Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

worldcoin/world-id-protocol

              main @ 5786684
            

Fixes

CVEs

CRITICAL

Peak severity

48.1%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

crates/authenticator/src/prove.rs: most-fixed (6 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authentication Bypass: Multiple high/critical fixes in this single file address session binding and signature malleability, indicating a core proof-generation path that repeatedly failed to enforce session and message integrity.

Auth Bypass: Four fixes target Merkle root validity caching, showing a recurring failure to enforce root freshness (infinite/zero validity, missing TTL) that allowed stale-root replay.

Authentication Bypass: Replaced a timestamp-delta check with an expiration threshold, indicating the contract previously accepted proofs with expired credentials.