Ethereum

Read

<p class="is-style-lead">An analysis of the smart contract of the just-launched PayPal stablecoin PYUSD revealed the presence of so-called “centralization attack vectors.”</p> 
<p>Smart contract security auditor Pashov pointed out in a recent Twitter <a href="https://twitter.com/pashovkrum/status/1688591468498239496" target="_blank" rel="noopener noreferrer nofollow">thread</a> that PYUSD’s contract has an ‘assetProtection’ role. It can wipe your balance in two transactions: first ‘freeze,’ then ‘wipeFrozenAddress.’</p> 
<p>The reason why this is seen as an attack vector is that such a feature increases the damage that potential attackers can do if they managed to access it.</p> 
<p> You might also like: <a href="https://crypto.news/paypal-ventures-into-stablecoins-with-launch-of-pyusd/" rel="noopener noreferrer nofollow"> PayPal ventures into stablecoins with launch of PYUSD </a> </p> 
<p>Pashov noted that PYUSD has six decimals, and uses Solidity compiler version 0.4.24. More interestingly, this smart contract does not “implement <a href="https://eips.ethereum.org/EIPS/eip-712" target="_blank" rel="noopener noreferrer nofollow">EIP-712</a> as the standard expects you to.”</p> 
<h2 class="wp-block-heading" id="what-is-eip-712">What is EIP-712</h2> 
<p>Ethereum Improvement Proposal 712 or EIP-712 is a 2017 standard that allows Ethereum wallets like MetaMask to display structured and readable data in signing prompts instead of just hexadecimal strings. This makes it easier for users to verify the actual data they are signing, improving security and usability.</p> 
<p>To implement EIP-712, developers need to define data structures and create a domain separator to prevent signature collisions between dapps. They also need to write signing code for their dapp to interface with the user’s wallet, write contract code to hash the data structures, and verify signatures on-chain using ecrecover. Overall, EIP-712 allows users to better understand what they are signing and prevents phishing attacks.</p> 
<p>Freezing and balance-wiping features may be surprising to those in the crypto space who expect assets to be entirely under the control of the owners.</p> 
<p>Still, smart contract-based tokens have allowed for such features for some time, and those features are pretty typical of centralized stablecoins.</p> 
<p>“Newsflash: USDT &amp; USDC both have similar attack vectors as well. I thought this one might be different, but it really isn’t,” Pashov <a href="https://twitter.com/pashovkrum/status/1688615907323428865" target="_blank" rel="noopener noreferrer nofollow">commented</a>.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
   <p lang="en" dir="ltr">Newsflash: USDT &amp; USDC both have similar attack vectors as well. I thought this one might be different, but it's really isn't.</p>— pashov (@pashovkrum) <a href="https://twitter.com/pashovkrum/status/1688615907323428865?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">August 7, 2023</a> 
  </blockquote> 
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
<p> Read more: <a href="https://crypto.news/us-official-calls-for-stablecoin-law-amid-paypals-pyusd-launch/" rel="noopener noreferrer nofollow"> US official calls for stablecoin law amid PayPal’s PYUSD launch </a> </p>

PayPal’s stablecoin has wallet freezing and wiping functions

Table of Contents

crypto.news

Other articles published on Aug 8, 2023

Cardano (ADA) Whales and On-Chain Activity Surge to September 2022 Levels

Scammers created Fake PYUSD Tokens after the PayPal Announcement!

Fireblocks Endangers Terra Luna Classic (LUNC) Delisting on Exchanges

FTX Attorneys Face Second Lawsuit for Allegedly Aiding in Fraud

Alibaba Stock Price Prediction: Will BABA be Bullish In 2023?

Pro-XRP Bitstamp Halts Trading for Solana (SOL) and Other Major Tokens

Join our free newsletter for daily crypto updates!