Penpie

Pendle

when

<h2 class="wp-block-heading">Pythia hit with reentrancy attackDecentralized finance protocol Pythia Finance was drained of $53,000 via a reentrancy attack on Sept. 3, according to a report from blockchain security firm Quill Audits. Pythia is an algorithmic stablecoin project that aims to use artificial intelligence to manage its treasury.The attacker called the claim rewards function repeatedly, without allowing the reward balance to be updated after each call, allowing them to collect more rewards than they were entitled to.<a href="https://x.com/quillaudits_ai/status/1830987505987920162" target="_blank" rel="nofollow">According</a> to the report, the attacker was able to call this function repeatedly and in rapid succession because Pythia called the tokens safe transfer function when rewards were distributed. Thus, a malicious token contract could call back Pythia, causing Pythia to call it back again, and resulting in a chain reaction that could drain the protocols funds.
 <figure class="wp-block-image aligncenter size-large is-resized">
 <img decoding="async" width="1024" height="488" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/Pythia-exploit-1024x488.png" alt="Pythia code with exploit vulnerability on the left and a text explanation of it on the right." class="wp-image-35846" style="width: 100%;height:auto" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/Pythia-exploit-1024x488.png 1024w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/Pythia-exploit-300x143.png 300w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/Pythia-exploit-770x367.png 770w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/Pythia-exploit.png 1150w" sizes="(max-width: 1024px) 100vw, 1024px">
 <figcaption class="wp-element-caption">
 Screenshot of Pythia partial audit report. (Pythia / X).
 </figcaption>
 </figure>Quill Audits partial audit report for Pythia <a href="https://shield.quillai.network/PythiaTokenStaking/shareablelink/75a7cfa0233b0ba1693e48b6f3fdce294cbaecef52111ed1fab7ac08de080ed9?type=3&amp;projectID=804" target="_blank" rel="nofollow">shows</a> zero unresolved security issues, implying that the team may have upgraded the contract to prevent any further use of this exploit.A reentrancy attack, in which an attacker calls a function repeatedly without allowing its code to fully execute, is one of the most common types of smart contract exploits.</h2>
<h2 class="wp-block-heading" id="zyxel-critical-vulnerability">Zyxel critical vulnerability</h2>
On Sept. 4, networking hardware manufacturer Zyxel disclosed a critical vulnerability in some of its networking devices that could have allowed attackers to execute code on users routers and access points, potentially allowing hackers to gain access to users devices.
According to the disclosure, the vulnerability was the result of The improper neutralization of special elements in the parameter host in the CGI program of several different firmware versions. Because of this improper neutralization, these firmware versions could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.
Crypto wallet users should be especially cautious about potential attacks against their home networks. If an attacker gains access to a users home network, they can use this access to redirect a users traffic through DNS spoofing, view any unencrypted data sent across the network, or use deep packet inspection to decrypt data that is encrypted. The data obtained may be used for social engineering attacks to convince the user to approve transactions or to share their private keys.
Zyxel has <a href="https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-aps-and-security-router-devices-09-03-2024" target="_blank" rel="nofollow">provided</a> a list of the potentially affected devices, which includes the NWA50AX PRO, NWA90AX, WAC500, and other access points, as well as the USG LITE 60AX router. The manufacturer advised users of these devices to upgrade their firmware.
<h2 class="wp-block-heading" id="penpie-exploiter-created-fake-pendle-market">Penpie exploiter created fake Pendle Market</h2>
The $27 million Penpie exploit was made possible because of a flaw that allowed any user to create a Pendle market, according to a Sept. 4 report from blockchain security firm Zokyo. The report claims that an earlier version of the protocol was audited by Zokyo but did not contain the flaw at the time.
Penpie <a href="https://zokyo.io/blog/penpie-postmortem-analysis-of-the-27m-reentrancy-exploit/" target="_blank" rel="nofollow">contains</a> a function called registerPenpiePool that can be used to register a new pool address and Pendle Market, the report stated. To prevent malicious markets from registering, it contains a modifier that checks to see if the Pendle Market is already listed in Pendle Finances factory contract. If its not listed in this factory contract, then it cant be registered. However, any user can get their market listed in the factory contract by calling the createNewMarket function in the factory contract. According to the report, this essentially means that any user can create a Pendle Market and register it.
The attacker exploited this vulnerability to create a fake Pendle Market and pool, which were configured to provide valuable Pendle tokens as rewards.
<figure class="wp-block-image aligncenter size-full is-resized">
 <img decoding="async" width="634" height="487" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/pendle-finance-create-new-market.png" alt="Pendle Finance code for create new market function" class="wp-image-35845" style="width: 100%;height:auto" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/pendle-finance-create-new-market.png 634w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/pendle-finance-create-new-market-300x230.png 300w" sizes="(max-width: 634px) 100vw, 634px">
 <figcaption class="wp-element-caption">
 Pendle Finance createNewMarket function. (Zokyo).
 </figcaption>
</figure>
The protocol also contained a reentrancy flaw that allowed any market to deposit tokens repeatedly and before other balances could be updated. The attacker called the deposit function over and over again, artificially inflating the rewards to be earned. They then withdrew the deposit and claimed the rewards, draining the protocol of over $27 million.
According to the report, the reentrancy flaw existed in the version that Zokyo audited. But in that version, only the protocol team would have been able to register a new pool and market, which should have prevented an external attacker from making use of it. The report states:
The _market parameter received in the batchHarvestMarketRewards(…) method was not expected to be malicious as in the earlier version of the code audited by Zokyo, only the owner (multi-sig) can register a pool.
In a separate report published on Sept. 3, the Penpie team <a href="https://blog.penpiexyz.io/penpie-post-mortem-report-1ac9863b663a" target="_blank" rel="nofollow">claimed</a> that it introduced permissionless pool registration approximately one year after Zokyo performed its audit. At the time, it hired security firm AstraSec to audit the new registration system. However, only the new contracts were in scope of this audit. Since the exploit resulted from an interaction between two different contracts audited by two different teams, neither of them caught the vulnerability. Penpie claimed that it will do periodic audits of the entire protocol in the future to ensure that incidents like this wont happen again. Penpie is a decentralized finance protocol that attempts to provide yield boosting to Pendle Finance users. The exploit against it <a href="https://cointelegraph.com/news/penpie-protocol-exploited-suffers-27-million-loss" target="_blank" rel="nofollow">occurred on Sept. 3</a>.

2 auditors miss $27M Penpie flaw, Pythia’s ‘claim rewards’ bug: Crypto-Sec

Table of Contents

Cointelegraph

Other articles published on Sep 10, 2024

Kujira team to build new THORChain app layer following ‘Rujira’ merge

Metalpha on Ethereum Selling Spree, Can Dump 51,300 ETH By End of Week

TON’s Meme Coin DOGS Leads the Largest Meme TGE in History

Coinbase’s L2 Network Base Surpasses Arbitrum and Ethereum with 4.2M Daily Transactions

Insights on Altcoin Trends: Trading Levels and Volume

Fed’s Initial Rate Cut Excites Markets but Doesn’t Guarantee Risk Market Upsurge

Join our free newsletter for daily crypto updates!