{
 "version": "v1",
 "generatedAt": "2026-10-15T21:09:14Z",
 "name": "PYUSD (Paxos)",
 "named_from": "dashboard",
 "chain": "Ethereum",
 "address": "0x6c3ea9036406852006290770bedfcaba0e23a0e8",
 "composite": 2,
 "band": "critical",
 "keys_to_move": 1,
 "react_hours": 0,
 "money_per_key_usd": null,
 "not_assessed": [
  "the money behind one key (no money figure, or no key count)",
  "the protocol's total value locked (no DefiLlama match)"
 ],
 "sub": {
  "adminKeyScore": 5,
  "multisigScore": 0,
  "timelockScore": 0,
  "oracleAuthorityScore": 100,
  "crossExposureScore": 100
 },
 "requirements": [
  {
   "label": "Admin power is not a bare key",
   "met": false
  },
  {
   "label": "At least a 3-of-5 multisig",
   "met": false
  },
  {
   "label": "A confirmed delay before changes apply, no bypass",
   "met": false
  },
  {
   "label": "Bypass paths of the delay checked and ruled out",
   "met": false
  },
  {
   "label": "Price feed not under one hand",
   "met": true
  },
  {
   "label": "No key shared with another tracked protocol",
   "met": true
  }
 ],
 "exit_window": "none: a change applies at once",
 "tvl_usd": null,
 "category": null,
 "at_risk_usd": null,
 "narrative": {
  "summary": "The proxy admin and the owner are accounts with no code. Either can replace the token's logic or act as the owner, with no delay.",
  "tag": "accounts with no code, no timelock, composite 2",
  "detail": "Added 2026-10-11. Scored 5 / 0 / 0 (composite 2). Read: the proxy admin, owner(), defaultAdmin() and supplyControl() (the mint authority, a contract whose owner is followed); all four lead to accounts with no code, three of them to the same one. Whether one key, an HSM or an MPC service holds an account with no code cannot be observed on chain; the score treats it as a bare EOA, the methodology's convention."
 },
 "score_account": null,
 "paused": null,
 "side_roles": null,
 "side_pending": null,
 "safe_activity": null,
 "admin_probe": null,
 "held": null,
 "dispute": null,
 "independent_read_reproduce": {
  "rpc": "https://ethereum-rpc.publicnode.com",
  "steps": [
   {
    "what": "owner() on the contract: the holder",
    "method": "eth_call",
    "params": [
     {
      "to": "0x6c3ea9036406852006290770bedfcaba0e23a0e8",
      "data": "0x8da5cb5b"
     },
     "latest"
    ]
   },
   {
    "what": "eth_getCode on the holder: 0x means a plain key",
    "method": "eth_getCode",
    "params": [
     "<holder>",
     "latest"
    ]
   },
   {
    "what": "eth_getTransactionCount on the holder: how many transactions this key has sent (425 at the read)",
    "method": "eth_getTransactionCount",
    "params": [
     "<holder>",
     "latest"
    ]
   }
  ],
  "curl": "# owner() on the contract: the holder\ncurl -s -X POST https://ethereum-rpc.publicnode.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x6c3ea9036406852006290770bedfcaba0e23a0e8\",\"data\":\"0x8da5cb5b\"},\"latest\"]}'\n# eth_getCode on the holder: 0x means a plain key\ncurl -s -X POST https://ethereum-rpc.publicnode.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getCode\",\"params\":[\"<holder>\",\"latest\"]}'\n# eth_getTransactionCount on the holder: how many transactions this key has sent (425 at the read)\ncurl -s -X POST https://ethereum-rpc.publicnode.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getTransactionCount\",\"params\":[\"<holder>\",\"latest\"]}'",
  "block": "latest",
  "note": "read between blocks 26199869 and 26199870 of the chain; this RPC cannot replay the block of the read (it ignores the block tag, or no longer serves old state): the answers are the current ones"
 },
 "history": [
  {
   "t": "2026-10-11T06:34:38Z",
   "composite": 2,
   "from": "watch"
  },
  {
   "t": "2026-10-13T01:45:10Z",
   "composite": 2,
   "from": "push"
  }
 ],
 "feed": "https://raw.githubusercontent.com/RealSpap/authority-risk-oracle-showcase/watch-data/feed/ethereum-l1-sepolia/0x6c3ea9036406852006290770bedfcaba0e23a0e8.xml",
 "reproduce": {
  "rpc": "https://ethereum-sepolia-rpc.publicnode.com",
  "to": "0xB6F8474ccC71AF477c31c2DF663B3942ddfbf906",
  "data": "0xd47875d00000000000000000000000006c3ea9036406852006290770bedfcaba0e23a0e8",
  "block": "0xb5eb8d",
  "composite_word": 6,
  "block_honoured": true,
  "note": null,
  "curl": "curl -s -X POST https://ethereum-sepolia-rpc.publicnode.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0xB6F8474ccC71AF477c31c2DF663B3942ddfbf906\",\"data\":\"0xd47875d00000000000000000000000006c3ea9036406852006290770bedfcaba0e23a0e8\"},\"0xb5eb8d\"]}'"
 },
 "consumer_example": {
  "verdict": "zero",
  "collateral_factor_bps": 0,
  "text": "collateral factor 0 (score 2 is under MIN_SAFE_SCORE 60)"
 },
 "cheapest_fix": {
  "band": "weak",
  "next": 20,
  "axis": "admin key",
  "from": 5,
  "to": 49,
  "what": "a stronger admin setup (admin power spread beyond one key, or checked by others)"
 },
 "main_gap": {
  "requirement": "Admin power is not a bare key",
  "reason": "One key, or a tiny group, can change it"
 },
 "independent_read": {
  "path": "owner()",
  "holder": "0x3af3\u2026024b",
  "pending_admin": null,
  "pending_via": null,
  "self_delay_seconds": null,
  "kind": "eoa",
  "since": "2026-10-11T06:43:46Z",
  "posture": "admin: a plain key, 425 transactions sent; delay: none",
  "exposure": {
   "keys_to_move": 1,
   "react_hours": 0,
   "tvl_usd": null,
   "money_per_key_usd": null,
   "money_source": null,
   "held_symbol": null,
   "held_amount": null
  }
 },
 "score_cluster": null,
 "last_pushed": 1791855910,
 "stale": false,
 "methodology_hash": "0x46a1a85b619e7db0f81e543674e8aa0a3a1afba36b7500fe2cb256e0024db645",
 "block": 11922317,
 "live": "https://realspap.github.io/oracle/#chain=all&q=0x6c3ea9036406852006290770bedfcaba0e23a0e8",
 "page": "https://realspap.github.io/oracle/p/ethereum-l1-0x6c3ea9036406852006290770bedfcaba0e23a0e8.html",
 "license": "CC BY 4.0, attribution: Authority Risk Oracle, realspap.github.io/oracle"
}