Worldcoin Publishes Security Audit Reports, with Most Issues Resolved

Worldcoin said that, starting in April 2023, audit firms Nethermind and Least Authority conducted two separate security audits of the Worldcoin protocol, and the reports are now published, indicating 29 issues, most of which have been resolved.

Nethermind focused on an audit of the protocol’s smart contracts, which include the World ID contracts, the World ID state bridge, the World ID example airdrop contracts, the $WLD grants contracts, along with the $WLD ERC-20 token contract and its associated vesting wallet. Of the 26 items surfaced during this security assessment, 92.6% (24) were identified as fixed after the verification stage, while one was mitigated and the remaining one was acknowledged.

Least Authority’s focus was on the protocol’s use of cryptography, including its use of the Semaphore protocol as well as the enhancements made to scale the protocol in a more gas efficient manner. These include the protocol’s cryptographic design and implementation, the Rust implementation of the semaphore protocol and the Go implementation of the Semaphore Merkle Tree Batcher (SMTB). The team identified three issues and offered six suggestions, all of which have either been resolved or have planned resolutions. Least Authority said in its report, "we found that the cryptographic component of the Worldcoin Protocol is generally well-designed and implemented."