Worldcoin

Further Reading

World ID Reset

World ID 2.0 allows a user to reset their World ID in case their World ID has been lost or stolen. The user reverifies at the Orb, and their old World ID is invalidated. The user is then issued a new World ID and this new identity is verified at the Orb. A user will not be able to perform a World ID Reset more than once every 14 days.

Impact on Sign-In with World ID

When a user signs in with World ID, their Nullifier Hash is returned as the sub claim in the ID Token. Recall that the Nullifier Hash is the unique identifier of a user in the context of a specific action -- a different identity will return a different Nullifier Hash.

A user who performs a World ID Reset will appear as a new user to your application.

Suggested Action

A second sign-in method, such as an email address or phone number, is highly recommended to ensure that the user can continue to use their account in the event of a World ID Reset. The user should be able to verify that second factor after a World ID Reset and link their new World ID to their existing account.

For comparison, if your application were to use Sign In with Ethereum, this is identical to a user migrating to a new Ethereum address.

Impact on Anonymous Actions

When a user performs a World ID Reset, they are issued a new World ID and their old World ID is invalidated. This means that any anonymous actions performed by the user will no longer be associated with their new World ID.

If your application uses Anonymous Actions for sybil-resistance, this means that a user will be able to perform the action again with a new Nullifier Hash after performing a World ID Reset.

Suggested action

We recommend rotating the action used in your application regularly and limiting the time an action is valid.

For example, a social media application may use Anonymous Actions to mark a user's account as "verified". To mitigate the impact of a World ID Reset, the application could require the user to perform a new action every 30 days to maintain their "verified" status. In this situation, a user who performs a World ID Reset would be able to mark a second account as "verified" immediately after performing the reset, but at the end of the 30-day period, the user would then only be able to verify with World ID for a single account. The user would only be able to maintain the "verified" status for a single account at the end of the 30-day period.