World security record
As of 1 Nov 2026, World has 12 audit reports by 1 security firm on Trustblock; the latest is by Nethermind Security, dated 9 Jun 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits12
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| World Rollup Boost security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Wld Vault security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Operator security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Identity Manager security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Worldcoin Grants4 security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Minikittransfer security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Worldcoin - security review | Security firm: Nethermind Security | Date: | Scope: Repository at commit 42c26ec | No open critical findings | Open · IPFS |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
Findings20
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 0 |
| Medium | 1 | 1 | 2 |
| Low | 0 | 3 | 11 |
CriticalAirdrops’ funds can be stolen from the WorldIDMultiAirdrop contractWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportCriticalOld roots can allow invalid proofs to be submitted as valid in the contract WorldIdBridgeWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportMediumServer listening on all interfaces by default, without authenticationWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportMediumPolygonWorldID sender and receiver can be set by any addressWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportLowJWT tokens timestamped 60 seconds into the futureWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportLowPossible execution_mode inconsistency in get_payloadWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportLowUse of sync::Cache in an async contextWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportLowPotential use of stale WLD price in payout calculationsWorld Operator security review · Nethermind Security · 14 May 2025Fixed
The report gives no description here.
Open the reportLowIncorrect check in _withdraw(...) function could prevent valid withdrawalsWorld security review · Nethermind Security · 23 Jul 2024Fixed
The report gives no description here.
Open the reportLowPotential interest loss due to Address Book and verification length changesWorld security review · Nethermind Security · 23 Jul 2024Fixed
The report gives no description here.
Open the reportShow 5 more
LowInvalid batchSize can result in incorrect hash calculationWorldcoin - security review · Nethermind Security · 12 Oct 2023Fixed
The report gives no description here.
Open the reportLowAbsence of ROOT_HISTORY_EXPIRY update mechanism in StateBridge contractWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportLowactionId is hashed two times in WorldIDAirdrop contractWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportLowLack of a two-step process for transferring ownershipWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportLowNonExistentRoot() may not be executed for nonexistent rootsWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="worldcoin"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us