Briefing
On September 3, 2024, Penpie Finance, a yield farming protocol operating on Arbitrum and integrated with Pendle Protocol, experienced a severe reentrancy attack, resulting in the loss of approximately $27 million in digital assets. This incident stemmed from a critical flaw within the _harvestBatchMarketRewards() function of its PendleStaking contract, which lacked an essential reentrancy guard. The attacker exploited this vulnerability by repeatedly invoking the function before the contract’s internal state could update, thereby inflating reward balances and illicitly siphoning funds. The absence of robust market validation mechanisms further enabled the exploit, allowing the attacker to leverage counterfeit tokens and malicious markets.
Context
Prior to this incident, the DeFi ecosystem had grappled with a persistent class of reentrancy vulnerabilities, a well-documented risk dating back to early blockchain exploits. Despite numerous security audits being standard practice, such flaws often persist when critical functions lack adequate reentrancy protection or when administrative functions are made permissionless without subsequent rigorous re-auditing. The prevailing attack surface for yield farming protocols frequently includes complex reward distribution logic and reliance on external market data, necessitating stringent validation that was demonstrably absent in this case.
Analysis
The attack vector originated from a reentrancy vulnerability embedded within the _harvestBatchMarketRewards() function of Penpie’s PendleStaking contract. This function, designed for processing token transfers and calculating staking rewards, crucially lacked a reentrancy guard. The attacker initiated the exploit by creating a malicious market with a counterfeit SY token, which the protocol’s inadequate validation mechanisms failed to detect as fraudulent.
Subsequently, the attacker repeatedly called the _harvestBatchMarketRewards() function, specifically leveraging the redeemRewards() sub-function to deposit additional tokens during reward calculation. This manipulation artificially inflated the amountAfter balance, leading to an overestimation of eligible rewards and enabling the attacker to withdraw a significantly larger sum of assets than entitled, culminating in the $27 million loss.
Parameters
- Protocol Targeted ∞ Penpie Finance (integrated with Pendle Protocol)
- Attack Vector ∞ Reentrancy Exploit
- Vulnerable Function ∞ _harvestBatchMarketRewards() in PendleStaking contract
- Financial Impact ∞ ~$27 Million
- Blockchain ∞ Arbitrum
- Exploit Date ∞ September 3, 2024
- Contributing Factor ∞ Inadequate market validation and missing reentrancy guard
Outlook
In the wake of this incident, immediate mitigation for users involves reviewing interactions with similar yield farming protocols, particularly those with complex reward distribution or market creation mechanisms. Protocols must prioritize comprehensive smart contract security audits, ensuring that all functions, especially those with elevated privileges or those transitioning to permissionless access, are rigorously re-audited for reentrancy and input validation flaws. The industry will likely see an increased emphasis on advanced testing methodologies like mutation testing to uncover latent vulnerabilities that traditional audits might miss. This event reinforces the imperative for continuous on-chain monitoring and robust incident response frameworks to safeguard digital assets and maintain ecosystem integrity.
