Signature verification

The step in which a contract decides whether a message was really authorised by the keys it requires.

Why it matters

It is the boundary between “someone asked” and “the system agrees they may”. Where the check can be satisfied by input an attacker controls — a forged guardian set, an unchecked account, a skipped validation — the rest of the protocol’s security is bypassed rather than broken.

What you can check

Verification logic is the most-audited part of any bridge or vault, and audit reports state which functions perform it. The question is not whether signatures are checked, but whether every path that moves value passes through the check.

Where it showed up

Records in the Incident Tracker that turn on this: Wormhole signature verification exploit.