Decode an unbacked mint caused by a spoofed verification account on Solana.
The Solana-side Wormhole program accepted a forged verification path because a supplied instruction-sysvar account was not properly validated. The selected complete_wrapped transaction minted 120,000 Wormhole ETH without a corresponding Ethereum deposit.
01
INVESTIGATOR BRIEF
Research question
Verify the 120,000-wETH mint transaction, identify the involved Solana accounts and programs, and keep the vulnerability explanation tied to technical sources.
Wormhole reported that the vulnerability was patched and the missing ETH was replenished to restore 1:1 backing.
02
PROVENANCE BEFORE CONCLUSION
Evidence ladder
Read these layers in order. A later layer may explain an observation, but it does not change what kind of evidence the underlying transaction is.
01 · on-chain fact
The Solana transaction executed and changed token balances
The signature, slot, account list, instructions, logs, fee, and pre/post balance data are available from Solana RPC data.
02 · source-reported context
Technical analysis identifies a spoofed sysvar verification path
CertiK and independent researchers connect the earlier verify_signatures sequence to the complete_wrapped mint and explain the missing account validation.
03 · bounded inference
The mint was unbacked because no corresponding deposit authorized it
The incident record supports the unbacked-mint conclusion. The selected transaction alone does not reproduce every earlier preparation step or prove a human identity.
A ChainRadar result is one observation. Compare it with an independent ledger, official record, or technical source and record both agreement and discrepancy.
01
The selected signature is the 120,000-wETH complete_wrapped mint.
ChainRadar check
Solana decoder instructions, accounts, logs, and balance deltas
Independent check
Solscan record and CertiK incident analysis
Expected agreement
Signature and involved accounts agree; CertiK supplies the 120,000-wETH interpretation.
02
The transaction interacted with the official Wormhole Token Bridge program.
ChainRadar check
Decoder program/account list
Independent check
Wormhole official contract-address reference
Expected agreement
The program ID matches wormDTUJ6AWPNvk59vGQbDvGJmqbDTdgWgAqcLBCgUb.
03
A spoofed sysvar account bypassed guardian verification.
ChainRadar check
The seed transaction supplies accounts and execution evidence, not the complete root-cause proof
Independent check
CertiK analysis plus the earlier verify_signatures transaction
Expected agreement
Root cause remains a technical-source conclusion, not a label inferred by ChainRadar.
07
REPORTING STANDARD
Calibrated findings
Supported conclusions
The selected Solana signature is a reproducible transaction-level anchor for the unbacked mint.
Program IDs can be checked against Wormhole's official deployment registry.
The verification-bypass explanation requires the earlier transaction sequence and technical analysis.
Required limitations
One Solana transaction does not reconstruct every forged-message preparation step.
Solana token balance interpretation depends on program encoding and provider completeness.
The address graph does not identify the human operator.