Pendle / PT Looping audit
WatchPug reviewed Pendle Finance (Pendle / PT Looping audit) on 7 Aug 2026: 11 findings, 0 critical; 3 marked fixed, 8 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings11
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 0 | 6 | 3 |
MediumclaimMMRewards's unrestricted external call lets a malicious/compromised frontend/backend drain the box and money-market position to an arbitrary addressAcknowledged
The report gives no description here.
MediumswapBridgeWithdrawAll minimum-output check counts the box's pre-existing output-token and input-token balanceAcknowledged
The report gives no description here.
Low_boxBridgeToken() fails to validate that msg.value == b.nativeFee.Acknowledged
The report gives no description here.
LowConsider bypassing the _ltvCheck for deleveraging operations that don't involve a withdrawalAcknowledged
The report gives no description here.
LowOwner's isZeroPriceImpact intent is not bound to the swap executionAcknowledged
The report gives no description here.
LowPendlePTLooper._boxSwapToken() fails to validate minSwapRate when tokenIn == tokenOut.Acknowledged
The report gives no description here.
LowPendlePTLooper._boxSwapToken() returns incorrect values when tokenIn == tokenOut.Acknowledged
The report gives no description here.
LowRewards that are airdropped to MoneyMarket will be locked in the contractAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Pendle Finance’s security record
Pendle FinanceSecurity firm
1 project reviewed · 1 report · latest Aug 2026
See WatchPug’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us