AIOil scanner re-runs Wormhole and Cashio audits with mixed results
Wormhole (W)
Editor:
Eugene Serbin
dev.to published a re-run of static analysis on Wormhole and Cashio using the AIOil Security Shield tool. The scanner identified the specific Wormhole bug that caused the $325M hack, noting that the instruction account was never checked against the real sysvar. It also found a High severity issue where transfer fees did not update bridge.last_lamports, and a Low severity issue regarding the guardian set size.
However, the tool misrated a post_message fee front-running risk as Medium, ignoring a comment that the behavior was intentional. On Cashio, the scanner missed the core vulnerability where validation checks compared only caller-supplied accounts without anchoring to a canonical root. It instead flagged new_bank as callable by anyone and suggested ignoring the finding if the design was intentional.
The analysis concluded that the scanner is blind to the pattern of unauthenticated initializers in validation chains. The tool is not a professional audit and does not guarantee the absence of vulnerabilities. Both programs have been patched for four years, so this is a historical re-run. The findings highlight that inconsistent severity ratings are a fixable defect in automated tools.
How the market reacted
Whalio's own Binance spot order flow for W, measured when this story was written up on 26 August 2026. Not the outlet's figures.
Wormhole (W) is trading at $0.009600 with a 1-hour buy ratio of 34.4%, which is lower than the 4-hour ratio of 50.8%. The 24-hour buy ratio stands at 50.9%, indicating that short-term selling pressure is higher than the recent average. Volume delta is negative -$10,831 in the last hour, contrasting with a positive $561 over four hours and $31,301 over 24 hours. This suggests that immediate buying interest is fading compared to the broader daily trend. Cumulative Volume Delta is positive $16,276, showing that net buying has occurred over the day despite recent outflows. Spot volume reached $1,552,442 with 24,901 trades in the last 24 hours.
The latest daily buy ratio of 50.1% sits at the 64th percentile of the last 322 days, against a median of 49.3% - ordinary for this coin.
Twenty-four hours later
What W did over the 23 hours after the story broke. The market moves for its own reasons; this is what happened, not what the story caused.
Was that an ordinary day?
The same Binance spot measurements for W, averaged over the days leading up to the story.
Over the preceding week, the 7-day average buy ratio was 49.5%, making the current 24-hour ratio of 50.9% slightly above average. Volume was 1.53x the weekly average, indicating significantly higher trading activity than usual. The price increased by 10.9% over eight days, with a total volume delta of -$55,633 for the period. This represents an unusual day for the coin, driven by volume 1.53x the average compared to the standard daily baseline. Net buying occurred on 3 of the last 7 days, showing intermittent rather than consistent accumulation.