Analysis of the Penpie exploit
Last evening, Penpie, a yield optimizer and liquid locker built on Pendle, was exploited for ~$27 million.
The attacker created a fake market and counterfeit SY tokens on Pendle. While this is completely harmless to Pendle, Penpie failed to account for such adversarial scenarios, enabling the attacker to execute a re-entrancy attack. This resulted in the theft of $27 million in rswETH, wstETH, agETH, and sUSDe from Penpie.
The stolen tokens were then sold for ETH using the LiFi DEX router. The attacker subsequently withdrew the ETH to various addresses and has deposited over 95% of the stolen funds into Tornado Cash.
In response, the Pendle team acted swiftly to pause all their contracts, preventing an additional $105 million in potential losses for Penpie users.
Market impact
The attacker had minimal impact on wstETH and sUSDe pegs when selling the stolen funds on Uniswap V3 and Curve. However, the exploit did cause a slight depeg of rswETH on PancakeSwap and a significant depeg of agETH on Balancer.
Additionally, PNP, Penpie's token, plummeted by 40% as investor confidence in the project sharply declined. In contrast, the PENDLE token remained unaffected in ETH terms. Indeed, the Pendle protocol was neither affected by nor responsible for this exploit.
Thoughts & Learnings
As investors, assessing counterparty risk, especially smart contract risk is crucial and often overlooked. Depositing LP tokens into another smart contract introduces significant additional layers of risk that must be carefully evaluated. Often, you'll find that the potential reward doesn't justify the extra risk.
Pendle team's devops, alerting and response was top notch, preventing a further $105m loss to Penpie users. This is even more impressive accounting for the fact that this happened in the middle of the night Singapore hours.
Thoughts are with those affected by this exploit.
To conclude, Pendle.