PayPal USD: Quick Dive into PYUSD's Status, Collateralization Plan, and Centralized Attack Vectors

The announcement of PayPal USD (PYUSD) this week was unexpected, especially after the New York State Department of Financial Services (NYDFS) ordered Paxos to cease issuing Binance's BUSD stablecoin in February. Not to mention there has been no stablecoin-related regulatory clarity since. This article covers PYUSD's current status, collateralization plans, and centralized attack vectors within its token contract.

🔵 Operations

PYUSD is an ERC-20 token that is already live on Ethereum Mainnet. However, support for the stablecoin is yet to launch for PayPal users, and there's currently no way to acquire it. Support will likely be rolled out over the coming weeks and is expected to be limited to United States users.

Minting and redemption will be facilitated by Paxos, a licensed trust company regulated by NYDFS. Reserve assets will function similarly to USDC, held in cash and cash equivalents such as U.S. treasuries and overnight repurchase agreements. Public Transparency Reports and third-party attestations will be released monthly, similar to Deloitte's monthly USDC Reserve Reports.

🔵 Official Uses

What are you expected to be able to do with PYUSD?  

• Make offchain "Internal Transfers" through the PayPal app (not subject to fees). These transfers will function no differently than transferring a USD balance on PayPal.
• Make onchain "External Transfers" to Ethereum wallets like MetaMask (subject to Ethereum gas fees).
• Use it as a payment method when checking out with PayPal. In this case, you aren't paying with PYUSD. Rather, PYUSD is sold for USD (not subject to fees), and the transaction is settled in USD. 
• Convert to and from any of PayPal's supported cryptocurrencies (subject to fees and a hidden spread of ~0.5%).
• Sell for USD on PayPal or redeem for USD directly through Paxos, both at a 1:1 ratio. 

Centralized stablecoin issuers are raking it in during this high-interest rate environment. Stablecoin tokens remain liquid for users while the underlying USD reserve assets accrue interest directly to the issuer. PayPal wants in. This new stablecoin isn’t innovating anything that hasn’t already been done with other centralized stablecoins like Circle’s USDC and Tether’s USDT. Still, PayPal continues to focus on bringing blockchain technology offerings to its user base of hundreds of millions. The upcoming launch of PYUSD won’t be the end of their plans.

🔵 Risks and Superuser Functions

As for the technical side of PYUSD, there are several notable functions in its token contract and implementation contract:

• PYUSD has 11 tokenholders, a total supply of ~27 million, and was recently in a paused state. The paused state is indicative of the stablecoin's centralized nature. Paxos controls the ability to pause all PYUSD transactions through a 3-of-7 multisig wallet that can call a pause function due to being the implementation contract's owner.
• PYUSD has a freeze function that allows the Ethereum address assigned with the assetProtectionRole to freeze PYUSD token balances of a specified address. This assetProtectionRole also allows for the wipeFrozenAddress function to be called, burning all PYUSD held in a frozen address. NYDFS mandates these types of functions in case PayPal must freeze or seize a criminal party's assets when required by law. 
• PYUSD also has a supplyController role that can mint PYUSD through the increaseSupply function, or burn PYUSD through the decreaseSupply function. These functions are how PYUSD will have a constantly variable supply based on the demand for the token, or lack thereof. 

PYUSD has functions that would be red flags if found in supposedly decentralized tokens. However, PayPal is a highly regulated entity that is adhering to the rules it is subject to. We shall see how PYUSD fares within the stablecoin sector and what plans PayPal has up its sleeve to drive demand for the token.