We have analyzed the smart contract of the Worldcoin token $WLD, found at 0x163f8c2467924be0ae7b5347228cabf260318753, and identified certain security risks. Below is a detailed explanation of the risks associated with the $WLD token.
Centralized Approach
mintOnce Function
The contract implements a centralized minting mechanism called mintOnce, which allows the owner to mint tokens for multiple addresses in a single call. It has been verified that this function has been called by the current owner.
The current owner is a 1/1 multisig wallet contract at 0x59a0f98345f54bAB245A043488ECE7FCecD7B596, and there is only one contract owner address: 0xc534a745bFfaF9466Ed7B47fA23B0177b99A3e77. This means that a single signature is sufficient to represent the owner for privileged operations.
setMinter Function
This contract also implements the setMinter function, which allows the owner to set a minter address. Currently, the minter address is set to zero.
mintInflation function
If the owner sets a non-zero minter, the minter can freely call mintInflation to mint an unlimited amount of tokens for any address.
Token Allocation
According to statistics, the first 6 addresses already hold 94.5% of the total supply, indicating a highly concentrated token distribution.
In conclusion, the $WLD token faces the following security risks:
The owner currently has only one signer, meaning that only one signature is required to perform privileged operations on the contract on behalf of the owner.
There is a risk of unlimited token inflation after setting the minter.
The token distribution is highly concentrated, with the first 6 addresses holding the majority of the tokens.
To mitigate these security risks, we recommend:
Increasing the number of signers for the owner and implementing multi-signature management.
Restricting the arbitrary setting of the minter to prevent unlimited token inflation.
Implementing measures such as token locking or continuous release to reduce the concentration of token distribution.
Security is the foundation of a healthy blockchain ecosystem. We will continue to pay attention to project security, provide timely security risk warnings, and jointly safeguard the security of on-chain assets.
