Pendle v2 (Part 1, Follow up 1) audit

WatchPug15 Jul 2022Not recorded. See the report

WatchPug reviewed Pendle Finance (Pendle v2 (Part 1, Follow up 1) audit) on 15 Jul 2022: 9 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Pendle Finance’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	3
Medium	0	0	1
Low	0	0	5

High_swapScyForExactYt() When current exchangeRate is lower than the highest history exchangeRate , the user will be charged for extra SCY and lose part of the PT minted to the marketFixed

The report gives no description here.

HighPendleYearnVaultScy.sol Wrong decimals for exchangeRate()Fixed

The report gives no description here.

HighPendleYearnVaultScy.sol Wrong implementation of _redeem()Fixed

The report gives no description here.

MediumPendleYieldToken.sol transfer of YT tokens may revert or cause loss of rewards after expirationFixed

The report gives no description here.

LowActionCallback._callbackSwapScyForExactYt() Wrong implementation to guard against precision issue while calculating totalScyNeedFixed

The report gives no description here.

LowActionSCYAndYTBase.sol#_swapScyForExactYt() Wrong return valueFixed

The report gives no description here.

LowAvoid unnecessary expensive external calls can save gasFixed

The report gives no description here.

LowPendleQiTokenSCY.sol decimals of the SCY token should not be fixed as 18Fixed

The report gives no description here.

LowPendleYearnVaultScy.sol decimals of the SCY token should not be fixed as 18Fixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Pendle Finance’s security record

Pendle Finance

Audits4 audits by 3 firmsLast audit Aug 2026, by WatchPug.

Critical findingsNo open critical findingsAcross the 4 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.

Open Pendle Finance’s security record

Security firm

WatchPug

1 project reviewed · 1 report · latest Aug 2026

See WatchPug’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.