Arbitrary call with user-controlled target
Wormhole's assessment for RD-F-013 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
`Governance.sol` `submitTransferFees()` performs `recipient.transfer(transfer.amount)` where recipient is extracted from a VAA. This is a native-ETH transfer (not an arbitrary calldata call). `Bridge.sol` uses SafeERC20.safeTransfer() and SafeERC20.safeTransferFrom() for ERC-20 movements; no arbitrary external call with user-controlled calldata found.
Sources #
- Curator noteExtracted from 01-code-security.md — RD-F-013 finding; no URL cited in originalretrieved 2026-04-28
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol wormhole factor RD-F-013 score green collected_at 2026-04-28 01:38:43