A NullMeridian record Andromeda Logs

NullMeridianLog

3 Sep 2024

Penpie: Missing Reentrancy Guard on batchHarvestMarketRewards

Penpie: on 3 Sep 2024 missing reentrancy protection in PendleStakingBaseUpg.batchHarvestMarketRewards let a malicious SY inflate rewards via flash-loaned assets during harvest. ~11,113.6 ETH (~$27.35M) reported lost.

  • Event date
  • Incident typeSmart-contract exploit
  • Bug classReentrancy
  • Published

Loss, as sourced

11,113.6 ETH, about $27.35 million, per Penpie's post-mortem as summarized in Magpie governance and contemporaneous primary reporting of that post-mortem. Penpie paused deposits/withdrawals.

Traceability

Primary sources

  1. 01gov.magpiexyz.ioMagpie governance: Penpie incident overview (opens in a new tab)
  2. 02blog.penpiexyz.ioPenpie Post-Mortem Report (opens in a new tab)

In brief

Root cause: Per Penpie post-mortem (via Magpie overview): missing reentrancy protection in batchHarvestMarketRewards allowed a malicious SY to re-enter depositMarket during reward harvesting and inflate rewards using flash-loaned assets.

Timeline, as sourced: Per Magpie/Penpie: 3 Sep exploit; deposits/withdrawals paused; frontend restored; FBI and Singapore police reports filed (per contemporaneous coverage of Penpie statements).

Account, as sourced

Claimed (Penpie/Magpie) (governance thread (opens in a new tab)): compensation discussion opened.

Note: Penpie Medium post-mortem URL returned 403 to automated fetch this session; Magpie governance thread used as accessible primary discussion of the same incident.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/penpie-batch-harvest-reentrancy-2024