Wormhole Review

How Wormhole scores in bridges

This entry rates Wormhole, the cross-chain messaging protocol behind token transfer products such as Wrapped Token Transfers (WTT), Native Token Transfers (NTT) and the Portal app, in our bridge ranking. The basis is desk research of Wormhole's documentation and the wormhole-foundation GitHub repository, checked on November 6, 2026. No transfer was made. The category uses five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.

The overall score is the plain average: (5 + 10 + 9 + 9 + 10) / 5 = 43 / 5 = 8.6.

Three marks changed at this check, and the overall rose from 6.8 to 8.6. Chain coverage rose from 3 to 9. The earlier review treated the split product tables as no answer, but each table is a checkable mainnet list, and the rubric scores a published list. Audit disclosure rose from 9 to 10 now that the security page names all ten firms behind its 29 audits. Fee transparency rose from 3 to 5 for the core-contracts statement that messages carry no fee outside Solana and a documented quote mechanism for delivery. Both the chain and fee marks were first set at 8 and 4 and then aligned with the scale the category applies to every bridge: 25 or more documented networks score 9, and a charged fee explained as a mechanism without a published rate scores 5.

Strongest criteria: trust model and audits

Trust model disclosure scores 10. Wormhole states its assumption in numbers. A supermajority of 13 of 19 guardians can pass any message and any governance action, including contract upgrades and changes to the guardian set itself. A minority of 7 can censor by refusing to sign. The guardians are established staking and infrastructure firms rather than validators selected by token stake. The docs also name the newer per-chain weak point. On chains with a delegated guardian set, a subset observes events for the whole set, which adds a per-chain trust assumption to the observation layer. SECURITY.md explains why Wormhole chose not to build an emergency pause and relies on guardian governance to patch contracts instead.

Wormhole also documents its own incident history. Its Governor design document says that on February 2, 2022, a vulnerability in the Solana core contract was exploited to mint wETH on Solana, and it links Wormhole's incident report. The Governor followed from it. Each guardian can delay large token-bridge transfers by 24 hours once they cross per-chain limits, and the document states that the Governor "can only reduce the impact of an exploit, but not prevent it." Because Wormhole documents the incident itself, we report it here. The rubric has no incident criterion, so it does not move a mark.

Audit disclosure scores 10: 29 audits, ten named firms, and the reports themselves in public folders, including product-specific ones such as Native Token Transfers. Audits are point-in-time reviews, not insurance.

Weakest criterion: fees

Fee transparency at 5 is a deficiency. Wormhole states one figure, that core message publishing is free except on Solana, and flags that it may change. It does not give the Solana amount. The cost a user actually pays is the destination-chain execution fee, which the Executor framework sets through signed quotes from relay providers. That is a mechanism, not a price. Any fee added by Portal or another front end sits outside Wormhole's docs altogether. A reader cannot look up what a transfer will cost before requesting a quote.

Chain coverage and licence both score 9, each a point short of the top for reasons that are about presentation, not openness. Coverage is split by product, with 33 mainnet chains in the largest table, and the docs warn that a chain's presence in the documentation does not mean it is currently connected. The Apache 2.0 licence is stated as a short-form notice rather than the full text.

What the score does not cover

• The identity and independence of each guardian. The set is published on Wormhole's dashboard, but the rubric does not grade the operators.
• The security of connected chains. Wormhole flags chains that fall short of its integrator standards, and a compromised source chain can still produce bad messages.
• The W token, its 2025 unlock changes and any staking yield.
• Third-party front ends, including the fees they add.

Our guide to how bridges work and why they are risky explains why the size and independence of a signer set matter.

Wormhole vs Axelar and Across

On current category marks, Axelar and Wormhole share first place at 8.6, and Across is sixth of nine at 7.2. Under the site's tie rule the order is alphabetical, so Axelar is listed first and Wormhole second of nine. Axelar is the closest design, a messaging network secured by a signer set. The two are level on fees (5 each), chain coverage (9 each) and audits (10 each); Axelar leads on licence (10 to 9) and Wormhole on trust model (10 to 9). Across shares Wormhole's 10 on trust model with an optimistic design and is level on fees and chains. Wormhole leads it on licence (9 to Across's BUSL-1.1 at 4) and audits (10 to 8).

Who this rating suits

The score suits a reader or integrator who wants to know exactly who can move or censor a cross-chain message, and what has been audited. It is less useful for estimating the cost of a single transfer, which depends on the app and relay quote in front of you. The rating is not a recommendation. Before bridging, check which Wormhole product the app uses (wrapped tokens, native token transfers or CCTP), since each has its own contracts and limits.