World security review
Audit · firm’s term: security review
Nethermind Security reviewed World (World security review) on 22 May 2023: 9 findings, 2 critical; 7 marked fixed, 1 acknowledged, 1 open.
2 critical findings, fixed
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 0 |
| Medium | 1 | 0 | 1 |
| Low | 0 | 1 | 4 |
CriticalAirdrops’ funds can be stolen from the WorldIDMultiAirdrop contractFixed
The report gives no description here.
CriticalOld roots can allow invalid proofs to be submitted as valid in the contract WorldIdBridgeFixed
The report gives no description here.
MediumPolygonWorldID sender and receiver can be set by any addressFixed
The report gives no description here.
LowAbsence of ROOT_HISTORY_EXPIRY update mechanism in StateBridge contractFixed
The report gives no description here.
LowactionId is hashed two times in WorldIDAirdrop contractFixed
The report gives no description here.
LowLack of a two-step process for transferring ownershipFixed
The report gives no description here.
LowNonExistentRoot() may not be executed for nonexistent rootsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of World’s security record
WorldAudits12 audits by 1 firmLast audit Jun 2025, by Nethermind Security.
Critical findingsNo open critical findingsAcross the 12 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open World’s security recordSecurity firm
Nethermind Security57 projects reviewed · 81 reports · latest Sep 2026
See Nethermind Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us