Worldcoin 🛠️ Global Proof of Personhood - Ian Dilick

foreign [Music] and welcome to the super hack World coin Workshop Global proof of personhood joining us today is Ian dillock who will be taking us through the session and with that I will pass over to Ian to get the session started hi everyone thanks for the introduction Rory I'm Ian I also go by Penryn online I do developer relations at World crime so in this workshop I'll go through what world ID is why worldcoin created it what you can do with World ID and how to integrate World ID so World ID really helps solve this one big question how do you know who or what is a real and unique person right worldcoin started out as a project that wanted to help introduce everyone in the world to this digital economy by giving them a little bit of cryptocurrency and doing that is really tough you have to know that as many that someone's a really human and that they're only getting their share once for that we've built World ID which recently became publicly available still in beta but there's no wait list anymore and I'll walk you through a little bit of how we got to where we are we designed world at e to be private inclusive and robust we never ask your name your email anything like that with World ID for it to be inclusive right we want to have as many people as possible be able to participate in This Global identity solution and we want it to be robust making sure that each person can only get a single account we looked at a lot of different ways to do this right a really weak end of the spectrum is using an email or phone number to verify someone but having multiple emails and multiple phones is super easy so it's not robust in that sense we looked at doing kyc on official government IDs but that's not inclusive enough less than half of the world has a digitally verifiable government ID we looked at web of Trust Systems but they don't scale super well to the scale of all of humanity every hop away from that initial trusted set you are reduces the amount of trust you actually have in that web of trust though we settled on Biometrics which initially sounds a little scary but we do it in a privacy preserving way when it comes to the Biometrics we used we looked at fingerprints Palm scans face scans but none of those actually had enough entropy to scale to all of humanity face ID and Touch ID on your phone can distinguish about one in 30 million people which is fine when you're trying to make sure that the person in front of the device now is the same as the person who was in front of the device at sign up right that one-to-one matching but for us we're checking to make sure that you're unique from everyone else who's ever signed up this one to end matching requires a much higher level of entropy and for us fingerprints base scan Etc just wouldn't scale to the level that we need we also looked at DNA which is nearly invasive it's impossible to do that in a privacy preserving way that doesn't tell you a lot about a person so we settled on Iris scans the irises have a huge amount of entropy even identical twins have very different irises but also something that can be done in a very privacy preserving manner right your attention is required whereas with face scan that's something that can be done much more passively if someone tries to scan your irises and you don't want to you can close your eyes um so it's something that really meets a lot of what we're looking for and when it comes to doing those Iris scans we looked at phone sensors and off-the-shelf Hardware but neither of those met our requirements phone sensors just don't have good enough cameras off-the-shelf Hardware uh it's really expensive it's difficult to scale um and for us that meant that we ended up building custom Hardware that custom Hardware is the orb the orb has been in development since early 2020 and has gone through multiple different revisions and what the orb does is it makes sure that real you're a real human right you're not a cat or a dog you're not a photo of a human it takes photos of your irises and calculates an iris code on the device so that those those photos never need to be stored anywhere and then checks to make sure that that Iris code is unique and at that point it verifies your world ID your world ID is this self-custodial identity on your mobile device it gets verified with different proof of personhood credentials uh to verify that you're a unique human world that He Is This Global digital identity protocol somewhat like an internet passport and those credentials are somewhat like stamps in that passport and the two weeks before right now are the orb biometric verification as well as verifying with a phone number in World app so two separate ends of the spectrum there in terms of how strong that proof of personhood is World ID is privacy first as I said we never collect personal information like your email or your name it's decentralizing progressively and it's open source all of our smart contracts and everything is available on GitHub today there's lots of different use cases for World ID voting is a great example you want to make sure that a vote's coming from a unique human but each human only gets to vote one for social media you want to know that this profile is a real person and not a bot customer incentives are one that I find really fun because you can give a bigger discount if you have a stronger proof of personhood and know with higher certainty that that person's only going to get that one-time sign-up discount once right I signed up for Netflix with a new email to get that two-week free trial multiple times that world ID can help prevent things like that we've also designed World ID to be super easy to integrate on a wide variety of platforms you can use it on the web on mobile and on chain and there's two main ways to integrate World ID sign in with worldcoin and Anonymous actions so let's start with sign in with World recording let's see how it works so we actually use sign in with worldcoin to sign in to our developer portal here if I click login it takes me to sign in with worldcoin page I can scan this QR code either from directly within World app by pressing this button in the top left or I can just scan it with my phone's QR Scanner and it will automatically open up the app once it scans it tells me in the app that I'm trying to sign into the worldcoin developer portal I tap verify with World ID and oh the sign in didn't work that's unfortunate let's try that again and I go through the slope flow again that should take me back to the app something's broken on our developer portal that's not great I'll make sure we get that fixed afterwards but with cited with worldcoin there's a bunch of different ways to actually integrate it into your app you have an integration with bot zero uh you can use nextdoc.js you can use our oidc weldown file with the custom authentication engine you can build out your own custom open ID connect flows for really custom use cases but I'll walk through how you can integrate it with nextdoc.js this is the configuration for next.js where we add World coin as a sign in provider and we actually just provide this openid well-known file problem id.worldcoin.

org we give the client ID and the client secret for an app that you create in our developer portal and then we map the information from the profile returned by World ID to next off and that's all you have to do everything else is next off is completely normal we also have a temper template repository available for integrating next off using World ID and now let's get into anonymous actions this is a bit more powerful of an integration it's a bit more customizable and what most of you in this hackathon will probably be using Anonymous actions verify that your user is a unique human doing something once or if you'd like some limited number of times you can set that number to be whatever you'd like and optionally with a specific signal that signal is a message that is integrated into this zero knowledge proof from World ID it's also optional but for voting right that signal can be who you're voting for or if someone's claiming an airdrop this can be the wallet address that they're claiming that to and given that things aren't working I'll skip a demo for right now just to save myself any further mistakes there but to integrate Anonymous actions it all starts with ID kit our front end Library the single component that you put in your JavaScript or react front end there's a couple different parameters you pass to it first one is the name of the action a user is performing you also have to give it the app ID both of those things you configure in our developer portal there's the on success callback function which is called after the idkit widget is closed um this is where you can pass the proof return from ID kit to you know a call to a function on chain or that can be changing the state in your front end to show the user is verified and will verify is the second optional callback function but it's mostly useful for when you're using Anonymous actions off chain and verifying proofs with our API uh that handle verify function is uh called immediately after that proof is returned um and the widget shows a loading State any errors thrown in the verify function will be displayed to the user through the widget which is nice provides a good way to show an error State show a user what's gone wrong say they verified for an action before or they don't have the required credential um in a very pretty way the credential types will default to credentialtype.org this is also typescript if you're using regular JavaScript you would just pass the string orb and or the string phone and this just shows which verification methods you want to require or I should say which verification methods you want to accept right this example would accept someone who is either phone or or verified and then finally you have a child component in this case just a button that allows the user to click and open up the widget and begin the verification process this is the proof returned from ID kit it also passed as an input to both the on success and the handle verify functions and in here we have the Merkle root of the root of the Merkle tree again in which you verify this proof uh these Merkle roots on chain are essentially the list of identities that have been verified this nullifier hatch is a unique identifier of this user in the context of this action and app so for a user who tries to perform the same action twice they will have the same nullifier hash which is how you can tell that they're trying to perform that action twice but when a user tries to perform a different action you'll have a completely different nullifier hash which is how we keep this privacy preserving and prevent different actions from being correlated back to the same user this proof is a very long hexadecimal string this is the actual proof and then you get the credential types that user's been verified this Returns the highest credential type so if they're all verified it will return to orb they're only phone verified it will return phone and if they're verified with both it will also return order so we have this proof but we're not done yet we have to verify that proof right your user can always manipulate data in your app's front end so with this proof there's two ways to verify it you can verify it with our API or you can verify that proof on chain so to verify it with our API first you would pass that proof to your app's back end if you're using next.js this is quite simple and we also have a template repository available that shows how you can handle this and then once you have that proof in your back end you make a request to developer.worldcoin.org API V1 verify slash your apps ID from the developer portal um the body of that will include the app ID or sorry the app ID is already in the URL that will include the action name the Merkle root nullifier hash proof the signal if you're using that otherwise you should just set the signal as an empty string uh and then our backend handles all of the math to verify that through everything like that and we'll respond either with a 200 status code if that's successful or we'll respond with a 400 code and a brief description of what the error actually is whether that's the user is already performed this action if the user doesn't actually have that credential that they gave to your app's front end but if you get this 200 response after the response get sent you should then for example set the user as verified in your database right any actions that you want to have occur when you know for sure that that user is actually verified it could happen in your backend again because in the front end the user can always manipulate that data if you wanted to verify our chain we also have template repositories that highlight the uh on chain verification and in the Constructor for your smart contract there's a few things you'll need to set so the world ID here is the address of the world ID router against which you want to validate you can find those up-to-date addresses at docs.

worldcoin.org reference slash address Dash book or you can just go to our docs and you'll see it in the navigation on the sidebar your app ID and action ID as well combine to form this external nullifier that is again that scope of uniqueness for these proofs this is just what SEMA for the zero knowledge proof system that we are built on top of uses um and for us if you only have one action that the user is performing in your smart contract you can set this external nullifier in the Constructor otherwise you can pass into your function call the action name and then compute this external nullifier before submitting the proof to our smart contract and then the actual function that your users would call to verify this proof and perform an action can look something like this lead pass in a signal in this example we're using a wallet address let's say that we are having the user claim an airdrop pass in the root of the Myrtle tree the nullifier hash and the proof and in this example we make sure the user can only do this once because we have a list of nullifier hashes that we've seen before the first thing we do is check if that nullifier hash is in this list of users that have already performed this action and if so we revert otherwise we move on we call the verify proof function on the world ID router contract we pass in the root the group ID so the group ID is one for orb verified users and zero for phone verified users generally we don't recommend uh having phone verifications enabled on chain so you can also hard code that to one in your Constructor you have to encode and Ash the signal so we have a hash to field helper function again you can see that in our template repository that handles hashing things properly using kecought 256 which is what sema4 requires and then Additionally the nullifier hash the external nullifier and the proof if this proof verifies properly this will just continue if it doesn't this will revert so if this doesn't revert then we can move on add that nullifier hash to the listed nullifier hashes that we've seen just to make sure that this user doesn't get to perform this action again and then once all that's done this is where you would add in your logic to issue that airdrop to that user in super hack we have 20K worth of prizes so 5K to best overall 2500 do the best governance app the most creative use case the best AI related use case and the best sign-in with World Coin App we have three one thousand dollar prizes for honorable mentions and I've added typo here um we have a two thousand dollar prize pool split among all submissions that properly integrate World ID and don't receive a different price if any of these prizes end up not being rewarded the funds are added to the prize pool and we have a notion page with lots of different resources for all of you hackers uh you can go to worldcoin.org super hack that will redirect you to that page uh I believe it's also in the world twin section of the super hack dashboard and yeah now I'm happy to answer any questions that anyone may have awesome cheers thanks Ian yeah if anybody has any questions please feel free to check yourself off mute or ask in the chat and if there are no questions and of course oh there's one is there any update on on-chain verifications yes so the on-chain verification has been having issues we think we've identified what the issue is and the team's working on it and I will make sure to update everyone in the partner World coin channel of the each level Discord thanks for checking in on that by the way I was gonna ask that too but I thought maybe somebody else might ask it uh let's see curious about the client-side configs that we have to remove um remove from what exactly um I guess if you want to are they able to unmute themselves and ask directly are they limited to chat yeah they should be able to admit yourself I think shelves do you guys hear me hey yeah see you um the high quick question I was each with Waterloo and my teams they're like submission and I really didn't have the chance to speak to you after submissions uh but uh one of my team members mentioned that in order to properly integrate World scoring SDK we had to remove something from a front end or um I wasn't too sure about what he said but I thought maybe you have an idea or you can leave me there eventually um I think it's when you do like verification on the phone on the client um I'm not sure exactly what this is uh it may have been like if you all were sending the API verification request from your front end rather than from your back end um that that may have been what it was um without knowing exactly what project and looking back at the code I'm not able to respond super directly um but you do have to send that API verification request from your back end because otherwise if it's only from the front end to our API back to your front end the user can again manipulate that response from our API to make it appear verified even though they're not awesome yeah I think that that awesome thank you in it so any other questions security considerations though the uh when using uh World ID on chain from the world ID side there's very very little information actually passed I guess the only thing in terms of like a privacy concern that I would consider is that when a user performs different actions right that nullifier hash is different but other information associated with that like the signal right their address in the example that I used the signal is public so if you have a user trying to verify for two different actions and they use the same wallet to perform that then those two actions would be correlated to the same user so making sure that's communicating to the user clearly is something that I think is important to do but the world ID proofs themselves without some other information the users provide can't be correlated to each other and are completely anonymous we completely separate World ID from the wallet within World app the wallet isn't accessible through the SDK or anything like that actually the world app Wallet isn't even something that users can connect to dapps at the moment so for web true development as well you would need to have users connect the wallet through metamask or wallet connect or some other method that many dapps use today any other questions yeah I'm going to read this for the recording as well uh we were trying to get the events every time a group is added in quarterly test net but the implementation in quarterly for the world ID smart contract doesn't admit if it's just the right implementation so Andres um there aren't going to be new groups added and the information in like the world Eddie implementation that the router routes these things to uh it only receives the root of the Merkle tree bridged from ethereum mainnet or for testnet from ethereum Gurley um and with those like that mercury is essentially a list of the public keys of the world ID identities but that information isn't useful for anything the only time that that public key of that identity is revealed is um when the user signs up everything else this is your knowledge proof like every World ID verification is a zero knowledge proof of testing that they are one of the identities within this Oracle tree without revealing which one so given that monitoring the events on the world ID implementation for new identities being added or anything like that won't actually provide you any valuable information um unfortunately and if you have any more questions about that we can chat in the partner worldcoin channel of the global Discord anybody else have any other questions and if not uh okay we can just maybe end it early thank you Ian for the great workshop and thank you all for attending as a reminder we have the project feedback session in about half an hour so stay tuned for that and get some feedback from mentors and partners on your current sales of your projects so cheers thanks again thanks everybody for attending thank you all right