Penpie Hack

Reported loss $27.0M
Ethereum Arbitrum
Cross-contract reentrancy

What happened

On September 3, 2024, Penpie, a yield-boosting protocol integrated with Pendle, was exploited across Ethereum and Arbitrum for approximately $27 million. The attacker introduced a malicious Pendle market backed by a counterfeit Standardized Yield contract, then used its reward callback to corrupt Penpie's reward accounting. The incident affected Penpie's staking and reward-distribution system, not Pendle's core protocol.

Security analyses identify a missing reentrancy guard in Penpie's batch reward-harvesting path and insufficient validation of markets accepted by that path as the combined cause.

Technical root cause

Penpie's batchHarvestMarketRewards path made an external reward-redemption call after recording balances but before finalizing reward accounting, without reentrancy protection. A malicious market could therefore re-enter during that callback and make deposits that appeared to the outer call as newly harvested rewards. The attack also depended on Penpie treating permissionlessly created Pendle markets as trusted reward sources.

How it happened

  1. The attacker created a counterfeit Standardized Yield contract and used Pendle's permissionless market infrastructure to create a market that Penpie accepted for reward processing.
  2. They then invoked Penpie's batch reward-harvesting flow with the malicious market.
  3. That flow captured reward-token balances before making an external call to the market's reward-redemption logic.
  4. The malicious market used the callback opportunity to re-enter Penpie and deposit flash-loaned liquidity into legitimate Pendle markets.
  5. When the original harvest resumed, Penpie treated the balance increase as harvested rewards rather than newly deposited liquidity.
  6. The attacker was credited with inflated rewards, withdrew the resulting Pendle LP positions, redeemed them for underlying assets, repaid the flash loans, and retained the difference.

Protocol details

Classification Reentrancy / untrusted market validation
Protocol Type Yield
Implementation language Solidity
Protocol links Website @Penpiexyz_io
Attacker Address 0x7a2f4d625fb21f5e51562ce8dc2e722e12a61d1b
Exploit Transaction 0x42b2ec27c732100dd9…ea7ce0d8e5

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Reentrancy

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes