Sun Yuchen Again Points Out USD1 Contract Can Transfer User Funds Without Consent
Sun Yuchen emphasized that the highest authority of USD1 can transfer USD1 from accounts to the issuer or others' wallets without user permission, and cold wallets or multi-signatures cannot prevent this. The implementation of these permissions was not approved by WLFI holders and constitutes a self-added backdoor.
He also pointed out that the USD1 source code displayed on World Liberty's official GitHub is not the code currently executed on-chain. The publicly available source code does not have drain and reallocate functions, but the StablecoinV2 upgraded in April 2026 can perform these two operations on frozen balances.
Merely viewing the official GitHub underestimates the current centralized control permissions of USD1. Sun Yuchen stated that this is consistent with the previous model of WLFI tokens adding backdoors, which constitutes a fraudulent onboarding process.
Related technical analysis was published by independent researchers, and Sun Yuchen urged users to verify the on-chain contract themselves. This statement continues his litigation claims against World Liberty.
From a market mechanism perspective, the exposure of contract-level forced transfer permissions exacerbates trust risks in stablecoins, and funds may accelerate outflow from USD1-related assets; the incident is driven by public technical comparisons, benefiting security audits and transparency advocates while putting pressure on the project party.
Source: Public Information
ABAB AI Insight
Sun Yuchen continues to detail the issues of USD1's drain and reallocate permissions and the mismatch with the source code in Chinese, directly translating technical details into public doubts about World Liberty's centralized control and transparency, reinforcing his litigation narrative.
In terms of capital pathways, the project added sensitive functions post-upgrade in the contract without synchronously disclosing them, shifting resources from claimed transparent code to actual administrator control, with the motive to retain final disposal capability over frozen funds, including the introduction of transfer permissions in the April V2 upgrade.
Similar cases can be seen in other stablecoins that have triggered trust crises due to excessive administrator permissions, as well as precedents of inconsistencies between code audits and on-chain deployments; the current stablecoin sector is in a phase of intensified scrutiny over bank license applications and contract control rights.
Essentially, this is a technical substitution: user asset autonomy is replaced by contract administrator permissions, with the mechanism designed to allow forced transfers after freezing, locking final control at the issuance end, thereby weakening the actual decentralization level of on-chain custody.
ABAB News · Cognitive Law
The day the source code is inconsistent with the on-chain, transparency has already gone bankrupt.
Permissions that cold wallets cannot block are the true centralized trump cards.
The number of times backdoors are added will ultimately define the project's trust ceiling.