Worldcoin releases audit reports showing resolved security issues

29 July 2023

Cointelegraph By Tom Blackstone

The proof of humanity protocol released security audit reports claiming that most issues were fixed or mitigated.

News

Join us on social networks

Proof of humanity protocol Worldcoin released its audit reports on July 28 as criticism of its data collection practices continues to mount. The new reports were conducted by security consulting firms Nethermind and Least Authority.

According to an accompanying announcement from Worldcoin, Nethermind found 26 security issues with the protocol, of which 24 were “identified as fixed” during the verification phase, while one was mitigated and another was acknowledged.

Least Authority discovered three issues and made six suggestions, all of which “have been resolved or have planned resolutions,” the announcement stated.

Learn more about the results of two separate security audits of the Worldcoin protocol, performed by @NethermindEth & @LeastAuthority.https://t.co/fXa50wNBYE

— Worldcoin (@worldcoin)

July 28, 2023

Worldcoin first rose to prominence in 2021 when it announced that it would give away free tokens to any users who verify their humanity by having their iris scanned by a device called an “Orb.” The project was co-founded by Sam Altman, the co-founder of AI developer OpenAI.

At the time, Altman and other team members argued that AI bots would become an increasing problem on the internet if people didn’t find a way to verify their humanness without giving up their privacy. According to the protocol’s documentation, The Orb produces a hash of the user’s iris scan but does not keep a copy of the iris scan.

Related: Worldcoin confirms it is the cause of mysterious Safe deployments

Nethermind’s Worldcoin audit report. Source: GitHub

Worldcoin initiated its public launch on July 25 after nearly two years of development and beta testing. But criticism of it erupted almost immediately. The United Kingdom’s Information Commissioner’s Office (ICO) reportedly said the government body was deciding whether to investigate the project for violating the country’s data protection laws. French data protection agency — the National Commission on Informatics and Liberty — also questioned Worldcoin’s legality.

The crypto community was divided over the project’s launch, with some participants seeing it as the start of a dystopian future where privacy would be eliminated. In contrast, others saw it as a necessary step toward protecting humans against malicious artificial intelligence.

The new audit reports cover various security topics, including resistance to distributed denial of service attacks, case-specific implementation errors, key storage and proper management of encryption and signing of keys, data leaking and information integrity, and others. Some issues found resulted from dependencies on Semaphore and Ethereum, including “elliptic curve precompile support or Poseidon hash function configuration,” the announcement stated.

All issues except one were fixed, mitigated or have planned fixes. The one security issue that was not fixed by the time of verification has a severity of “undetermined” and is listed as “acknowledged.”

  

You might also like

Trump supports bill to buy 1 million BTC — Senator Lummis  
Trump supports bill to buy 1 million BTC — Senator Lummis  

US President Donald Trump supports the BITCOIN Act and has a team of experts in the White House working to roll out landmark digital asset legislation in the coming weeks, according to Wyoming Senator Cynthia Lummis. Speaking at the Bitcoin 2025 conference in Las Vegas, Nevada, Lummis said she is bringing the BITCOIN ACT to the “attention of the American people and the world,” adding that, “President Trump supports the bill.”In March, Lummis reintroduced the BITCOIN Act — landmark legislation that directs the US government to acquire 1 million Bitcoin (BTC) over five years. The acquisitions would be financed using existing funds within the Federal Reserve System and the Treasury Department. As Cointelegraph reported, the Trump administration has reiterated the need to use “budget-neutral ways” to acquire Bitcoin without burdening taxpayers.Source: CryptoGoosAt the Bitcoin Conference, Lummis said the Trump administration has a team working on “digital asset issues,” including legislation on stablecoins, market structure and the Bitcoin Strategic Reserve.“They will probably roll out in that order,” she said.“The Senate Banking Committee has passed the stablecoin bill out of committee,” said Lummis, adding: “We’re getting close to being ready to have it on the floor. We’ve worked for untold hours with the minority party to satisfy them, and we should be voting on it the week before we get back from this break.”Related: Senator Lummis’ new BITCOIN Act allows US reserve to exceed 1M BitcoinGENIUS Act on stablecoins is “going to pass,” says White House crypto czarThe White House seems to be in alignment with Senator Lummis. Last week, Trump’s top crypto adviser, David Sacks, said the GENIUS stablecoin bill is “going to pass” the Senate with bipartisan support after clearing a key procedural vote on May 19.On May 19, the Senate voted 66 to 32 to advance debate on the GENIUS Bill. Source: US SenateGENIUS refers to the Guiding and Establishing National Innovation for US Stablecoins Act, possibly the most comprehensive federal push to establish a legal framework for dollar-pegged stablecoins.Stablecoins have become one of the most prominent use cases for blockchain technology, with some industry advocates arguing that they could help extend the US dollar’s dominance as the global reserve currency.Collateralized, dollar-backed stablecoins like Tether’s USDt (USDT) and Circle’s USDC (USDC) account for more than 85% of the $250 billion market, according to CoinMarketCap.Related: Former CFTC chair criticizes STABLE Act amid calls for urgent regulatory clarity

Growing BTC reserve requires Congressional legislation — VanEck exec  
Growing BTC reserve requires Congressional legislation — VanEck exec  

Building a permanent US strategic Bitcoin reserve would likely require targeted legislation rather than executive action, according to VanEck’s head of digital assets, Matthew Sigel. Speaking at Bitcoin 2025 in Las Vegas, Sigel said the most viable path forward may involve inserting Bitcoin mining incentives into the congressional budget reconciliation process.According to Sigel, the most effective path to growing a US strategic Bitcoin reserve would be through targeted amendments to congressional budget legislation. These could include tax credits for mining companies that use methane gas and other incentives aimed at encouraging miners to share a portion of their mined BTC with the federal government. He argued that such an approach would allow the reserve to grow organically over time. Sigel also highlighted the limitations of executive actions in achieving this goal:”The problem with executive action is that it’s going to prompt lawsuits. And anything over $100 million is going to get sued by the Elizabeth Warrens of the world. So, I would say start with something maybe in the Exchange Stabilization Fund for $100 million.”US President Donald Trump established the US Bitcoin Strategic Reserve through a March 7 executive order. According to the order, the US government can only acquire Bitcoin through budget-neutral strategies or asset forfeiture, prompting a range of different ideas on how to add to the government’s stockpile of nearly 200,000 BTC.From left to right, Alex Thorn, Matthew Sigel, Matthew Pines and Fred Thiel. Source: Turner Wright/CointelegraphRelated: Bitcoin’s new highs may have been driven by Japan bond market crisisLawmakers, officials pitch different ideas to grow strategic Bitcoin reserveWyoming Senator Cynthia Lummis, the US lawmaker who introduced legislation for a Bitcoin strategic reserve in July 2024, proposed converting a portion of the gold certificates held by the US Treasury to Bitcoin.Converting gold to Bitcoin would allow the US government to purchase more Bitcoin without incurring a cost to the taxpayer, Lummis said.Bo Hines, the executive director of the President’s Council of Advisers on Digital Assets, echoed the idea in March 2025.Hines called on the US Treasury to revalue its gold holdings, which are currently priced at just $42.22 per troy ounce, and convert a portion of those gains to Bitcoin. This strategy would also be budget-neutral, Hines said.The price of gold reached an all-time high of $3,500 per ounce in April but experienced a minor pullback to around $3,300 on May 27.Magazine: TradFi fans ignored Lyn Alden’s BTC tip — Now she says it’ll hit 7 figures: X Hall of Flame

ZKPs can prove I'm old enough without telling you my age  
ZKPs can prove I'm old enough without telling you my age  

Opinion by: Andre Omietanski, General Counsel, and Amal Ibraymi, Legal Counsel at Aztec LabsWhat if you could prove you’re over 18, without revealing your birthday, name, or anything else at all? Zero-knowledge proofs (ZKPs) make this hypothetical a reality and solve one of the key challenges online: verifying age without sacrificing privacy. The need for better age verification todayWe’re witnessing an uptick in laws being proposed restricting minors’ access to social media and the internet, including in Australia, Florida, and China. To protect minors from inappropriate adult content, platform owners and governments often walk a tightrope between inaction and overreach. For example, the state of Louisiana in the US recently enacted a law meant to block minors from viewing porn. Sites required users to upload an ID before viewing content. The Free Speech Coalition challenged the law as unconstitutional, making the case that it infringed on First Amendment rights. The lawsuit was eventually dismissed on procedural grounds. The reaction, however, highlights the dilemma facing policymakers and platforms: how to block minors without violating adults’ rights or creating new privacy risks.Traditional age verification failsCurrent age verification tools are either ineffective or invasive. Self-declaration is meaningless, since users can simply lie about their age. ID-based verification is overly invasive. No one should be required to upload their most sensitive documents, putting themselves at risk of data breaches and identity theft. Biometric solutions like fingerprints and face scans are convenient for users but raise important ethical, privacy, and security concerns. Biometric systems are not always accurate and may generate false positives and negatives. The irreversible nature of the data, which can’t be changed like a regular password can, is also less than ideal. Other methods, like behavioral tracking and AI-driven verification of browser patterns, are also problematic, using machine learning to analyze user interactions and identify patterns and anomalies, raising concerns of a surveillance culture.ZKPs as the privacy-preserving solutionZero-knowledge proofs present a compelling solution. Like a government ID provider, a trusted entity verifies the user’s age and generates a cryptographic proof confirming they are over the required age. Websites only need to check the proof, not the excess personal data, ensuring privacy while keeping minors at the gates. No centralized data storage is required, alleviating the burden on platforms such as Google, Meta, and WhatsApp and eliminating the risk of data breaches. Recent: How zero-knowledge proofs can make AI fairerAdopting and enforcing ZKPs at scaleZKPs aren’t a silver bullet. They can be complex to implement. The notion of “don’t trust, verify,” proven by indisputable mathematics, may cause some regulatory skepticism. Policymakers may hesitate to trust cryptographic proofs over visible ID verification. There are occasions when companies may need to disclose personal information to authorities, such as during an investigation into financial crimes or government inquiries. This would challenge ZKPs, whose very intention is for platforms not to hold this data in the first place.ZKPs also struggle with scalability and performance, being somewhat computationally intensive and tricky to program. Efficient implementation techniques are being explored, and breakthroughs, such as the Noir programming language, are making ZKPs more accessible to developers, driving the adoption of secure, privacy-first solutions. A safer, smarter future for age verificationGoogle’s move to adopt ZKPs for age verification is a promising signal that mainstream platforms are beginning to embrace privacy-preserving technologies. But to fully realize the potential of ZKPs, we need more than isolated solutions locked into proprietary ecosystems. Crypto-native wallets can go further. Open-source and permissionless blockchain-based systems offer interoperability, composability, and programmable identity. With a single proof, users can access a range of services across the open web — no need to start from scratch every time, or trust a single provider (Google) with their credentials.ZKPs flip the script on online identity — proving what matters, without exposing anything else. They protect user privacy, help platforms stay compliant, and block minors from restricted content, all without creating new honeypots of sensitive data.Google’s adoption of ZKPs shows mainstream momentum is building. But to truly transform digital identity, we must embrace crypto-native, decentralized systems that give users control over what they share and who they are online.In an era defined by surveillance, ZKPs offer a better path forward — one that’s secure, private, and built for the future.Opinion by: Andre Omietanski, General Counsel, and Amal Ibraymi, Legal Counsel at Aztec Labs.This article is for general information purposes and is not intended to be and should not be taken as legal or investment advice. The views, thoughts, and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.