Crypto▼ Bearish
HKDAP stablecoin contract has broken KYC controls, analyst says
Security analyst Yajin Zhou found HKDAP's KYC module has a broken revocation function and governance concentrated in a single key. The HKMA-licensed stablecoin launched August 12.
Continue with
A security review published by analyst Yajin Zhou says HKDAP, the Hong Kong dollar stablecoin from Standard Chartered-backed Anchorpoint, runs on an Ethereum contract that is not production-ready. Its Know-Your-Customer and revocation controls do not work as coded.
HKDAP launched August 12 through Anchorpoint Financial, a Standard Chartered Bank (Hong Kong) subsidiary jointly owned with telecom operator HKT and Web3 firm Animoca Brands. The token settles on Ethereum mainnet with source code verified on Etherscan, which let Zhou's team inspect it directly.
The review checked two things: whether the code was correct and ready for real-world use, and whether its on-chain behavior follows the HKMA's official rules for stablecoin issuers. The answer to both was no.
The contract has several functional flaws. A single key can mint new tokens, freeze accounts, pause the system, and force-burn tokens. It lacks a time-lock, a standard feature that delays high-risk actions for review. Zhou's team said the contract "clashes with specific clauses" in the HKMA regulations.
The compliance controls meant to block unauthorized users do not work as written. The KYC module has a broken revocation function. If a KYC provider is de-registered, the wallets that provider approved can still transact. KYC proofs are not validated on-chain, and deregistered verifiers can still approve new users.