Security

Read

Trust — white hat hacker and head of smart contract auditing firm Trust Security — shed some light on a peculiar feature of the smart contract powering PayPal’s new stablecoin PYUSD. 
In a recent tweet, Trust pointed out that they have “seen a lot of dunking on PayPal for using an ancient Solidity compiler.” 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Seen a lot of dunking on <a href="https://twitter.com/PayPal?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@PayPal</a> for using an ancient Solidity compiler. Here's why I think it is actually a 200IQ move! 🧵 <a href="https://t.co/jYN5eRNiNT" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/jYN5eRNiNT</a>— Trust (@trust__90) <a href="https://twitter.com/trust__90/status/1688877793470234624?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">August 8, 2023</a> 
 </blockquote> 
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
As pointed out in a recent <a href="https://crypto.news/paypals-stablecoin-has-wallet-freezing-and-wiping-functions/" rel="noopener noreferrer nofollow">article</a>, an analysis of the smart contract revealed that the company used Solidity compiler version 0.4.24. 
Considering that version 0.4.24 of Solidity was released on May 16, 2018, shows that the version chosen by PayPal was ancient indeed. Still, this is not necessarily a bad thing. 
Trust explained that when choosing a Solidity compiler version, a programmer is looking for a compromise with the latest versions guaranteeing lower gas usage and more features. In contrast, older versions have been tested for longer and feature fewer unknowns. 
In other words, older compilers are less likely to feature unknown vulnerabilities. He concluded someone may want to use an older version “because it withstood the test of time.” 
 You might also like: <a href="https://crypto.news/paypal-ventures-into-stablecoins-with-launch-of-pyusd/" rel="noopener noreferrer nofollow"> PayPal ventures into stablecoins with launch of PYUSD </a> 
Furthermore, Trust also pointed out that PayPal’s token is powered by a single short smart contract and the <a href="https://docs.openzeppelin.com/contracts/2.x/api/math" target="_blank" rel="noopener noreferrer nofollow">SafeMath</a> library. This shallow complexity system does not require new features, with the objective being an “ultra-robust code used for the next 10+ years, not to do anything too fancy.” 
Trust also explained, “The simpler the codebase and the fewer the integrations with outside code, the earlier you can set the compiler version and get away with it.” 
In addition to that, this is also in line with the cybersecurity principle of attack surface reduction — where programmers look to make a system as simple and barebones as possible to reduce the probability of vulnerabilities hiding in unnecessary complexity and libraries. 
Trust further highlighted that “immutable smart contracts are inherently different from traditional software” since there are no “periodic patch days or emergency releases.” The only viable approach is to “hope all components of the codebase are safe at a specific point in time,” and PayPal developers “can now rely on five years of compiler testing.” 
 Read more: <a href="https://crypto.news/us-official-calls-for-stablecoin-law-amid-paypals-pyusd-launch/" rel="noopener noreferrer nofollow"> US official calls for stablecoin law amid PayPal’s PYUSD launch </a>

PayPal’s secret strategy to smart contact security revealed

crypto.news

Autres articles publiés le 9 août 2023

PEPE Investors Buzzing As Mystery Investor Splashes $1,000,000 on Jaw-Dropping 807B Coins Post-Surge

Russia Agreed With 13 Banks For CBDC!

Walmart Stock Price Prediction: Results Awaiting, Short Or Long?

Wrapped KAVA down by 90% despite KAVA’s bull run

Bitcoin Gains Past $30K As Spot Bitcoin ETF Approval Likely Soon

Billionaire Rubenstein calls Bitcoin mainstream adoption inevitable

Join our free newsletter for daily crypto updates!