Penpie: Reentrancy via fake Pendle market → staking balance inflation → excess reward drain
Penpie lost $27M when an attacker registered a fake Pendle market and exploited a reentrancy vulnerability in the harvest rewards function to inflate their staking balance and drain legitimate pool rewards.
Summary #
Penpie suffered a Yield Aggregator / Pendle Booster on 2024-09-03, resulting in a loss of approximately $27M.
What happened #
Penpie lost $27M when an attacker registered a fake Pendle market and exploited a reentrancy vulnerability in the harvest rewards function to inflate their staking balance and drain legitimate pool rewards.
Linked factors #
- RD-F-001 — causal : ★ Direct: Audit scope mismatch (report commit ≠ deployed bytecode) [via cross-hack: Factor 1: Audit Scope Mismatch]
- RD-F-004 — causal : Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-audit feature addition)]
- RD-F-006 — causal : Audit-deploy gap (RD-F-006 time between audit and deploy) [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Likely Y — the `batchHarvestMarketRewards()` function appears to be a later addition] || Audit-deploy gap — alternate field name [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Likely Y — the `batchHarvestMarketRewards()` function appears to be a later addition] || Time between audit end and deploy [via cross-hack: Factor 4: Newly Deployed or Unannounced Contract] || (+1 more matches)
- RD-F-007 — related : Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
- RD-F-046 — related : ★ Contract unverified at launch — adjacent (no public ABI as a permissionless variant) [via cross-hack: Factor 7: Permissionless Feature Without Safety Validation]
- RD-F-072 — causal : Market-listing governance threshold = permissionless [via cross-hack: Factor 7: Permissionless Feature Without Safety Validation]
- RD-F-111 — causal : Team doxx status — pseudonymous-no-track-record class [via dashboard_risk_factors/Team anonymity: Unknown]
- RD-F-139 — causal : ★ Post-audit code changes deployed without re-audit [via cross-hack: Factor 21: Post-Audit Code Change Without Re-Audit]
- RD-F-141 — related : Test-mode parameters left on in deploy (possibly related) [via cross-hack: Factor 4: Newly Deployed or Unannounced Contract]
- RD-F-146 — related : New deploys in last 30 days (fresh attack surface) [via cross-hack: Factor 4: Newly Deployed or Unannounced Contract] || New deploys in last 30 days — fresh attack surface [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Likely Y — the `batchHarvestMarketRewards()` function appears to be a later addition]