Less than 24 hours after the launch of PYUSD, PayPal’s new stablecoin is already attracting criticism, with the ability to freeze assets. We’ve analysed the community’s complaints.
PayPal stablecoin triggers concerns
This week, PayPal surprised the ecosystem by returning to the forefront with its PYUSD stablecoin, built in partnership with Paxos, the issuer of the USDP. After abandoning its project last February, the payment giant finally reversed its decision.
Nevertheless, this announcement has not been slow to trigger concerns in the community. One observer pointed out that the PYUSD code would include functions for freezing assets using the “freeze” function, and for deleting a user’s balance using the “wipeFrozenAddress” function.
There is also a function for unfreezing funds frozen in the smart contract analysed:
The new Paypal USD stablecoin has an “assetProtection” role which can wipe your balance in two transactions (first `freeze`, then `wipeFrozenAddress`)
In smart contract security we call this a “centralisation attack vector” pic.twitter.com/RsmqvsnKvi
– pashov (@pashovkrum) August 7, 2023
So, the critics began to appear, for example with lawyer Sasha Hodder, who attributes PayPal’s stablecoin “all the censorship capabilities of a central bank digital currency (CBDN), but launched by a tech giant instead of a government” :
I just read the PayPal USD terms of service.
– full KYC
– custody by Paxos
– tied to your PayPal login
– PayPal can reverse any transaction
– claimed to be fully backed by actual USDAll the censorship capabilities of a CBDC, but launched by big tech instead of the gov’t.
– Sasha Hodder (@sashahodler) August 7, 2023
What’s really going on?
Faced with these concerns, our own searches of the PYUSD smart contract failed to turn up the functions relayed by @pashovkrum on Twitter.
And for good reason, if we refer to CoinGecko and CoinMarketCap, the smart contract for PayPal’s stablecoin is the following: 0x6c3ea9036406852006290770bedfcaba0e23a0e8, which is different from the one mentioned by the interested party.
But if we continue our research, it turns out that this smart contract allows the management of the funds to be delegated to another smart contract. Digging a little deeper, it turns out that the address indicated on CoinGecko and the one relayed by @pashovkrum are both controlled by the following smart contract: 0x0644Bd0248d5F89e4F6E845a91D15c23591e5D33.
This confirms what we said earlier, and in fact it’s not really surprising to see such functions on this type of asset. It is a reminder of the centralised nature of the PYUSD and its need to evolve in a regulated environment in which stablecoins are distrusted by political leaders.
Other observers have pointed out that stablecoins such as Paxos’ USDP, Circle’s USDC and Tether’s USDT also have freeze mechanisms. These have been used in the past, for example, to block funds from addresses implicated in hacks or sanctioned by the authorities.
However, such cases are totally at odds with the very idea of decentralisation and real ownership of one’s money. Investors for whom this philosophy is important should turn to other assets to protect themselves against such eventualities.
