{
  "id": 4324126,
  "title": "Security Audit Report: Reentrancy & Access Control Review: Paxos Gold",
  "url": "https://urgent.news/2026/08/30/security-audit-report-reentrancy-access-control-review-paxos-gold",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-30T01:21:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/dannydoes_2abdf9c/security-audit-report-reentrancy-access-control-review-paxos-gold-4jgg"
  },
  "original_language": "en",
  "account": "Paxos Gold (PGX) is a regulated, fiat-backed token that represents physical gold on-chain. The protocol's core contracts include PGXToken ERC-20 token, PGXBridge for L1↔L2 deposit/withdrawal, PGXController for role-based admin and upgradeability, PGXReserve for custody and audit-reporting interface, and PGXStaking (optional) for a yield-bearing staking wrapper on L2. The security audit focused on two high-impact security domains: Reentrancy and Access Control.\n\nThe audit found several vulnerabilities. In Reentrancy, the bridge's withdraw function has an external call before updating the withdrawal nonce, creating a checks-effects-interactions violation. Such an attack could allow unlimited double-spending of gold-backed tokens, leading to over-minting of PGX and a breach of the 1:1 gold peg.\n\nAccess Control issues include a public setPendingOwner function in PGXController that can be called by any address, a lack of rotation for the ownership key stored in a 3-of-5 multisig, granting the PAUSER_ROLE to a single external contract (PGXStaking), and the use of nonReentrant modifier in PGXStaking's reward-distribution loops. These issues could be exploited for Denial-of-Service attacks, rug-pulls, or hidden backdoors.\n\nThe combined risk score is 8/10, indicating a high-impact attack surface that could lead to loss of user funds or prolonged service disruption. The audit recommends adding a reentrancy guard to PGXBridge.withdraw, restricting setPendingOwner to onlyOwner, tightening the PAUSER_ROLE, rotating proxy admin multisig keys, and adding nonReentrant modifiers to external call loops in reward-distribution contracts.",
  "summary": "Security Audit Report: Reentrancy & Access Control Review: Paxos Gold Target Protocol : Paxos Gold (TVL: $1913.4M) Security Audit Report – Reentrancy & Access‑Control Review Protocol: Paxos Gold (PGX) – TVL ≈ $1.913 B (Ethereum + L2) Date: 30 August 2026 Auditor: [Your Name], Senior DeFi Security Researcher 1. Executive Summary Paxos Gold (PGX) is a regulated, fiat‑backed token that represents…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Security Audit Report: Reentrancy & Access Control Review: Grove Finance",
        "url": "https://urgent.news/2026/08/29/security-audit-report-reentrancy-access-control-review-grove-finance",
        "published": "2026-08-29T14:56:47.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}