world.GetMedal returns an empty string when the player does in fact have medals.
The reference says:
Whenever possible, GetMedal() will avoid contacting the hub by using the information it was given when the user logged in. If contacting the hub is required, the proc may take a few moments to return a result.
I'm not sure what this means but it sounds like this could be related to the problem. This issue only happens when you're not the host. The game is almost always able to look up the host's medals.
It seems like the server is somehow getting the idea that the client has no medals so it doesn't even bother checking the hub. What does the underlined part of the quote from the reference mean? What information can be provided when the user logs in? Is there a way to prevent this to force the game to check the hub for medals?