Code complexity vs audit coverage
Wormhole's assessment for RD-F-024 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Wormhole spans 5 language stacks (Solidity, Rust, Move, Go, Python) across 35+ chains. The total codebase complexity is exceptional for a bridge protocol. However, 29 third-party audit engagements by 14 firms calibrated to each language and component represent very high coverage density relative to complexity. No audit has flagged audit-coverage-inadequacy as a concern for a specific component. Individual components (e.g., EVM core bridge) have had 4+ independent firms cover them.
Sources #
- Curator noteExtracted from 01-code-security.md — RD-F-024 finding; no URL cited in originalretrieved 2026-04-28
Methodology #
Determine whether the cyclomatic complexity or LOC-per-audit-day ratio exceeds the curator-declared credibility threshold for the audit to be meaningful.
See the full factor methodology and distribution across all protocols →