USD1's $4 billion stablecoin carries wallet powers its GitHub omits

The gap between USD1's live contract and its public repository is verifiable, even as Justin Sun's broader fraud claims remain unsupported by available evidence.

World Liberty Financial's $4 billion USD1 stablecoin carries administrative functions on-chain that its own public GitHub repository does not show, a disclosure gap that surfaced as Justin Sun escalated fraud allegations against the Trump-backed project.

"USD1's highest-level permissions allow the issuer to move USD1 out of YOUR account into its own wallet — or anyone else's — without your consent," Justin Sun, founder of Tron, said on X on Aug. 21. "Cold wallet? Multisig? Doesn't matter. The authority operates at the token contract level."

USD1 operates through an upgradeable proxy that moved to its current StablecoinV2 implementation on April 5. That version contains drain and reallocate functions that apply to frozen accounts. A technical review of the contract found drain transfers a frozen address's full balance to the contract owner, while reallocate can move a specified amount from a frozen address to another address. Neither action requires approval from the affected holder.

The gap matters because World Liberty is pursuing final approval from the Office of the Comptroller of the Currency for a national trust bank that would assume USD1 issuance, redemption, and reserve management from BitGo. The OCC granted preliminary conditional approval on Aug. 14, but final authorization remains subject to pre-opening requirements, including at least $20 million in Tier 1 capital.

What the live code allows

The functions do not give arbitrary users access to someone else's USD1 or allow unrestricted transfers from any wallet at any time. They sit behind privileged permissions and operate on frozen balances. The harder issue is the gap between the deployed contract and World Liberty's own published repository.

The project's GitHub code includes minting, burning, freezing, and pausing functions, but does not show the drain, reallocate, or V2 initializer functions present in the live implementation. The deployed code itself is publicly visible through verified blockchain explorers, so the functions are not hidden from anyone inspecting the active contract directly. Still, a developer or investor relying on World Liberty's own repository would not see the full set of administrative powers governing USD1 today.

That distinction is significant because centralized stablecoins routinely retain intervention rights. Tether's USDT and Circle's USDC issuers can freeze or blacklist addresses, while BitGo, USD1's current issuer and technical provider, says in its terms that it may freeze or upgrade USD1 and, in some legal or compliance circumstances, render assets permanently unusable. Those disclosures make the existence of centralized controls less unusual. They do not explain why World Liberty's public repository has not kept pace with its deployed contract.

A legal fight with regulatory stakes

The allegations deepen a dispute between Sun and World Liberty that has been building for months. Sun was one of the project's early investors, committing $45 million to WLFI. Their relationship deteriorated after World Liberty restricted his access to the tokens, accused him of improperly moving assets, and sued him for defamation. Sun denies the allegations.

On Aug. 20, Sun claimed he had won a procedural victory that would keep his personal claims against World Liberty in federal court. The case, Sun et al v. World Liberty Financial LLC, is assigned to Judge James Donato in the U.S. District Court for the Northern District of California. World Liberty CEO Zach Witkoff said Sun's account of the hearing was "riddled with falsehoods," arguing the court had made no ruling and that some claims brought by Sun's companies belong in arbitration.

The timing raises the stakes for World Liberty. Sun's attack came seven days after the OCC granted preliminary conditional approval to World Liberty Trust Company. USD1 is also approaching that transition with a smaller supply base — circulating supply has fallen by more than $1.3 billion from a February peak above $5.3 billion to $4 billion, according to DeFiLlama data. The token remains pegged to the dollar, unlike WLFI, which trades near $0.061, down about 87 percent from its September high of $0.46.

The decline began before Sun's latest allegations and does not show that holders are redeeming because of the contract dispute. It does, however, leave World Liberty pursuing final bank approval while its flagship stablecoin sits below its recent peak.

The available evidence does not establish that World Liberty deliberately kept its repository outdated to mislead users or auditors. Nor does the code discrepancy indicate a reserve shortfall, impaired backing, or unauthorized movement of USD1 from holder accounts. What remains harder to dismiss is the disclosure gap: USD1's live contract contains powers that World Liberty's own public repository does not fully reflect, just as the company seeks final approval for a regulated trust bank that would eventually oversee the stablecoin.

This article is for informational purposes only and does not constitute investment advice.