USD Coin (USDC) Smart Contract Risk
Blocklist / Freezable
⚡ MEDIUM severityVulnerability
USDC includes a blocklist feature controlled by Circle. Addresses on the blocklist cannot send or receive USDC, which can break protocol accounting if a user address gets blocked.
Related: Access Control
Safe integration
Account for the possibility of blocked transfers. Use try/catch around USDC transfers and implement fallback mechanisms for blocked addresses.
Contract addresses
| Chain | Address |
|---|---|
| Ethereum | 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 |
| Polygon | 0x3c499c542cef5e3811e1192ce70d8cc03d5c3359 |
| Arbitrum | 0xaf88d065e77c8cc2239327c5edb3a432268e5831 |
| Base | 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913 |
Audit any contract that interacts with USDC: SmartContract.us automatically detects USDC integration risks →
Chain & standard security guides
What this contract permits today
Read live from Ethereum on 2026-10-14. This is a different question from the integration risk above: not how to call the token safely, but what the holders of its keys are able to do to the people holding it.
| Question | Answer |
|---|---|
| Can new tokens be created? | Yes |
| Can transfers be blocked? | Yes |
| Is there a trading tax? | No |
| Can the logic be replaced? | Yes |
| Can liquidity be withdrawn? | Yes |
Control is split across 4 addresses: 0xFcb19e6a322b27c06842A71e8c725399f049AE3a (owner-gated functions, a single private key); 0xE982615d461DD5cD06575BbeA87624fda4e3de17 (creating new tokens, a contract); 0x0A06BE16275B95a7d2567fBdAE118b36C7DA78F9 (blocking transfers, a single private key); 0x4914f61d25e5C567143774B76EdbF4D5109a8566 (blocking transfers, a single private key). 3 of them are a plain private key. Whether that is acceptable depends on who holds them.