{"id":959,"date":"2024-11-25T10:33:00","date_gmt":"2024-11-25T08:33:00","guid":{"rendered":"https:\/\/ackee.xyz\/blog\/?p=959"},"modified":"2024-11-25T10:33:00","modified_gmt":"2024-11-25T08:33:00","slug":"wormhole-worldcoin-world-id-state-root-bridge","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/wormhole-worldcoin-world-id-state-root-bridge\/","title":{"rendered":"Wormhole Worldcoin World ID State Root Bridge"},"content":{"rendered":"

Wormhole Worldcoin World ID State Root Bridge protocol enables the bridging of the Worldcoin World ID state root from Ethereum to Solana. The Worldcoin World ID utilizes <\/span>Semaphore<\/span><\/a>, with a single set containing public keys (or identity commitments) for each verified user. A commitment to this set is then replicated to other blockchains, in this case to Solana, where the new Merkle root is stored, allowing verified users to prove their personhood.<\/span><\/p>\n

 <\/p>\n

Wormhole engaged Ackee Blockchain Security to perform a security review of the Wormhole Worldcoin World ID State Root Bridge protocol for a total of 11 engineering days in a period between September 6 and September 27, 2024.<\/span><\/p>\n

METHODOLOGY<\/span><\/h2>\n

The audit began by understanding the high-level goals of the project, followed by a deep dive into the program\u2019s logic. In the initial phase, we implemented fuzz tests, which were particularly helpful for two reasons: to enhance our understanding of the project\u2019s core concepts and to begin fuzzing as early as possible, increasing the likelihood of identifying bugs. For fuzzing, we used <\/span>Trident<\/span><\/a>. See the <\/span>Pull Request<\/span><\/a> with a complete fuzz test code.<\/span><\/p>\n

 <\/p>\n

In the later stages of the audit, we shifted focus to a manual review of the project, paying special attention to the following:<\/span><\/p>\n