Bridge tracks nonce-consumed mapping

Lido's assessment for RD-F-153 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Wormhole NTT uses consumed-VAA hash tracking (_consumedVAAs mapping). isVAAConsumed(vm.hash) check before processing; TransferAlreadyCompleted on replay. NTT EndpointManager provides additional replay protection. Native L2 bridges delegate to chain-level CrossDomainMessenger replay protection.

Detail #

WormholeTransceiverState.sol: 'mapping(bytes32 => bool) storage' for consumed VAAs. isVAAConsumed(vm.hash) checked before processing. Joint bridge proposal: 'Replay protection is implemented both by Endpoint contracts (Wormhole & Axelar message replay protection) and the EndpointManager contract.'

Sources #

Governance
https://research.lido.fi/t/wormhole-x-axelar-lido-bridge-implementation-for-wsteth-on-bnb-chain/6012retrieved 2026-04-28
GitHub
https://github.com/wormhole-foundation/native-token-transfers/blob/main/evm/src/Transceiver/WormholeTransceiver/WormholeTransceiverState.solretrieved 2026-04-28

Methodology #

Determine whether the bridge inbox maintains a nonce-consumed mapping and rejects replay of used nonces.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol lido factor RD-F-153 score green collected_at 2026-04-28 13:58:42