Ethereum

Read

<div class="cryptonews"> 
 <p class="is-style-lead">An <a rel="noopener noreferrer nofollow" title="Category Analysis" href="https://thebittimes.com/analysis.html">Analysis</a> of the smart contract of the just-launched PayPal <a rel="noopener noreferrer nofollow" title="stablecoin" href="https://thebittimes.com/tag/stablecoin.html">stablecoin</a> PYUSD revealed the presence of so-called “centralization attack vectors.”</p> 
 <p>Smart contract security auditor Pashov pointed out in a recent Twitter thread that PYUSD’s contract has an ‘assetProtection’ role. It can wipe your balance in two transactions: first ‘freeze,’ then ‘wipeFrozenAddress.’</p> 
 <p>The reason why this is seen as an attack vector is that such a feature increases the damage that potential attackers can do if they managed to access it.</p> 
 <div class="cn-block-related-link"> 
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"> <use xlink:href="#"></use> 
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> PayPal ventures into stablecoins with launch of PYUSD 
 </div> 
 <p>Pashov noted that PYUSD has six decimals, and uses Solidity compiler version 0.4.24. More interestingly, this smart contract does not “implement EIP-712 as the standard expects you to.”</p> 
 <h2 class="wp-block-heading" id="what-is-eip-712">What is EIP-712</h2> 
 <p>Ethereum Improvement Proposal 712 or EIP-712 is a 2017 standard that allows Ethereum <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>s like MetaMask to display structured and readable data in signing prompts instead of just hexadecimal strings. This makes it easier for users to verify the actual data they are signing, improving security and usability.</p> 
 <p>To implement EIP-712, developers need to define data structures and create a domain separator to prevent signature collisions between dapps. They also need to write signing code for their dapp to interface with the user’s <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>, write contract code to hash the data structures, and verify signatures on-chain using ecrecover. Overall, EIP-712 allows users to better understand what they are signing and prevents phishing attacks.</p> 
 <p>Ecrecover is an EVM precompile in Solidity that allows contracts to verify signatures of off-chain data. It takes a hash and an elliptic curve signature comprised of v, r, and s, and returns the Ethereum address that was used to sign the data, verifying the signature is valid. This allows building use cases like meta-transactions and permit tokens.</p> 
 <p>There are different standards for signing data like eth_sign, personal_sign, and EIP-712. EIP-712 is the recommended way for contracts to accept signed data as it provides protection against misuse and replay attacks. It involves hashing specific contract data like chain ID along with the message data itself. OpenZeppelin contracts provide secure implementations of ecrecover and EIP-712 signing. Overall, ecrecover enables contracts to cryptographically verify signed data from off-chain sources.</p> 
 <p>Freezing and balance-wiping <a rel="noopener noreferrer nofollow" title="Category Features" href="https://thebittimes.com/features.html">Features</a> may be surprising to those in the crypto space who expect assets to be entirely under the control of the owners.</p> 
 <p>Still, smart contract-based tokens have allowed for such features for some time, and those features are pretty typical of centralized stablecoins.</p> 
 <p>“Newsflash: USDT &amp; USDC both have similar attack vectors as well. I thought this one might be different, but it really isn’t,” Pashov commented.</p> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
  <div class="wp-block-embed__wrapper"> 
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
    <p lang="en" dir="ltr">Newsflash: USDT &amp; USDC both have similar attack vectors as well. I thought this one might be different, but it's really isn't.</p>— pashov (@pashovkrum) August 7, 2023 
   </blockquote> 
  </div> 
 </figure> 
 <div class="cn-block-related-link"> 
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"> <use xlink:href="#"></use> 
  </svg> <span class="cn-block-related-link__prefix"> Read more: </span> US official calls for stablecoin law amid PayPal’s PYUSD launch 
 </div> <span class="google-news-banner__label">Follow Us on Google News</span> 
</div>

PayPal’s stablecoin has wallet freezing and wiping functions

Table of Contents

TheBitTimes

Other articles published on Aug 8, 2023

Huobi Exchange Receives $200M USDT and $9M ETH Amid Insolvency Rumors

Blockstream CEO is Sure Bitcoin will Hit $100K Before Next Halving

Bitdeer Successfully Finishes Bhutan Mining Facility

Senators Raise Alarm Over North Korea's Crypto Use While House Committee Chair Applauds PayPal's ...

BNT Rally Picks Up Steam, Analyst Forecasts 1,863% Explosion to $9: ‘Only a Matter of Time’

Ripple’s CLO Questions the Conflict of Interest of Ex-SEC Official Hinman!

Join our free newsletter for daily crypto updates!