PayPal USD PYUSD

Claim: No public cryptographic inventory or quantum threat model has been published by Paxos or PayPal for PYUSD.

Coverage basis: Absence of any quantum-specific documentation

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical uncertainty · Score treatment: score-reducing

Quantum blocker: No public cryptographic inventory; quantum-vulnerable surface cannot be systematically assessed by users or institutions.

Assurance: Absence of inventory confirmed by web search of Paxos documentation, PayPal developer portal, GitHub repositories, and press releases. No quantum-related content found in any official channel. The G7 CEG January 2026 roadmap explicitly recommends financial entities begin cryptographic discovery and inventory exercises.

• https://github.com/paxosglobal/pyusd-contract
• https://www.paxos.com/pyusd
• https://docs.paxos.com/guides/stablecoin/pyusd/mainnet

Claim: No quantum-specific evidence record has been published. Classical contract code, audits, and documentation exist but contain no quantum analysis.

Coverage basis: Public code and documentation exist but contain no quantum-relevant content

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical uncertainty · Score treatment: score-reducing

Assurance: Classical evidence (open-source code, verified contracts, audits) is well-documented but contains no quantum threat modeling, cryptographic inventory, or PQC analysis.

• https://github.com/paxosglobal/pyusd-contract
• https://etherscan.io/address/0x6c3ea9036406852006290770bedfcaba0e23a0e8

Claim: All PYUSD spend authorization is via host-chain classical signatures: ECDSA (secp256k1) on Ethereum/Arbitrum, Ed25519 on Solana. No PQ or hybrid path exists.

Coverage basis: Token inherits host-chain signature schemes; no custom spend authorization

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: All spend authorization remains entirely ECC/Ed25519-only with no PQ or hybrid path.

Assurance: Verified from on-chain contract code, official Paxos documentation, and token-standard specifications (ERC-20, SPL). EIP-3009/EIP-2612 permit signatures also use classical ECDSA (EIP-712 with secp256k1 recovery). Google's March 2026 whitepaper estimates ~500K physical qubits can break secp256k1 (~20x reduction from prior estimates).

• https://etherscan.io/address/0x6c3ea9036406852006290770bedfcaba0e23a0e8
• https://github.com/paxosglobal/pyusd-contract
• https://docs.paxos.com/guides/stablecoin/pyusd/mainnet

Claim: All PYUSD addresses follow host-chain address models. Ethereum/Arbitrum uses hash-based addresses (limited protection for unused addresses). Solana exposes Ed25519 public keys directly and by default.

Coverage basis: Host-chain address derivation; no token-specific address layer

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: Solana PYUSD addresses expose public keys directly, creating permanent at-rest quantum vulnerability. Ethereum PYUSD addresses that have sent transactions have exposed public keys on-chain.

Assurance: Solana's address model is well-documented as exposing public keys directly. Ethereum's model protects only addresses that have never sent a transaction. Both are inherited by PYUSD per QRI §7.3 attack-window classification.

• https://etherscan.io/token/0x6c3ea9036406852006290770bedfcaba0e23a0e8
• https://docs.paxos.com/guides/stablecoin/pyusd/mainnet

Claim: PYUSD is a token with no independent consensus layer. Consensus authentication is N/A for token-level evaluation.

Coverage basis: Token architecture: no consensus mechanism

Implementation score: 1 · Evidence confidence: High

Issue classification: none · Score treatment: not applicable

Host-chain consensus vulnerabilities affect PYUSD indirectly but are scored under host-chain QRI evaluations, not token-level.

• https://github.com/paxosglobal/pyusd-contract

Claim: PYUSD supply integrity is controlled by classical ECDSA admin keys (owner multisig 0x0644Bd0248d5F89e4F6E845a91D15c23591e5D33, supplyController 0xE25a329d385f77df5D4eD56265babe2b99A5436e, assetProtectionRole) through the AdminUpgradeabilityProxy and SupplyControl contract. No PQ protection exists for supply-binding.

Coverage basis: Token-specific admin key infrastructure

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: Supply integrity, contract upgradeability, freeze/wipe, and pause controls are all gated by classical ECDSA keys. A quantum attacker compromising any admin key can break token state integrity.

Assurance: Admin key structure verified from on-chain contract code, Paxos documentation, LlamaRisk research, and Aave governance discussions. Owner multisig uses 3-of-20 threshold (Gnosis Safe). SupplyControl rate limits constrain per-day mint but do not prevent quantum forgery of the supplyController signature.

The SupplyControl contract implements daily rate limits on mint/burn, providing operational blast-radius mitigation but zero quantum resistance.

• https://github.com/paxosglobal/pyusd-contract/blob/master/contracts/PYUSDImplementation.sol
• https://etherscan.io/address/0x6c3ea9036406852006290770bedfcaba0e23a0e8
• https://github.com/paxosglobal/paxos-token-contracts

Claim: PYUSD has no privacy features, shielded pools, ZK proofs, or confidential transaction mechanisms.

Coverage basis: Token architecture: no privacy layer

Implementation score: 1 · Evidence confidence: High

Issue classification: none · Score treatment: not applicable

• https://github.com/paxosglobal/pyusd-contract

Claim: PYUSD has no P2P network layer. All network communication is handled by host chains.

Coverage basis: Token architecture: no P2P layer

Implementation score: 1 · Evidence confidence: High

Issue classification: none · Score treatment: not applicable

• https://github.com/paxosglobal/pyusd-contract

Claim: No PQ wallet, custody, or HSM path exists for PYUSD. All wallet interactions use classical signatures via host-chain tooling.

Coverage basis: Token inheritance; host-chain wallet ecosystem

Implementation score: 1 · Evidence confidence: High

Issue classification: none · Score treatment: not applicable

Assurance: PayPal and Venmo provide integrated PYUSD custody but use standard blockchain key management. No PQ-specific wallet infrastructure exists at the token level.

• https://www.paypal.com/us/cshelp/article/what-is-paypal-usd-pyusd-help1005
• https://www.paxos.com/pyusd

Claim: Approximately $3.48B in circulating PYUSD supply (June 2026, CoinMarketCap/CoinGecko) is fully quantum-vulnerable. Zero percent is protected by PQ or hybrid mechanisms. Supply contracted ~13% in May 2026.

Coverage basis: Circulating supply across all host chains

Implementation score: 0.05 · Evidence confidence: Medium

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: ~$3.48B in fully quantum-exposed value with zero protection, zero migration, and no recovery path.

Assurance: Market cap figures vary across sources (~$3.0B Kraken/AMBCrypto, ~$3.03B MetaMask, ~$3.48B CoinMarketCap/CoinGecko as of June 2026). Supply contracted ~13% in May 2026 per MetaMask. The March 2026 secondary source (Stablecoin Insider) reported ~$4.09B but this predates the supply contraction. The exact figure does not materially change the <25% coverage classification. Solana and Arbitrum supply breakdowns are not separately verified.

Per QRI §9.3.1 coverage thresholds: <25% coverage = 1 point (out of 20). PYUSD qualifies for this tier. All circulating supply across all chains is quantum-vulnerable with no protection.

• https://coinmarketcap.com/currencies/paypal-usd/
• https://www.coingecko.com/en/coins/paypal-usd
• https://etherscan.io/token/0x6c3ea9036406852006290770bedfcaba0e23a0e8

Claim: No PYUSD treasury, exchange, custodian, bridge, foundation, or protocol-controlled wallets have been migrated to PQ protection. All admin keys remain classical.

Coverage basis: Token admin keys, treasury wallets, and major holder addresses

Implementation score: 0 · Evidence confidence: Medium

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: Admin keys (proxy admin, owner, assetProtectionRole, supplyController) are all classical ECDSA addresses with no PQ migration path.

Assurance: Paxos documentation confirms admin addresses use multisig (Gnosis Safe, 3-of-20). Multisig signers remain classical ECDSA. Specific signer identities and threshold confirmed via LlamaRisk and Aave governance sources. PayPal's internal custody infrastructure for PYUSD reserves is off-chain and outside evaluation scope.

The admin keys govern the entire token supply across all chains. A quantum compromise of any single admin key (regardless of multisig) would be catastrophic.

• https://github.com/paxosglobal/pyusd-contract
• https://docs.paxos.com/guides/stablecoin/pyusd/mainnet

Claim: No legacy vulnerable PYUSD pools have been identified, measured, deprecated, or addressed. No quantum-specific policy mechanism exists for handling quantum-vulnerable PYUSD holdings.

Coverage basis: Absence of any vulnerability identification or deprecation program

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: No mechanism exists to identify, freeze, deprecate, or migrate quantum-vulnerable PYUSD holdings. The freeze/wipe functions exist but are themselves controlled by quantum-vulnerable keys.

Assurance: Paxos has freeze/wipe capability (assetProtectionRole) which could theoretically be used to address vulnerable holdings, but the freeze mechanism itself relies on quantum-vulnerable ECDSA signatures. This creates a circular dependency.

Per QRI §9.3.2, a protocol with a credible salvage/freeze/deprecation policy may receive partial credit. PYUSD has the technical freeze mechanism but no quantum-specific policy, timeline, or governance approval for using it in a quantum-migration context.

• https://github.com/paxosglobal/pyusd-contract
• https://www.paxos.com/pyusd

Claim: No public quantum migration or protection roadmap exists for PYUSD. Neither Paxos nor PayPal has published any PQC transition plan.

Coverage basis: Absence of any roadmap publication

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical uncertainty · Score treatment: score-reducing

Quantum blocker: No migration roadmap. Users and institutions have no timeline, activation criteria, or dependency analysis for PYUSD quantum migration.

Assurance: Exhaustive search of Paxos documentation, PayPal newsroom, GitHub repositories, and press releases confirms no quantum-related roadmap content. The G7 CEG January 2026 roadmap and EU PQC roadmap (June 2025) target 2035 for financial sector migration completion, providing an external benchmark Paxos/PayPal have not acknowledged.

• https://github.com/paxosglobal/pyusd-contract
• https://www.paxos.com/pyusd
• https://newsroom.paypal-corp.com/

Claim: No PQ account creation, wallet tooling, transaction paths, custody paths, user-facing warnings, education, or migration prompts exist for PYUSD.

Coverage basis: Absence of any migration tooling or user guidance

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: No PQ migration path, tooling, or user guidance exists. Users cannot protect their PYUSD holdings even if they want to.

Assurance: PayPal's consumer-facing documentation and Paxos's developer portal contain no quantum-related content, warnings, or guidance.

• https://www.paypal.com/us/cshelp/article/what-is-paypal-usd-pyusd-help1005
• https://www.paxos.com/pyusd

Claim: No enforcement mechanisms, deprecation schedules, disabled legacy signing, restricted withdrawals, unsafe-path blocking, or exchange/custody/bridge coordination exist for quantum migration.

Coverage basis: Absence of any enforcement or coordination activity

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: No enforcement mechanisms exist. Even if a PQ migration were designed, there is no authority or process to compel or coordinate it.

Assurance: Paxos's centralized control (owner, assetProtectionRole, proxy admin) theoretically provides strong enforcement capability for a migration if one were designed, but no such design exists. The capability is a double-edged sword: it enables enforcement but the enforcement keys themselves are quantum-vulnerable.

• https://github.com/paxosglobal/pyusd-contract
• https://www.paxos.com/pyusd

Claim: No quantum-specific emergency disclosure process, incident-response playbook, or governance mechanism has been published.

Coverage basis: Absence of any quantum-specific process documentation

Implementation score: 0 · Evidence confidence: High

Issue classification: assurance-only caveat · Score treatment: score-reducing

Assurance: Paxos has operational incident-response capability (pause, freeze) but no published quantum-specific process. Per QRI §8.2, absence of a formal quantum-specific IR playbook does not independently create a Readiness & Risk Cap. Score reduction here is due to zero implementation, not the playbook gap specifically.

• https://www.paxos.com/pyusd
• https://github.com/paxosglobal/pyusd-contract

Claim: PYUSD uses no PQC algorithms whatsoever. All cryptography is classical (ECDSA, Ed25519, keccak256).

Coverage basis: Complete absence of PQC algorithm usage

Implementation score: 0 · Evidence confidence: High

Issue classification: quantum-critical vulnerability · Score treatment: score-reducing

Quantum blocker: No PQC algorithms in use. All token and admin cryptography is classical.

Assurance: Contract source code confirms exclusive use of classical Solidity primitives (ecrecover for ECDSA, keccak256 for hashing). Solana SPL token uses Ed25519 via the Solana runtime. NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in 2024. None are used or referenced in PYUSD.

• https://github.com/paxosglobal/pyusd-contract/blob/master/contracts/PYUSDImplementation.sol

Claim: No independent quantum or post-quantum audit exists for PYUSD. Existing audits (Trail of Bits v1 2022, Zellic/Trail of Bits v2) are classical smart-contract audits with no quantum scope.

Coverage basis: Existing audits are classical-only with no PQ relevance

Implementation score: 0 · Evidence confidence: Medium

Issue classification: assurance-only caveat · Score treatment: score-reducing

Assurance: Existing audits are scope-mismatched for quantum assessment. Trail of Bits v1 (2022) covers the initial ERC-20 implementation. v2 audits by Zellic and Trail of Bits are referenced in the README but not directly linked. None include quantum threat modeling or PQC review. Since no PQC implementation exists to audit, the score reduction reflects the absence of any quantum assurance, not audit staleness per se.

Per QRI §6.4, scope-mismatched audits support only the audited component (classical ERC-20 security) and confidence is limited for the unaudited quantum scope.

• https://github.com/paxosglobal/pyusd-contract/blob/master/audit-reports/Trail_of_Bits_Audit_Report.pdf

Claim: PYUSD contract code is open-source (MIT license) and verified on Etherscan. However, there is no PQC implementation to evaluate for reproducibility.

Coverage basis: Open-source classical code; no PQC code exists

Implementation score: 0 · Evidence confidence: High

Issue classification: none · Score treatment: score-reducing

Assurance: Classical code is open-source, verified, and reproducible. This subfactor scores 0.00 because there is no PQC implementation to evaluate—the open-source nature of classical code is commendable but does not compensate for the absence of quantum-safe code.

PYUSD v2.1.0 (February 2026) is the latest release.

• https://github.com/paxosglobal/pyusd-contract
• https://etherscan.io/address/0x6c3ea9036406852006290770bedfcaba0e23a0e8

Claim: No documented parameter agility or PQC upgrade path exists. The AdminUpgradeabilityProxy enables contract upgrades but there is no quantum-specific upgrade plan.

Coverage basis: Technical upgrade capability exists but no quantum plan

Implementation score: 0 · Evidence confidence: Medium

Issue classification: operational/product caveat · Score treatment: score-reducing

Assurance: The AdminUpgradeabilityProxy pattern technically enables future PQC upgrades (e.g., adding PQ signature verification). However, the proxy admin key itself is quantum-vulnerable, creating a bootstrap problem: upgrading to PQ requires a quantum-safe admin key, but the admin key is classical.

• https://github.com/paxosglobal/pyusd-contract

Claim: No stateful signatures (XMSS/LMS) are used. This subfactor is not applicable because there are no stateful PQC signatures to evaluate for safety.

Coverage basis: No stateful signature schemes in use

Implementation score: 1 · Evidence confidence: High

Issue classification: none · Score treatment: not applicable

• https://github.com/paxosglobal/pyusd-contract

Claim: No PQ performance or resource-impact analysis exists for PYUSD. No assessment of how PQC migration would affect gas costs, transaction throughput, or wallet UX.

Coverage basis: Absence of any PQC performance analysis

Implementation score: 0 · Evidence confidence: High

Issue classification: operational/product caveat · Score treatment: score-reducing

Assurance: PQC signature sizes are significantly larger than classical (e.g., ML-DSA-65 ~3.3KB vs ECDSA ~64-72 bytes). On Ethereum, this would dramatically increase gas costs for PYUSD transfers and approvals. On Solana, Project Eleven's April 2026 testnet showed ~90% throughput reduction with PQ signatures. No analysis exists for how PYUSD would handle these impacts.

The Solana Foundation's April 2026 live testnet data (Project Eleven) confirms the magnitude of the PQ performance challenge.