CertiK, a prominent blockchain security firm, recently disclosed a vulnerability in the Worldcoin protocol that enabled unauthorized access for an Orb operator. The flaw allowed individuals to bypass essential verification criteria and become an Orb operator without meeting the necessary requirements, such as being a legitimate company or passing a vetting interview.

CertiK’s Discovery and Swift Resolution

Through this security loophole, malicious attackers could evade the strict participation criteria of the Worldcoin Operator acceptance process. CertiK reported the issue to Worldcoin using a whitehat disclosure procedure, prompting the project’s security team to act promptly and implement a fix to address the vulnerability. CertiK confirmed that the fix effectively mitigated the threat.

Recent Security Audits and Kenya’s Suspension

Coincidentally, CertiK’s disclosure comes just a week after Worldcoin released a report on security audits conducted by Nethermind and Least Authority. The audits covered various aspects, including potential vulnerabilities in the code, protection against adversarial actions, and defense against malicious attacks and exploitation methods. Both auditors identified issues and provided suggestions, most of which have been resolved or are scheduled for resolution by Worldcoin.

3/ In a normal case, only legit businesses that pass the WorldCoin’s strict identification verification process can run an Orb operation, which collects user’s iris information.

WorldCoin’s security team confirmed the security vulnerability and promptly issued a fix.

— CertiK (@CertiK) August 3, 2023

However, amid these security concerns, Worldcoin faced further challenges when Kenya’s Ministry of the Interior suspended Worldcoin signup. The ministry cited concerns regarding the authenticity, legality, security, financial services, and data protection related to the project’s activities. Relevant agencies have initiated investigations to verify the project’s legitimacy and compliance with regulations.

Worldcoin’s Goals and Criticisms

Worldcoin, co-founded by OpenAI CEO Sam Altman and valued at over $2 billion, aims to create a “proof-of-personhood” network by registering verified humans through iris scans. While the project’s concept has garnered attention, it has faced notable criticism since its debut. Privacy and security concerns arise from the collection of biometric data, raising questions about how this sensitive information will be stored, protected, and potentially used. The project has also faced scrutiny regarding its methods of obtaining consent, with concerns about deceptive marketing practices and inadequately informed consent.

European Regulators Join Investigation

Adding to the scrutiny, European regulators, including the French National Commission on Informatics and Liberty (CNIL) and the Bavarian state authority in Germany, are now collaborating in the investigation of the Worldcoin project.

The government has suspended the activities of Worldcoin in Kenya until relevant agencies in Kenya establish their are no risks to the general public: pic.twitter.com/FuPhNtw2Ht

— Mwango Capital (@MwangoCapital) August 2, 2023

As Worldcoin continues to address thes security and regulatory challenges, the project’s future remains under intense scrutiny from various stakeholders, including authorities and privacy advocates.