- Hacken found that compromising two signing keys could give an attacker control over privileged actions affecting about $91.3 billion in USDT on TRON.
- The cybersecurity firm found no mechanism for seizing administrative control of the TRON deployment with a single key.
- Hacken said reused signing keys could allow three compromised signers to affect USDT deployments on multiple networks.
- According to the assessment, privileged operations have no time delays, while audited minting paths impose no onchain limits on issuance volumes.
Cybersecurity firm Hacken conducted an assessment of USDT governance on TRON, Ethereum and Solana, networks that together account for 98% of the stablecoin’s native supply, or about $184.6 billion. The assessment found that critical administrative actions depend on a small number of signers and can take effect without delay, creating risks if multiple signing keys are compromised.
Hacken’s analysis covered governance controls, signer arrangements, privileged operations, proof of reserves and onchain constraints on token issuance.
About half of USDT supply is on TRON
About $91.3 billion in USDT, roughly half of the token’s total supply, is concentrated on TRON. Privileged control over that amount operates through a 2-of-3 multisignature arrangement, meaning an administrative transaction requires approval from two of three designated key holders.
Hacken said compromising two signing keys could potentially allow an attacker to control privileged actions affecting the entire amount of USDT on TRON. The firm found no way to seize administrative control using only one key.
The TRON contract has no timelock, cancellation mechanism or other method to roll back administrative changes, according to the assessment.
Signing keys are reused across networks
Hacken also identified the reuse of the same set of signing keys on multiple networks. Ethereum, Avalanche and Celo use the same six keys under a 3-of-6 approval arrangement.
On Avalanche and Celo, those keys also control the ability to replace the token’s code. Hacken said the compromise of three signers could therefore potentially affect several USDT deployments at once rather than a single network.
The assessment found no time delays for privileged USDT operations. Minting tokens, freezing addresses and, where applicable, upgrading smart contracts take effect immediately after the required number of signatures has been collected.
According to Hacken, a timelock would create a window between approval and execution in which defenders could detect and stop a potentially malicious operation.
Audited minting paths have no onchain issuance limits
Hacken fully factored USDT’s proof of reserves into its assessment but lowered its rating because there is no onchain link between reserve verification and direct token issuance.
The firm found no onchain constraints on issuance volumes in the audited stablecoin minting paths. Once the required signer quorum authorizes a transaction, the contracts impose no additional limit on the amount of USDT that can be issued.
Source: Incrypted
