From Origin to Evolution: A Comprehensive Understanding of Wormhole

Source: Wormhole CN

This article is an excerpt from "The State of Solana's Bridging Landscape," jointly published by LI.FI and Four Pillars. The report focuses on the analysis and research of the current state of the Solana bridging ecosystem, exploring three parts: messaging protocols on Solana, cross-chain exchange applications on Solana, and interesting developments in Solana's interoperability scenarios. The report provides a detailed analysis of Wormhole, and this article only includes the parts related to Wormhole. Users interested in the full report can find the original link at the end of this article.

Part 1 Overview of Wormhole

Wormhole is a universal messaging protocol launched in October 2020, designed to enable developers to build native cross-chain applications that span multiple chains. Wormhole initially started as a hackathon project aimed at finding a solution for blockchains to "communicate" with each other.

Wormhole was originally incubated and supported by Jump, with its first version (Wormhole V1) primarily focused on establishing a bi-directional token bridge between Ethereum and Solana. As the project evolved, Wormhole has transformed into a universal messaging protocol that connects multiple chains within the ecosystem. This evolution aligns with its broader vision of becoming the foundational layer for developers to build diverse cross-chain applications. Consequently, Wormhole V1 was gradually phased out, and the Wormhole protocol was launched in August 2021.

Part 2 Product Services

To meet the growing demand of the multi-chain ecosystem, many cross-chain native applications and products have been built on Wormhole, including products developed by the Wormhole team itself:

• Wormhole Messaging: A decentralized messaging protocol that allows blockchain developers to securely and easily implement the flow of information and value with other networks. The modular open-source protocol enables developers to customize tools according to the needs of their chain or application.
• Wormhole Connect: An in-app bridging widget that allows developers to integrate a Portal-like token bridging interface into their applications. It provides developers with a simple and quick way to add bridging functionality to their apps.
• Wormhole Gateway: A specific application blockchain built to enhance connectivity between Cosmos-based application chains and the broader ecosystem, using a liquidity router as a unified liquidity layer between Cosmos chains. This tool is beneficial for developers looking to attract users and liquidity to their Cosmos application chains, as well as for users wishing to bridge funds to the Cosmos ecosystem. The Gateway is currently open to developers and serves users through Portal.
• Wormhole Queries: A cross-chain data querying tool that enables applications to read on-chain data from any EVM chain within the Wormhole ecosystem. This data is validated by a 2/3 supermajority of 19 Wormhole Guardians. The product is still in its early stages, with Synthetix expected to be an early adopter.

Read “Wormhole Ecosystem Developer Guide: Four Core Products, Three Ecosystem Plans, Up to $250,000 in Funding Support” for detailed information about these products.

These products are further supported by several developer-friendly solutions and features provided by the Wormhole team (many of which are now built and maintained by Wormhole contributors), such as:

• xAssets: Assets that can be bridged without slippage on any Wormhole-supported chain. For example: Pyth Network recently launched its governance token $PYTH as a Wormhole xAsset, making it available for users on 27 chains.
• Automatic Relayers: A network of relayers that can transmit messages across any Wormhole-supported chain. This feature allows developers to build cross-chain applications on Wormhole without having to set up and maintain their own off-chain relayers.
• Wormholescan: A cross-chain block explorer and analytics platform covering the Wormhole ecosystem. This tool can be used to track cross-chain transactions and understand network activity across the entire Wormhole ecosystem.

Part 3 Network Effects

Considering Wormhole's early development and ongoing focus on the Solana ecosystem, it is not surprising that Solana has become one of the most active chains on Wormhole in terms of transaction volume. Currently, its transaction volume is primarily distributed across Ethereum, Solana, and Sui, followed by other EVM L1 chains and L2 (Rollup).

Factors that have facilitated Wormhole's growth and positioned it as one of the top messaging protocols in the ecosystem include:

• Over 200 projects built on Wormhole ------ Wormhole has established a diverse range of application scenarios within the ecosystem, with many applications using it to build use cases such as liquidity bridges (Allbridge, Mayan, Magpie), multi-chain tokens (PYTH), token standards (Nexa), integrating Wormhole Connect for in-app bridging (Astroport, Uniwhale, YouSUI), cross-chain deposits (Friktion, PsyOptions, Aftermath Finance), etc.
• Wormhole x NFTs ------ Wormhole's cross-chain NFT standard has been widely adopted by Dust Labs, migrating its NFT collections DeGods and y00ts from Solana to Ethereum and Polygon. This NFT standard is also used by the Aptos NFT bridge, allowing developers and users to bridge NFTs to the Aptos network or transfer them out from Aptos.
• Wormhole's $50 million cross-chain ecosystem fund ------ The $50 million cross-chain ecosystem fund provides financial support to developers building cross-chain applications utilizing Wormhole's messaging infrastructure. This fund is managed and operated by Borderless Capital, with backing from renowned investment institutions such as Jump Crypto, Polygon Ventures, and Solana Foundation.
• xGrant program ------ In early 2023, Wormhole launched the xGrant program aimed at supporting developers, researchers, and founders. This program not only provides financial support but also offers guidance and resources to foster the development of innovative projects. These grants cover various expenses and expenditures for developers, including software development, marketing, team costs, and project growth expansion.
• Bitcoin tBTC on Solana ------ Threshold Network introduced tokenized Bitcoin (tBTC) on Solana, using Wormhole to mint the tokens. This marks the first expansion of tBTC into a non-EVM ecosystem, enabling users to utilize Bitcoin within the Solana DeFi ecosystem.
• Wormhole x Uniswap ------ Wormhole's status as a secure messaging protocol within the ecosystem has been significantly enhanced, thanks to Uniswap's cross-chain bridge evaluation committee recognizing and approving Wormhole for all cross-chain deployments on Uniswap after a comprehensive assessment of six different cross-chain protocols. Additionally, Uniswap actively uses Wormhole for cross-chain messaging, particularly in collaboration with chains like Celo, further solidifying Wormhole as a reliable choice for secure messaging needs.
• Wormhole x Circle CCTP ------ Wormhole has successfully integrated Circle's Cross-Chain Transfer Protocol (CCTP), making it accessible to other applications through Wormhole Connect and available to users via Portal Bridge. The anticipated launch of CCTP on Solana has generated significant interest in the community, with teams like Jupiter announcing plans to integrate it into their own applications through collaboration with Wormhole.
• Wormhole's $225 million funding, $2.5 billion valuation ------ Wormhole recently achieved a significant funding milestone, completing a new round of funding totaling $225 million, with the project valued at $2.5 billion. This substantial funding highlights the strength of the Wormhole team, the widespread adoption of its products, and the overall quality of its product services. This funding announcement has also attracted the attention of Airdrop Farmers, who are now closely monitoring and comparing Wormhole with LayerZero, considering Wormhole a "strong competitor in the interoperability space." With the Solana airdrop season underway and various strategic initiatives by Wormhole, such as offering "early" roles to Discord users, significant attention from Airdrop Farmers is expected in the near future.

Part 4 Security Audit

Audit

The architecture of Wormhole consists of several key components, such as guardian nodes for different chains and execution environments, and smart contracts. Each part of their tech stack has undergone a total of 22 audits by security firms including Neodyme, Kudelski, Trail of Bits, CertiK, Runtime Verification, OtterSec, and Zellic. It is worth noting that while we count each entry as a separate audit, these contract-specific audits are likely part of a larger audit of the Wormhole tech stack.

Bug Bounty

Since September 2022, Wormhole has operated a $2.5 million bug bounty program on Immunefi, primarily focusing on the security of Wormhole's smart contracts and guardian nodes.

Additional Security Layers

In February 2022, Wormhole briefly experienced a security attack, but the vulnerability was fixed within a few hours, and Wormhole quickly came back online and restored the network, with Jump providing the necessary funds to cover the loss.

Following this security incident, the Wormhole team announced the following future security measures:

• Continuous Audits: Comprehensive and ongoing audits of the Wormhole codebase to prevent potential future vulnerabilities.
• Building Advanced Monitoring Tools: Developing features and components such as accounting mechanisms and monitoring tools to isolate inter-chain risks and detect threats early, ensuring successful dynamic risk management.
• Launching a Bug Bounty Program: Wormhole launched a bug bounty program on Immunefi shortly after the attack occurred.

In light of these security upgrades, Uniswap's cross-chain bridge evaluation committee acknowledged Wormhole's efforts in their report, stating:

"Following the vulnerability attack, Wormhole made substantial improvements to its practices, such as improved implementation processes, clearer incident response plans, and robust unit testing. These improvements are commendable and demonstrate the protocol's development and maturity."

Additionally, Wormhole has incorporated several security features into its tech stack, including:

• Global Accountant: This tool monitors the total circulating supply of all Wormhole assets on all chains. Essentially, it prevents any blockchain from moving assets beyond the actual allowed amount.
• Governor: Complementing the Global Accountant, the Governor tracks the inflow and outflow of all on-chain assets. If the value of a cross-chain message is too large, it has the authority to delay suspicious transfers and limit the impact of potential exploits by allowing guardian nodes to hold the message for 24 hours. Furthermore, it can act as a rate limiter for nominal inter-chain traffic, which is particularly beneficial for newer, less tested chains. As the ecosystem of a chain matures, the limits set by the Governor can be adjusted.
• Open Source Codebase: By making its code repository open source, Wormhole effectively lowers the barriers for white-hat hackers to identify and report vulnerabilities.
• Comprehensive Monitoring via Guardians: Wormhole Guardians are professional validation companies with expertise in running, monitoring, and securing blockchain operations. They continuously track activities at the blockchain and smart contract levels and ensure the security of the Wormhole network using tools like the Governor.
• ZK Integration Coming to Wormhole: Wormhole is actively working on integrating zero-knowledge (ZK) proof validation into its tech stack.

Part 5 Growth Data

As of December 31, 2023, Wormhole's growth data is as follows:

Part 6 How It Works

The process of transmitting messages from the source chain to the target chain through Wormhole's architecture is both complex and straightforward. Here is a simplified breakdown:

1) Sending a Message: Each message originates from the core contract on the source chain.

2) Guardians Verify and Sign: The message is then verified and signed off-chain by 19 guardian nodes. Only messages that receive signatures from at least 2/3 (i.e., 13/19) of the guardian nodes are considered authentic.

3) Transmitted to the Target Chain: After verification and signing, the message is transmitted to the core contract on the target chain.

Looking more closely, we can see several key components working together to ensure secure cross-chain messaging:

Let’s delve into how Wormhole's Guardian Network verifies messages:

Step 1: The core contract on the source chain sends out the message.

Step 2: Guardians observe and verify the authenticity of the message.

Step 3: Guardians wait for the final confirmation message from the source chain, then the hash of that message is signed to prove its validity.

Step 4: The signatures from each Guardian are compiled into a multi-signature file known as Verifiable Action Approvals (VAA).

Step 5: Relayers transmit the VAA to the core contract on the target chain.

Note: "Spies" will observe all messages transmitted through the Guardian network and record them in a storage system (such as an SQL database) for analysis and further use.