Paypal USD: Boon for Ethereum but not decentralization, says community

August 8, 2023 Coin Telegraph

BUSD

Proponents say PayPal’s PYUSD could see Ethereum become the money layer of the internet, while opponents argue that it’ll act like a poorly designed CBDC.

Paypal’s new Ethereum-based stablecoin, PYUSD has been seen as bittersweet news for the crypto community.

While it could finally see Ethereum find its place in mainstream adoption, it could also spell trouble for decentralization and personal control of assets, warns the community.

The new stablecoin, Paypal USD, was launched on Aug. 7 and is issued by Paxos Trust Co. — the firm behind Binance USD (BUSD). It’s built on Ethereum and “designed for digital payments and Web3,” with the firm saying it will soon be available to United States customers.

The launch has been seen as a boon for Ethereum adoption. Ethereum bulls Anthony Sassano and Ryan Sean Adams believe the ERC-20 stablecoin will push the blockchain closer towards becoming the money layer of the internet.

This is the Ethereum contract address for PayPal's stablecoin.

I can't believe i get to tweet that.

We've come so far. pic.twitter.com/S6kSqcV4ut
— RYAN SΞAN ADAMS - rsa.eth (@RyanSAdams) August 7, 2023

The number of daily active users on Ethereum currently hovers between 300,000-400,000, according to Etherscan.

However, Sean Adams noted that 430 million accounts actively use the online payment processor, which means that over 5% of the world’s 8 billion people could theoretically be onboarded onto Ethereum through PayPal’s new stablecoin.

Martin Koppelmann, the CEO and co-founder of Gnosis, added that by launching PYUSD on Ethereum’s base layer, Ethereum layer-2s will be able to interact with PYUSD too.

Others, including lawmakers, have seen it as another example of larger institutions embracing crypto, breathing new life into the traditional payments system.

In an Aug. 7 statement, Patrick McHenry, Chair of the United States House Committee on Financial Services said stablecoins like PayPal’s PYUSD “hold promise as a pillar of our 21st century payments system.”

#NEW: Chairman @PatrickMcHenry releases a statement following the announcement of PayPal's payment stablecoin launch.

Read more https://t.co/LOF9ayUNnG pic.twitter.com/sRfSfLYbXQ
— Financial Services GOP (@FinancialCmte) August 7, 2023

However, not everyone is convinced about PayPal’s new stablecoin.

Several smart contract auditors highlighted that PYUSD’s smart contract contains a 'freezefunds' and 'wipefrozenfunds' function which they claim is a textbook example of a centralization attack vector in Solidity contracts.

The new Paypal USD stablecoin has an "assetProtection" role which can wipe your balance in two transactions (first `freeze`, then `wipeFrozenAddress`)

In smart contract security we call this a "centralisation attack vector" pic.twitter.com/RsmqvsnKvi
— pashov (@pashovkrum) August 7, 2023

This concern was echoed by cryptocurrency researcher Chris Blec, who believes that PayPal will use the controversial functions where necessary.

Digital asset lawyer Sarah Hodder believes many characteristics of PayPal’s stablecoin resemble that of a censorship-enabled central bank digital currency. Another smart contract auditor noted that PYUSD’s smart contract can be changed by PayPal at any time.

I just read the PayPal USD terms of service.

- full KYC
- custody by Paxos
- tied to your PayPal login
- PayPal can reverse any transaction
- claimed to be fully backed by actual USD

All the censorship capabilities of a CBDC, but launched by big tech instead of the gov't.
— Sasha Hodder (@sashahodler) August 7, 2023

In October, PayPal was slammed for a controversial policy that could’ve seen users fined $2,500 for spreading “misinformation.” The firm later backpedalled, claiming the policy update was published “in error.”

Meanwhile, Blockchain engineer Patrick Collins took a slightly more neutral view, suggesting that PayPal’s PYUSD could have been “epic” but believes some of the engineering choices were suboptimal — such as choosing an outdated version of Solidity to program the contract, making the contract upgradeable and not making it gas efficient.

Sassano also explained in a separate post that while PayPal's stablecoin is centralized, Ethereum users are free to choose whether they wish to use it or not.

Yes, PayPal's stablecoin is centralized.

No, that doesn't make it any less cool that PayPal has a stablecoin.

Ethereum being a settlement layer for all types of value means that different types of assets will exist on the network & you get to choose which ones you want to use.
— sassal.eth (@sassal0x) August 8, 2023

PayPal said PYUSD will be rolled out within the next few weeks.

ETH is currently priced at $1,825 which is approximately the same price at the time of PayPal’s announcement about 10 hours ago, according to CoinGecko. Only minor fluctuations have been observed in ETH’s price since then.

Magazine: DeFi Dad, Hall of Flame: Ethereum is ‘woefully undervalued’ but growing more powerful

ChatGPT can’t beat human smart contract auditors yet: OpenZeppelin’s Ethernaut challenges

June 1, 2023 Coin Telegraph

audit

While ChatGPT-4 can’t compete with human auditors yet, OpenZeppelin noted it was not optimized to do so, and AI models trained for this purpose would likely be more accurate.

While generative artificial intelligence (AI) is capable of doing a vast variety of tasks, OpenAI’s ChatGPT-4 is currently unable to audit smart contracts as effectively as human auditors, according to recent testing.

In an effort to determine whether AI tools could replace human auditors, blockchain security firm OpenZeppelin’s Mariko Wakabayashi and Felix Wegener pitted ChatGPT-4 against the firm’s Ethernaut security challenge.

Although the AI model passed a majority of the levels, it struggled with newer ones introduced after its September 2021 training data cutoff date, as the plugin enabling web connectivity was not included in the test.

Ethernaut is a wargame played within the Ethereum Virtual Machine consisting of 28 smart contracts — or levels — to be hacked. In other words, levels are completed once the correct exploit is found.

According to testing from OpenZeppelin’s AI team, ChatGPT-4 was able to find the exploit and pass 20 of the 28 levels, but did need some additional prompting to help it solve some levels after the initial prompt: “Does the following smart contract contain a vulnerability?”

In response to questions from Cointelegraph, Wegener noted that OpenZeppelin expects its auditors to be able to complete all Ethernaut levels, as all capable authors should be able to.

While Wakabayashi and Wegener concluded that ChatGPT-4 is currently unable to replace human auditors, they highlighted that it can still be used as a tool to boost the efficiency of smart contract auditors and detect security vulnerabilities, noting:

“To the community of Web3 BUIDLers, we have a word of comfort — your job is safe! If you know what you are doing, AI can be leveraged to improve your efficiency.“

When asked whether a tool that increases the efficiency of human auditors would mean firms like OpenZeppelin would not need as many, Wegener told Cointelegraph that the total demand for audits exceeds the capacity to provide high-quality audits, and they expect the number of people employed as auditors in Web3 to continue growing.

In a May 31 Twitter thread, Wakabayashi said that large language models (LLMs) like ChatGPT are not yet ready for smart contract security auditing, as it is a task that requires a considerable degree of precision, and LLMs are optimized to generate text and have human-like conversations.

Because LLMs try to predict the most probable outcome every time, the output isn't consistent.

This is obviously a big problem for tasks requiring a high degree of certainty and accuracy in results.
— Mariko (@mwkby) May 31, 2023

However, Wakabayashi suggested that an AI model trained using tailored data and output goals could provide more reliable solutions than chatbots currently available to the public trained on large amounts of data.

What does this mean for AI in web3 security?

If we train an AI model with more targeted vulnerability data and specific output goals, we can build more accurate and reliable solutions than powerful LLMs trained on vast amounts of data.
— Mariko (@mwkby) May 31, 2023

AI Eye: 25K traders bet on ChatGPT’s stock picks, AI sucks at dice throws, and more

Euler Finance’s offer to hacker: Keep $20M or face the law

March 15, 2023 Coin Telegraph

Euler Finance’s offer to hacker: Keep M or face the law

attack

The hacker committed a $196 million flash loan attack on the Ethereum-based lending protocol on March 13.

Ethereum-based noncustodial lending protocol Euler Finance is trying to cut a deal with the exploiter that stole millions from its protocol, demanding the hacker returns 90% of the funds they stole within 24 hours or face legal consequences.

Euler Labs sent its ultimatum to the flash loan attacker who exploited the platform for $196 million by transferring the hacker 0 Ether (ETH) with an attached message on March 14:

“Following up on our message from yesterday. If 90% of the funds are not returned within 24 hours, tomorrow we will launch a $1M reward for information that leads to your arrest and the return of all funds.”

euler just sent an on-chain message to the hacker pic.twitter.com/0wKIW51NjM
— 0xngmi (llamazip arc) (@0xngmi) March 14, 2023

The threat of law enforcement comes as Euler sent the hacker a much more civil message the day before.

“We understand you are responsible for this morning’s attack on the Euler platform,” it read. “We are writing to see whether you would be open to speaking with us about any potential next steps.”

The request for a 90% fund return would see the hacker send back $176.4 million while holding onto the remaining $19.6 million.

However, many observers have noted that the hacker has very little to no incentive to follow through with the deal.

Look over your shoulder for the rest of your life, or take a $20m deal. No brainer.

Although, they could easily be state actors and aren’t really worried about low levels feds. https://t.co/i5zUSDqFca
— drnick ️² (@DrNickA) March 15, 2023

“If I was the hacker I’d simply say ‘to anyone who manages to track me down, I will give you $2 million not to tell Euler,’” one observer said.

“Yeh he has 200 Million they have 2 Million. He wins in a bidding war,” another Twitter user wrote in response.

Euler Labs said it was already working with law enforcement in the United States and the United Kingdom, along with engaging blockchain intelligence platforms Chainalysis, TRM Labs and the broader Ethereum community, to help track down the hacker.

An update on our work today to recover funds for Euler protocol users.

Here are a few actions we took immediately:

1. Stopped the direct attack as soon as possible by helping disable the EToken module, which blocked deposits and the vulnerable donation function

2. Engaged TRM… https://t.co/6ZClE9uGoH
— Euler Labs (@eulerfinance) March 14, 2023

The lending platform added it was able to promptly stop the flash loan attack by blocking deposits and the “vulnerable” donation function.

As for the exploited code, the team explained that the vulnerability “was not discovered” in the audit of its smart contract, which had existed on-chain for eight months until bei exploited on March 13.

Euler Labs works with various security groups to perform audits of the Euler Finance protocol.

While the vulnerable code was reviewed and approved during an outside audit, the vulnerability was not discovered as part of the audit.

The vulnerability remained on-chain for eight… https://t.co/M3PYSOwHhL
— Euler Labs (@eulerfinance) March 14, 2023

Smart Contract Audit