Pendle v2 (Part 1) audit
WatchPug reviewed Pendle Finance (Pendle v2 (Part 1) audit) on 28 Jun 2022: 10 findings, 0 critical; 7 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 3 | 4 |
HighImproper handling of deposit with a baseToken that is also a rewardToken may result in users losing the rewardsFixed
The report gives no description here.
HighImproper handling of redeem() with a tokenOut that is also a rewardTokenFixed
The report gives no description here.
HighPendleYearnVaultScy.sol#_redeem() When withdrawing from a yvVault , some of the shares tokens may not be used but still burned from the user’s balanceFixed
The report gives no description here.
Low_updateAndDistributeInterest will overflow when exchangeRateCurrent > 3e38Fixed
The report gives no description here.
LowNew YieldContract can be created with the permisionless createYieldContract() with a non-uponly SCYFixed
The report gives no description here.
LowReuse arithmetic results can save gasFixed
The report gives no description here.
LowSending the rewards to the treasury in every token transfer after the expiry is gas inefficientFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Pendle Finance’s security record
Pendle FinanceSecurity firm
1 project reviewed · 1 report · latest Aug 2026
See WatchPug’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us