Web3 · Smart Contract Audit
Worldcoin
softstack completed a smart contract audit of Worldcoin's WLD Token in September 2023, reporting 6 findings (2 high, 1 medium, 1 low and 2 informational). The full report is published in the softstack public audit archive.
Key facts
- Client
- Worldcoin
- Completed
- Type
- Smart Contract Audit
- Chains
- Optimism, Ethereum
- Market cap
- $1.9B as of 2026-10-27
About the project
Worldcoin, now branded as World, is an identity network built by Tools for Humanity around World ID, a credential proving that its holder is a real person. Verification combines biometric iris imaging with zero-knowledge proofs so it can be presented without revealing identity. The WLD token launched in 2023 and is used in protocol governance, with contracts deployed on Ethereum and Optimism.
Findings
0 of 6 findings resolved before the final report.
| ID | Title | Severity | Status |
|---|---|---|---|
6.2.1 | Potential Loss Of User’s Funds On Optimism Due To Gas Limits Due to imprecise gas amount checks, malicious actors can lock user’s funds in the Optimism Portal by setting a specific gas amount on calling finalizeWithdrawalTransaction. | High | acknowledged |
6.2.2 | Permanent Locking Of User’s Withdrawals On Optimism An attacker can take advantage of the reentrancy guard protecting the relayMessage function to lock user’s funds permanently. | High | acknowledged |
6.2.3 | Permanent Locking Of User’s Tokens On Optimism On sending WLD token from Ethereum to Optimism, funds will be deposited in L1StandardBridge on Ethereum and received by L2StandardBridge on Optimism. | Medium | acknowledged |
6.2.4 | Missing Error Messages In the current implementation of the Worldcoin token contract, some functions hold several require checks without any error message on failure. | Low | acknowledged |
6.2.5 | Floating Pragma The current pragma Solidity directive is ^0.8.19; It is recommended to specify a fixed compiler version to ensure that the bytecode produced does not vary between builds. | Informational | acknowledged |
6.2.6 | Redundant Boolean Equality Check In the current implementation of the mintOnce function, the boolean variable initialMintDone is checked for equality with a boolean constant. This equality check is redundant and consumes gas unnecessarily. | Informational | acknowledged |
Methodology
Review process
Scoping and threat modelling
The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.
Automated analysis
Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.
Manual code review
Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.
Adversarial testing
Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.
Reporting
Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.
Remediation verification
Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.
Standards and references
- SWC RegistrySmart Contract Weakness Classification
- CWECommon Weakness Enumeration
FAQ
The review reported 6 findings: 2 high, 1 medium, 1 low and 2 informational. 0 of 6 were resolved or mitigated before the final report.
This report covers the code as reviewed in September 2023. Any code changed after that point is outside the reviewed scope.
Disclaimer
This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.