Pennysia Ethereum Settlement Contract Exploited: Urgent Security Alert

Security firm SlowMist has issued a critical alert regarding the Pennysia Ethereum Settlement contract, which has fallen victim to a targeted cyberattack. Following reports of unauthorized fund transfers, investigators confirmed that a vulnerability within the smart contract allowed an attacker to drain assets from users who had previously granted spending permissions. The breach highlights the ongoing risks associated with token authorizations on decentralized platforms, particularly when residual approvals remain active after transactions are completed.

Mechanism of the Arbitrary External Call Vulnerability

The security breach originated from an arbitrary external call vulnerability within the Pennysia Settlement contract code. This technical flaw permitted the exploiter to trigger unauthorized functions, effectively bypassing standard security protocols. By leveraging this entry point, the attacker gained the ability to interact with ERC-20 tokens that users had authorized the contract to manage.

An arbitrary external call occurs when a contract allows an attacker to specify the destination and data for a call, potentially leading to the execution of malicious logic or unauthorized transfers.

The investigation revealed the following details regarding the incident:

• The attack targeted residual authorized funds—tokens that users had approved for use but had not yet been spent by the protocol.
• The exploit was executed on the Ethereum mainnet, impacting various assets held by the settlement contract's participants.
• SlowMist identified the breach after multiple reports of stolen assets surfaced from the platform's user base.

Urgent Mitigation Steps for Pennysia Users

In response to the exploit, security experts are urging all individuals who have interacted with the Pennysia Settlement contract to take immediate defensive action. The primary risk remains for users who have "infinite" or high-limit approvals still active in their wallets. Even if a user does not currently have a balance on the platform, any future deposits of the authorized tokens could be at risk if the permission is not removed.

SlowMist reminds all users who have authorized tokens to this Settlement contract to revoke their authorization immediately to prevent further loss of funds.

To secure their digital assets, users are advised to utilize revocation tools such as Revoke.cash or blockchain explorers like Etherscan to identify and cancel any permissions granted to the compromised contract address.

The Pennysia incident serves as a reminder of the importance of security hygiene in the decentralized finance (DeFi) ecosystem. As of November 13, 2026, the total amount of lost assets is still being calculated, and the Pennysia team has not yet released a formal compensation plan. Users are encouraged to monitor official channels for updates while prioritizing the immediate revocation of smart contract permissions to safeguard their remaining holdings.