Post Mortem
Earlier today, a security breach targeting Penpie led to some loss of funds. In response, Pendle promptly paused our contracts, effectively safeguarding ~$105M that could have been further drained from Penpie.
Thanks to coordinated efforts from multiple parties, further breaches were mitigated, and Pendle contracts have now been unpaused. Normal operations have resumed.
Funds on Pendle were not at risk, and remain secure.
-------------------------------
At 1745 UTC, the attacker deployed the first contract to be used for the attack -
Immediately, our real-time in-house monitoring system detected this as a suspicious contract, having been funded from Tornado Cash and interacting with Pendle contracts.
At 1746 UTC, the team was already aware of the red flag and stayed on high alert, launching investigations to check if it is a real security threat against Pendle.
At 1823 UTC, the first attack happened on Penpie, an independent protocol building on top of Pendle. At 1825 UTC, ~2 minutes after Penpie’s security compromise, the team was fully mobilised to defend Pendle and Pencosystem against any subsequent attacks.
At 1834 UTC, we also got in touch with security experts Seal 911 to help assess the situation, evaluate the options, and devise appropriate strategies to stop any subsequent related attacks.
At 1845 UTC, we managed to pause all contracts on Pendle. This action helped stop any further attempts to drain assets from Penpie, ultimately safeguarding ~$105M that the attacker might have been able to drain from Penpie.
Thereafter, the team also actively reached out to protocols utilizing Pendle PTs as collateral and informed them of the contract pause (since PTs could not be liquidated during this time).
At 1852 UTC, our dev team confirmed that Pendle contracts were safe, and the attack was due to an issue specific to Penpie. The vulnerability was found to be linked to a unique feature that allowed permissionless listing of Pendle markets on Penpie.
Our next course of action was clear:
1️⃣ Make sure that Penpie themselves had paused their own contracts
2️⃣ Get in contact with other PENDLE liquid lockers such as Equilibria and StakeDAO to make sure they were not exposed to the same attack vector
3️⃣ Then, we could potentially unpause Pendle contracts safely
At 0050 UTC, after rigorous checks and coordination with all relevant parties to confirm step 1 and 2, Pendle contracts were safely unpaused, and normal operations resumed.
Throughout the incident, the Pendle team maintained active communication with security experts Seal 911 and Penpie to mitigate the situation. We extend our gratitude to Dan Caspi from @HypernativeLabs, @invlpgtbl, and 0xc0ffeebabe, as well as a special shoutout to @pcaversaccio for your assistance and expertise.
We want to reassure Pendies that funds on Pendle remain safe and unaffected, and we will continue to prioritize the safety and security of our platform above all elseetherscan.io/address/0x0ab3…
Earlier today, a security breach targeting Penpie led to some loss of funds. In response, Pendle promptly paused our contracts, effectively safeguarding ~$105M that could have been further drained from Penpie.
Thanks to coordinated efforts from multiple parties, further breaches were mitigated, and Pendle contracts have now been unpaused. Normal operations have resumed.
Funds on Pendle were not at risk, and remain secure.
-------------------------------
At 1745 UTC, the attacker deployed the first contract to be used for the attack -
Immediately, our real-time in-house monitoring system detected this as a suspicious contract, having been funded from Tornado Cash and interacting with Pendle contracts.
At 1746 UTC, the team was already aware of the red flag and stayed on high alert, launching investigations to check if it is a real security threat against Pendle.
At 1823 UTC, the first attack happened on Penpie, an independent protocol building on top of Pendle. At 1825 UTC, ~2 minutes after Penpie’s security compromise, the team was fully mobilised to defend Pendle and Pencosystem against any subsequent attacks.
At 1834 UTC, we also got in touch with security experts Seal 911 to help assess the situation, evaluate the options, and devise appropriate strategies to stop any subsequent related attacks.
At 1845 UTC, we managed to pause all contracts on Pendle. This action helped stop any further attempts to drain assets from Penpie, ultimately safeguarding ~$105M that the attacker might have been able to drain from Penpie.
Thereafter, the team also actively reached out to protocols utilizing Pendle PTs as collateral and informed them of the contract pause (since PTs could not be liquidated during this time).
At 1852 UTC, our dev team confirmed that Pendle contracts were safe, and the attack was due to an issue specific to Penpie. The vulnerability was found to be linked to a unique feature that allowed permissionless listing of Pendle markets on Penpie.
Our next course of action was clear:
1️⃣ Make sure that Penpie themselves had paused their own contracts
2️⃣ Get in contact with other PENDLE liquid lockers such as Equilibria and StakeDAO to make sure they were not exposed to the same attack vector
3️⃣ Then, we could potentially unpause Pendle contracts safely
At 0050 UTC, after rigorous checks and coordination with all relevant parties to confirm step 1 and 2, Pendle contracts were safely unpaused, and normal operations resumed.
Throughout the incident, the Pendle team maintained active communication with security experts Seal 911 and Penpie to mitigate the situation. We extend our gratitude to Dan Caspi from @HypernativeLabs, @invlpgtbl, and 0xc0ffeebabe, as well as a special shoutout to @pcaversaccio for your assistance and expertise.
We want to reassure Pendies that funds on Pendle remain safe and unaffected, and we will continue to prioritize the safety and security of our platform above all elseetherscan.io/address/0x0ab3…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
