WORMHOLE BRIDGEWORMHOLE BRIDGEWORMHOLE BRIDGE
$326M EXPLOIT

  1pub fn verify_signatures(
  2    ctx: &ExecutionContext,
  3    accs: &mut VerifySignatures,
  4    data: VerifySignaturesData,
  5) -> Result<()> {
  6    // BUG: No validation that instruction_acc is the real sysvar!
  7    // User can pass ANY account here and it will be trusted
  8    let instruction = load_instruction_at(
  9        data.instruction_index as usize,
 10        &accs.instruction_acc,  // <-- Attacker provides fake account
 11    )?;
 12
 13    // Check that Secp256k1 was called
 14    if instruction.program_id != secp256k1_program::id() {
 15        return Err(ProgramError::InvalidArgument);
 16    }
 17
 18    // THE FLAW: Attacker's fake account claims signatures valid
 19    // Real Guardians never signed anything!
 20}