$27 348 000 USD

SEPTEMBER 2024

GLOBAL

PENPIE

DESCRIPTION OF EVENTS

"Penpie is a next-generation DeFi platform designed to provide Pendle Finance users with yield and veTokenomics boosting services. Integrated with Pendle Finance, Penpie focuses on locking PENDLE tokens to obtain governance rights and enhanced yield benefits within Pendle Finance. Penpie revolutionizes the way users can optimize rewards for their active participation and monetize their governance power.

 

Penpie offers users the opportunity to deposit their assets to earn maximized APR % while it allows Pendle Finance voters to cost-effectively acquire voting power and user active engagement rewards at the same time through the PNP token.

 

Penpie gives PENDLE holders the chance to earn high APR by converting their tokens into mPENDLE. By leveraging the power of Pendle Finance's veTokenomics model, Penpie offers users the opportunity to earn more PENDLE rewards with their PENDLE tokens. Penpie has created mPENDLE, a Penpie version of the PENDLE token, which allows users to earn enhanced PENDLE rewards while enjoying increased flexibility through Penpie. This mechanism gives PENDLE holders the chance to earn high APR% by converting their tokens into mPENDLE at a 1:1 ratio.

 

When users convert their PENDLE tokens on Penpie, they receive mPENDLE, which enables them to earn maximized PENDLE rewards. Meanwhile, Penpie locks all the converted PENDLE as vePENDLE on Pendle Finance, resulting in the accumulation of vePENDLE for Penpie. This vePENDLE entitles Penpie to enhanced benefits on Pendle Finance. As a result, Penpie can offer users a sustainable, boosted yield to active participants and cost-effective governance rights."

 

"Despite audits by WatchPug and Zokyo, this glaring oversight slipped through the cracks."

 

"The root cause was a reentrancy protection vulnerability in the PendleStakingBaseUpg::batchHarvestMarketRewards() function. By re-entering the PendleStakingBaseUpg::depositMarket() function during the reward harvesting process, the malicious SY contract repeatedly added new deposits sourced from flash loan. This allowed the attacker to manipulate the reward token and their amounts sent to the fake Pendle market depositor, which is the attacker itself.

 

Penpie’s open system for permissionless registration of new Pendle markets triggered this fraudulent activity, the design of permissionless registration itself is fine, but it allowed the attacker to register a fake Pendle market with an attack SY contract and execute the exploit, which uncovered the reentrancy vulnerability."

 

"According to the blockchain gumshoes at PeckShield, the root cause was "the introduction of an evil market that was used to inflate the staking balance to claim unwarranted rewards."

 

Translation for the non-tech savvy: the attacker created a fake Pendle market, essentially tricking Penpie's contracts into thinking they were dealing with the real McCoy.

 

Ancilia provided more information, highlighting that the exploit stemmed from a sneaky loophole in Penpie's batchHarvestMarketRewards() function.

 

In a flash, the attacker launched a reentrancy attack, creating a fake Pendle market to dupe Penpie's contracts.

 

When the _harvestBatchMarketRewards() function called redeemRewards(), the hacker's contract slipped in, executing a deceptive maneuver that would make seasoned con artists envious.

 

The end result? A textbook double-dip, inflating the attacker's staking balance and siphoning off undeserved rewards."

 

"Seems like @Penpiexyz_io got hacked. $17M loss."

 

"Alert: Penpie has encountered a security compromise.

 

We have paused all deposits and withdrawals. Our team is working tirelessly to address it. Your patience and support are invaluable during this time."

 

"On September 3, 2024, at 6:23 PM UTC, a sophisticated attacker exploited a security vulnerability within the Penpie platform, seizing control of users’ funds and draining over $27,000,000 worth of assets across the Arbitrum and Ethereum networks. The attacker manipulated a fake Pendle market to maximize rewards."

 

"In light of the recent security compromise on @Penpiexyz_io, we want to assure our community that we have identified the root cause, and all other protocols within the Magpie ecosystem remain secure and unaffected."

 

"Dear community, deposits and withdrawals on @Penpiexyz_io remain paused as the platform undergoes full audits by several security firms to ensure a safe resumption of operations. @BlockSecTeam, @peckshield, and @AstraSecAI have already initiated their audits, and we are in discussions with additional companies. It is anticipated that deposits and withdrawals will resume in approximately 2-3 weeks, pending the successful completion of these audits.

 

In collaboration with @hexagate_, we are integrating real-time monitoring to establish a highly efficient and proactive response system.

 

We continue to work closely with law enforcement, security firms, partners, and key members of the crypto community, including major exchanges, to trace, track, and freeze funds linked to the hacker.

 

Also, steps are being taken to prepare a post on the Penpie governance forum to open discussions on a potential compensation plan. To our users and partners, thank you for your ongoing support and patience as we navigate through this process."

Penpie is a next generation yield farming platform. Unfortunately, during the deployment of their smart contract, a potential reentrancy vulnerability was not caught by 2 auditing firms. At the time, the vulnerability could not be exploited as only approved smart contract could be used, however this was subsequently allowed. At the time of the subsequent allowance, the portion of the smart contract with the vulnerability was not included in the audit. An attacker was able to create a malicious contract which repeatedly obtained the rewards incentive. Penpie attempted to negotiate with the hacker unsuccessfully before offering a 10% bounty for information leading to recovery of the funds. The Penpie protocol reportedly has $105m funds remaining that were not exploited, and plans to relaunch after extensive auditing is completed.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.