World Chain Bridge

This review reaches an adverse assessment based on L2Beat’s own structured risk data, not on a narrative summary. World Chain is an OP Stack rollup built and operated by Tools for Humanity, the Worldcoin/World ID organization. On paper, it shares the Optimism Superchain governance model already reviewed in this registry. But L2Beat’s own contract-level assessment says World Chain ”is not even a Stage 0 project.” It identifies fewer than five external actors who can submit fault-proof challenges. State validation therefore uses a permissioned dispute game, not Base’s permissionless one. L2Beat also flags ”no delay on code upgrades” as a CRITICAL risk. Despite the superficially similar Superchain branding, this structure is materially weaker than Base, Arbitrum, or Optimism, all approved with limits in this registry.

Review triggers: events that reopen the verdict
• World Chain’s fault-proof challenger set becomes permissionless, matching Base’s design
• L2Beat no longer flags no-delay code upgrades as a critical risk for World Chain specifically
• Any confirmed exploit of World Chain’s OptimismPortal or L1StandardBridge contracts
• A regulatory action against Tools for Humanity results in forced chain shutdown or comparable operational disruption in a jurisdiction material to Ketju clients

Watched nightly: a warning on its venues or files, or a cited document that changes, reopens the memo. The first confirmation is due 2026-11-17.

The research file

Mechanism

World Chain is an OP Stack Layer 2 built to give priority blockspace to World ID holders. Deposits from Ethereum confirm in roughly 12 minutes. Canonical withdrawals use the standard seven-day optimistic challenge window before users can claim funds on Ethereum. Third-party liquidity bridges offer faster exits at a premium, but they sit outside this canonical bridge’s trust model.

Control and governance

World Chain now has ”Orange Superchain status,” rather than the independent, fully-devolved security council that Base reached in March 2026. It remains under shared Optimism Superchain governance, with the same zero-delay 2-of-2 nested multisig documented for OP Mainnet in this registry. That shared governance may sound reassuring, but L2Beat’s direct contract-level discovery data shows a different picture for World Chain’s current deployment. Fewer than five external actors can submit fault-proof challenges, so state validation now uses a permissioned dispute game rather than the permissionless one that let Base pass L2Beat’s ”walkaway test.” L2Beat’s own risk summary says a malicious code upgrade can steal funds and that code upgrades have no delay, which it flags as CRITICAL. ”Alchemy Multisig 1,” a third-party infrastructure provider with an operator role, carried out a recent contract upgrade, rather than Tools for Humanity acting alone. This adds a party to the control chain that was not disclosed until checked.

Incident record

This review found no exploit of World Chain’s canonical bridge or OptimismPortal contracts through its 2026-08-17 search cutoff. Apart from bridge-contract security, Tools for Humanity has faced sustained regulatory action over its World ID biometric-verification system. Actions include bans or forced data-deletion orders in Kenya (High Court ruling, May 2025), Brazil (ANPD ban, January 2025), Indonesia (suspended May 2025), the Philippines (halt order, October 2025), and a Germany GDPR violation finding, among others. This creates organizational and reputational risk for the entity that operates the chain. It is not, by itself, a finding about the bridge contracts, but it adds to rather than reduces the contract-level concerns above.

Exit under stress

The standard seven-day challenge window applies in all cases, as it does for peer canonical bridges. But because L2Beat identifies a permissioned challenger set, the window’s practical protection depends on those few approved parties acting correctly. It does not depend on an open, adversarial market of challengers as Base’s design intends.

Comparison

Base, Arbitrum, and Optimism’s canonical bridges are all approved with limits in this registry. World Chain shares their nominal Superchain governance lineage, but it fails on the specific structural facts that L2Beat verifies directly: a Stage rating below Stage 0, a permissioned rather than permissionless challenger set, and a CRITICAL-flagged zero-delay upgrade path without an equal milestone for decentralizing to an independent council. Shared branding does not mean shared structure. This entry is judged on the structure observed for this specific chain.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• L2BEAT — World Chain project page · primary · accessed 2026-08-17
  Supports: not even Stage 0, fewer than 5 external challengers, no delay on code upgrades flagged CRITICAL, upgrade history
• Superchain Eco — World Chain chain profile · secondary · accessed 2026-08-17
  Supports: Orange Superchain status
• World Docs — World Chain overview · primary · accessed 2026-08-17
  Supports: chain identity, Superchain infrastructure
• The Defiant — World Chain bridge TVL climbs 33% over seven days · secondary · accessed 2026-08-17
  Supports: deposit and withdrawal timing
• Finance Magnates — Worldcoin ordered to delete biometric data in Kenya over privacy breach · secondary · accessed 2026-08-17
  Supports: Kenya regulatory action

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.