Pennysia settlement exploit spends leftover Ethereum token approvals
A Pennysia swap route could call an arbitrary token contract using approvals users had left in place. Researchers traced one exploit transaction from four wallets. Revoke approvals even if swaps are disabled.
- Disclosed
- Nov 13, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Ethereum wallets with remaining ERC-20 allowances to the affected PennysiaSettlement contract.
- DeFi · Ethereum · Token approvals
- In the wild
- Yes
- SlowMist investigated user theft reports; an independent trace shows four wallets drained.
What happened
SlowMist says it investigated theft reports and identified an arbitrary external call in Pennysia’s Ethereum settlement contract. PandaSecurity reconstructed the trace: a caller-controlled route made the settlement contract invoke ERC-20 transferFrom against tokens users had already approved. A token controlled by the attacker let the route pass its balance checks. The affected wallets did not need to sign the attack transaction.
The observed transaction moved 5,006.133489 USDC, 0.05 wstETH and 101,000 YUNO from four wallets through the settlement and helper contracts. These are the amounts observed in that transaction; the sources do not establish a final loss total or reimbursements. PandaSecurity observed that the contract’s swap flag was off. Pausing swaps does not erase approvals, and the sources do not establish a patched deployment.
For operators of similar contracts, restrict external calls to approved targets and methods, and keep execution separate from the contract holding user allowances. Test that an arbitrary route cannot debit a third party’s balance or allowance.
Crime-scene timeline
Nov 12, 13:59 UTC
A transaction drains tokens from four wallets
The transaction in Ethereum block 26,399,314 uses remaining allowances to move three assets.
Nov 13, 2026
SlowMist alerts users and researchers trace the transaction
The trace analysis finds that swaps are disabled at the time of review. Existing allowances still need to be revoked.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- SlowMist original alert via public embedPrimaryExplains the arbitrary external call and the use of leftover allowances.
- PandaSecurity transaction-trace analysisPrimaryReconstructs the call flow, four affected wallets, token transfers and paused swap entry point.
- Ethereum transaction and token transfer recordsPrimaryShows token movements through the settlement and helper contracts.
- PennysiaSettlement verified contractPrimaryIdentifies the deployed contract for which approvals should be checked.