World security record
As of 1 Nov 2026, World has 12 audit reports by 1 security firm on Trustblock; the latest is by Nethermind Security, dated 9 Jun 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits12
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| World Rollup Boost security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Wld Vault security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Operator security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Identity Manager security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Worldcoin Grants4 security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World Minikittransfer security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Worldcoin - security review | Security firm: Nethermind Security | Date: | Scope: Repository at commit 42c26ec | No open critical findings | Open · IPFS |
| World security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
Findings20
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 0 |
| Medium | 1 | 1 | 2 |
| Low | 0 | 3 | 11 |
Marked Best Practices or Info by the firms. Not counted as findings.
Best PracticesConcurrency in serverWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Acknowledged
The report gives no description here.
Open the reportBest PracticesLogic of forwarding requests should be improvedWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Acknowledged
The report gives no description here.
Open the reportBest PracticesSilent failures of tokio::spawnWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Acknowledged
The report gives no description here.
Open the reportInfoChanges to yieldRate cause wrong computation of rewardsWorld Wld Vault security review · Nethermind Security · 16 May 2025Acknowledged
The report gives no description here.
Open the reportBest PracticesMissing address(0) checksWorld Wld Vault security review · Nethermind Security · 16 May 2025Acknowledged
The report gives no description here.
Open the reportInfoThe AllowanceModule cannot be changed after it is setWorld Wld Vault security review · Nethermind Security · 16 May 2025Acknowledged
The report gives no description here.
Open the reportInfoUsers must trigger calculateInterest(...) whenever their verified endTime changes to receive the correct rewardsWorld Wld Vault security review · Nethermind Security · 16 May 2025Acknowledged
The report gives no description here.
Open the reportInfoUsers that refresh interest often, accrue the yield faster due to compoundingWorld Wld Vault security review · Nethermind Security · 16 May 2025Acknowledged
The report gives no description here.
Open the reportInfoUsers don’t have any control over some parameters when using the relayerWorld security review · Nethermind Security · 28 Aug 2024Acknowledged
The report gives no description here.
Open the reportBest PracticesMissing inputs validationWorld security review · Nethermind Security · 23 Jul 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
InfoPayable verify(...) function may lead to locked EtherWorld security review · Nethermind Security · 23 Jul 2024Acknowledged
The report gives no description here.
Open the reportInfoPossible phishing attack due to the use of tx.origin in the onlyRelayer(...) modifierWorld security review · Nethermind Security · 29 Apr 2024Acknowledged
The report gives no description here.
Open the reportBest PracticesUnchecked return values of transfer(...) and transferFrom(...) callsWorld security review · Nethermind Security · 29 Apr 2024Acknowledged
The report gives no description here.
Open the reportInfoWithdrawal fee can be bypassed for small sDAI amountsWorld security review · Nethermind Security · 29 Apr 2024Acknowledged
The report gives no description here.
Open the reportBest PracticesFloating pragmaWorldcoin - security review · Nethermind Security · 12 Oct 2023Acknowledged
The report gives no description here.
Open the reportInfoPossible duplicate roots block propagating root to L2 contractsWorldcoin - security review · Nethermind Security · 12 Oct 2023Acknowledged
The report gives no description here.
Open the reportInfoboost_sync flag can cause discrepancies between builder and L2 op-gethWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportInfoCI GitHub Action actions-rs unmaintainedWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportBest PracticesCI use cargo denyWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportInfoCode inside the is_fallback_enabled() branch may not be reachableWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportShow 10 more
Best PracticesDifferent conditions for cache insertion/evictionWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportBest PracticesDo not clone payload in rpc|new_payload_v3World Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportBest PracticesDo not clone payload in server|fcu_v3World Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportInfogetPayload requests to builder when FCU no_tx_pool is trueWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportInfoIncoming requests have a large size limitWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportBest PracticesUsing expect and unwrap in the codeWorld Rollup Boost security review · Nethermind Security · 9 Jun 2025Fixed
The report gives no description here.
Open the reportInfoHigh minWldPrice can lead to zero tokenAmountWorld Operator security review · Nethermind Security · 14 May 2025Fixed
The report gives no description here.
Open the reportBest PracticesMissing event emission in the setRelayer functionWorld Operator security review · Nethermind Security · 14 May 2025Fixed
The report gives no description here.
Open the reportBest PracticesMissing validation for zero dollarAmountWorld Operator security review · Nethermind Security · 14 May 2025Fixed
The report gives no description here.
Open the reportBest PracticesComments/Natspec notesWorld Identity Manager security review · Nethermind Security · 5 Feb 2025Fixed
The report gives no description here.
Open the reportShow 10 more
Best PracticesMissing zero address checks in Grants4FirstBatchWorld security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportBest PracticesMissing zero address checks in Grants4FirstBatchWorldcoin Grants4 security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportBest PracticesThird-party code should be imported and installed as an external dependencyWorld security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportBest PracticesThird-party code should be imported and installed as an external dependencyWorldcoin Grants4 security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportBest PracticesUnused code in Grants4FirstBatch contractWorld security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportBest PracticesUnused code in Grants4FirstBatch contractWorldcoin Grants4 security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportBest PracticesUnused importsWorld security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportBest PracticesUnused importsWorldcoin Grants4 security review · Nethermind Security · 23 Sep 2024Fixed
The report gives no description here.
Open the reportInfoIncorrect commentWorld security review · Nethermind Security · 28 Aug 2024Fixed
The report gives no description here.
Open the reportBest PracticesSafeERC20 is declared but not usedWorld security review · Nethermind Security · 28 Aug 2024Fixed
The report gives no description here.
Open the reportShow 10 more
Best PracticesThe USDVault rounds up when giving assets outWorld security review · Nethermind Security · 28 Aug 2024Fixed
The report gives no description here.
Open the reportBest PracticesUnused events and errorsWorld security review · Nethermind Security · 28 Aug 2024Fixed
The report gives no description here.
Open the reportBest PracticesAvoid the usage of magic numbersWorld security review · Nethermind Security · 23 Jul 2024Fixed
The report gives no description here.
Open the reportBest PracticesRedundant check in refresh(...) functionWorld security review · Nethermind Security · 23 Jul 2024Fixed
The report gives no description here.
Open the reportBest PracticesThe verify(...) function does not follow C-E-I patternWorld security review · Nethermind Security · 23 Jul 2024Fixed
The report gives no description here.
Open the reportBest PracticesThe WalletVerified event is not emitted in the verify(...) functionWorld security review · Nethermind Security · 23 Jul 2024Fixed
The report gives no description here.
Open the reportInfoThe safeTransferFromInternal(...) function can be directly invoked by the RelayerWorld Minikittransfer security review · Nethermind Security · 2 Jul 2024Fixed
The report gives no description here.
Open the reportBest PracticesA frequently used number literal 10_000 could be made constantWorld security review · Nethermind Security · 29 Apr 2024Fixed
The report gives no description here.
Open the reportBest PracticesMissing input validationsWorld security review · Nethermind Security · 29 Apr 2024Fixed
The report gives no description here.
Open the reportBest PracticesPerform input validation before external callsWorld security review · Nethermind Security · 29 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
InfoPossible underflow within redeem functionsWorld security review · Nethermind Security · 29 Apr 2024Fixed
The report gives no description here.
Open the reportBest PracticesThe MIN and MAX DSR conversion rate state variables could be made constantWorld security review · Nethermind Security · 29 Apr 2024Fixed
The report gives no description here.
Open the reportInfoThe onlyRelayer(...) modifier reverts with an incorrect relayer addressWorld security review · Nethermind Security · 29 Apr 2024Fixed
The report gives no description here.
Open the reportBest PracticesThe validateConversionRate(...) function name contains a typoWorld security review · Nethermind Security · 29 Apr 2024Fixed
The report gives no description here.
Open the reportBest PracticesAbsence of event emission during contract initializationWorldcoin - security review · Nethermind Security · 12 Oct 2023Fixed
The report gives no description here.
Open the reportBest PracticesFunction deleteIdentities(...) has different access control than stated in the documentationWorldcoin - security review · Nethermind Security · 12 Oct 2023Fixed
The report gives no description here.
Open the reportBest PracticesMissing input validation in some functionsWorldcoin - security review · Nethermind Security · 12 Oct 2023Fixed
The report gives no description here.
Open the reportBest PracticesOutdated NatSpec documentation and comments in V2 implementationWorldcoin - security review · Nethermind Security · 12 Oct 2023Fixed
The report gives no description here.
Open the reportBest PracticesUsed event marked as unused in the documentationWorldcoin - security review · Nethermind Security · 12 Oct 2023Fixed
The report gives no description here.
Open the reportInfoDouble initialization of the tree depthWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportShow 5 more
Best PracticesLack of events for relevant operationsWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportBest PracticesLow-level calls may cause errorsWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportBest PracticesNon-private functions are not virtualWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportBest PracticesPresence of unused variablesWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportInfoUnnecessary storage writesWorld security review · Nethermind Security · 22 May 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="worldcoin"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us