W
Neutral
Wormhole Scanner Misses Cashio Bug; W Spot Data Shows Mixed Sentiment
A dev.to post details a static analysis re-run on Wormhole and Cashio protocols using the AIOil Security Shield scanner. The tool correctly identified the critical bug in Wormhole's instructions sysvar but missed the structural validation flaw in Cashio. Cashio's scanner rated the issue as Medium and suggested ignoring it, whereas Wormhole's similar vulnerability was rated Critical. This inconsistency highlights how tools can misjudge severity even when detecting the underlying pattern. The findings emphasize that unauthenticated initializers in validation chains pose significant risks. Both protocols were patched years ago, and this analysis serves as a retrospective on scanner reliability.