ERC-777/1155/721 hook without reentrancy guard
Wormhole's assessment for RD-F-015 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Bridge handles arbitrary ERC-20 tokens through `safeTransfer`/`safeTransferFrom` pattern. NFT Bridge handles ERC-721. ReentrancyGuard in Bridge.sol provides protection. No specific hook-exploitation finding in published audits. However, the breadth of token types supported across 35+ chains creates surface area for edge-case hook interactions not all individually tested.
Sources #
- Curator noteExtracted from 01-code-security.md — RD-F-015 finding; no URL cited in originalretrieved 2026-04-28
Methodology #
Determine whether the protocol integrates token standards with callbacks (ERC-777 tokensReceived, ERC-1155 onReceived, ERC-721 onReceived) without reentrancy guards on the affected functions.
See the full factor methodology and distribution across all protocols →