Trail of Bits Audit Finds Worldcoin’s Orb Software Secure, No Vulnerabilities Detected

According to a draft report from the Worldcoin development team, a third-party audit by Trail of Bits has found no vulnerabilities in the Orb software. The audit, seen by Cointelegraph, stated that there were no exploitable vulnerabilities related to the project’s goals. The full report is expected to be released on March 14.

Worldcoin’s Orb software allows users to verify their humanity using a phone number, email address, or iris scan. Co-founded by Sam Altman, the project aims to prevent AI bots from impersonating humans effectively.

Privacy concerns have been raised regarding Worldcoin’s iris scanning feature, with fears that users’ iris scans could be leaked to hackers or governments, potentially compromising their activity associated with their World ID.

The audit by Trail of Bits, conducted over six weeks starting on Aug. 14, 2023, focused on version 3.1.10 of the Orb software. The auditors did not find any vulnerabilities that could be directly exploited in relation to the project’s goals. They concluded that obtaining a user’s iris code would require control of one of the trusted certificates, which typical attackers would not have access to.

Although the auditors recommended two improvements for security, including strengthening the signup flow configuration and replacing the ZBar library, Worldcoin claims to have implemented both suggestions.

Despite the audit’s findings, debates over Worldcoin’s privacy practices persist. Spain’s Agency for the Protection of Data issued an injunction against Worldcoin on March 6, prompting claims from Worldcoin that it did not violate data protection laws and accusations against the Spanish government of bypassing EU law with the injunction.