PayPal’s Stablecoin Vulnerable to Account Balance Wipeout

2:40 pm
August 8, 2023
  • PayPal introduced its stablecoin on the Ethereum blockchain.
  • Huobi has announced that it will offer the new stablecoin.
  • The PYUSD has an “assetProtection” mechanism that can wipe out account balances through two transactions—first by freezing the balance and then wiping the frozen address.

The recently launched PayPal stablecoin, called the PayPal USD (PYUSD), has come under scrutiny from Pashov, a smart contracts security review expert. The PYUSD was unveiled on August 7, and Pashov’s analysis has revealed some concerning findings, as posted on X platform on the same day.

Pashov has found that selected members of the development team at PayPal will have the ability to execute sensitive code actions, such as freezing accounts and clearing frozen account balances, using the “assetProtection” mechanism.

Similar Attack Vectors in USDT and USDC

While many crypto enthusiasts expected PayPal’s stablecoin to offer unique features, Pashov’s revelation indicates that the new PayPal USD stablecoin shares similarities with USDT and USDC in terms of security vulnerabilities.

The PayPal USD (PYUSD), Tether (USDT), and USD Coin (USDC) all include an “assetProtection” functionality, which is considered a ‘centralization attack vector’ in smart contract security.

This feature makes PayPal’s stablecoin centralized, similar to many other popular stablecoins in the market.

Summary

A review by smart contracts security expert Pashov has revealed that PayPal’s recently launched stablecoin, the PayPal USD (PYUSD), is vulnerable to an attack that can wipe out account balances. The PYUSD has an “assetProtection” role that can be used by selected members of PayPal’s development team to freeze accounts and clear frozen account balances. This vulnerability puts the stability of the PayPal stablecoin at risk and raises questions about the security of popular stablecoins like Tether (USDT) and USD Coin (USDC), which also have similar attack vectors.

Frequently Asked Questions (FAQ)

What is PayPal’s stablecoin?

PayPal’s stablecoin, the PayPal USD (PYUSD), is a digital currency pegged to the US dollar. It was launched on the Ethereum blockchain and aims to provide a stable store of value for users.

What is an “assetProtection” role?

An “assetProtection” role is a functionality within a smart contract that allows certain individuals or entities to perform actions such as freezing accounts and clearing account balances. In the case of PayPal’s stablecoin, the “assetProtection” role can be used by selected members of PayPal’s development team.

What is a “centralization attack vector”?

A “centralization attack vector” refers to a vulnerability in a system that allows a centralized authority or a small group of individuals to exert control over critical functions. In the context of stablecoins, it means that the stability and security of the cryptocurrency are dependent on a centralized entity, which goes against the principles of decentralization and trustless systems that blockchain technology aims to achieve.


Share:

More in this category ...

7:27 pm April 30, 2024

Ripple companions with SBI Group and HashKey DX for XRPL answers in Japan

Featured image for “Ripple companions with SBI Group and HashKey DX for XRPL answers in Japan”
6:54 pm April 30, 2024

April sees $25M in exploits and scams, marking historic low ― Certik

Featured image for “April sees $25M in exploits and scams, marking historic low ― Certik”
5:21 pm April 30, 2024

MSTR, COIN, RIOT and different crypto shares down as Bitcoin dips

Featured image for “MSTR, COIN, RIOT and different crypto shares down as Bitcoin dips”
10:10 am April 30, 2024

EigenLayer publicizes token release and airdrop for the group

Featured image for “EigenLayer publicizes token release and airdrop for the group”
7:48 am April 30, 2024

VeloxCon 2024: Innovation in knowledge control

Featured image for “VeloxCon 2024: Innovation in knowledge control”
6:54 am April 30, 2024

Successful Beta Service release of SOMESING, ‘My Hand-Carry Studio Karaoke App’

Featured image for “Successful Beta Service release of SOMESING, ‘My Hand-Carry Studio Karaoke App’”
2:58 am April 30, 2024

Dogwifhat (WIF) large pump on Bybit after record reasons marketplace frenzy

Featured image for “Dogwifhat (WIF) large pump on Bybit after record reasons marketplace frenzy”
8:07 pm April 29, 2024

How fintech innovation is riding virtual transformation for communities around the globe  

Featured image for “How fintech innovation is riding virtual transformation for communities around the globe  ”
7:46 pm April 29, 2024

Wasabi Wallet developer bars U.S. customers amidst regulatory considerations

Featured image for “Wasabi Wallet developer bars U.S. customers amidst regulatory considerations”
6:56 pm April 29, 2024

Analyst Foresees Peak In Late 2025

Featured image for “Analyst Foresees Peak In Late 2025”
6:59 am April 29, 2024

Solo Bitcoin miner wins the three.125 BTC lottery, fixing legitimate block

Featured image for “Solo Bitcoin miner wins the three.125 BTC lottery, fixing legitimate block”
7:02 pm April 28, 2024

Ace Exchange Suspects Should Get 20-Year Prison Sentences: Prosecutors

Featured image for “Ace Exchange Suspects Should Get 20-Year Prison Sentences: Prosecutors”
7:04 am April 28, 2024

Google Cloud's Web3 portal release sparks debate in crypto trade

Featured image for “Google Cloud's Web3 portal release sparks debate in crypto trade”
7:08 pm April 27, 2024

Bitcoin Primed For $77,000 Surge

Featured image for “Bitcoin Primed For $77,000 Surge”
5:19 pm April 27, 2024

Bitbot’s twelfth presale level nears its finish after elevating $2.87 million

Featured image for “Bitbot’s twelfth presale level nears its finish after elevating $2.87 million”
10:07 am April 27, 2024

PANDA and MEW bullish momentum cool off: traders shift to new altcoin

Featured image for “PANDA and MEW bullish momentum cool off: traders shift to new altcoin”
9:51 am April 27, 2024

Commerce technique: Ecommerce is useless, lengthy are living ecommerce

Featured image for “Commerce technique: Ecommerce is useless, lengthy are living ecommerce”
7:06 am April 27, 2024

Republic First Bank closed by way of US regulators — crypto neighborhood reacts

Featured image for “Republic First Bank closed by way of US regulators — crypto neighborhood reacts”
2:55 am April 27, 2024

China’s former CBDC leader is beneath executive investigation

Featured image for “China’s former CBDC leader is beneath executive investigation”
10:13 pm April 26, 2024

Bigger isn’t all the time higher: How hybrid Computational Intelligence development permits smaller language fashions

Featured image for “Bigger isn’t all the time higher: How hybrid Computational Intelligence development permits smaller language fashions”
7:41 pm April 26, 2024

Pantera Capital buys extra Solana (SOL) from FTX

Featured image for “Pantera Capital buys extra Solana (SOL) from FTX”
7:08 pm April 26, 2024

Successful Beta Service release of SOMESING, ‘My Hand-Carry Studio Karaoke App’

Featured image for “Successful Beta Service release of SOMESING, ‘My Hand-Carry Studio Karaoke App’”
12:29 pm April 26, 2024

SEC sues Bitcoin miner Geosyn Mining for fraud; Bitbot presale nears $3M

Featured image for “SEC sues Bitcoin miner Geosyn Mining for fraud; Bitbot presale nears $3M”
10:34 am April 26, 2024

Business procedure reengineering (BPR) examples

Featured image for “Business procedure reengineering (BPR) examples”
7:10 am April 26, 2024

85% Of Altcoins In “Opportunity Zone,” Santiment Reveals

Featured image for “85% Of Altcoins In “Opportunity Zone,” Santiment Reveals”
5:17 am April 26, 2024

Sam Altman’s Worldcoin eyeing PayPal and OpenAI partnerships

Featured image for “Sam Altman’s Worldcoin eyeing PayPal and OpenAI partnerships”
10:55 pm April 25, 2024

Artificial Intelligence transforms the IT strengthen enjoy

Featured image for “Artificial Intelligence transforms the IT strengthen enjoy”
10:04 pm April 25, 2024

Franklin Templeton tokenizes $380M fund on Polygon and Stellar for P2P transfers

Featured image for “Franklin Templeton tokenizes $380M fund on Polygon and Stellar for P2P transfers”
7:13 pm April 25, 2024

Meta’s letting Xbox, Lenovo, and Asus construct new Quest metaverse {hardware}

Featured image for “Meta’s letting Xbox, Lenovo, and Asus construct new Quest metaverse {hardware}”
2:52 pm April 25, 2024

Shiba Inu (SHIB) unveils bold Shibarium plans as Kangamoon steals the display

Featured image for “Shiba Inu (SHIB) unveils bold Shibarium plans as Kangamoon steals the display”