Pendle Finance security record
As of 30 Oct 2026, Pendle Finance has 12 audit reports by 3 security firms on Trustblock; the latest is by WatchPug, dated 7 Aug 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits12
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Pendle / PT Looping audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle MarketV6 audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle Boros Markets | Security firm: ChainSecurity | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Pendle SparkLinearDiscountOracle audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle V2 Core | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Pendle LP Oracle audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle PT Oracle audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 2) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 1, Follow up 2) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 1, Follow up 1) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 1) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings82
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 9 |
| Medium | 3 | 3 | 9 |
| Low | 1 | 22 | 34 |
MediumclaimMMRewards's unrestricted external call lets a malicious/compromised frontend/backend drain the box and money-market position to an arbitrary addressPendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportMediumswapBridgeWithdrawAll minimum-output check counts the box's pre-existing output-token and input-token balancePendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportMediumIn PendleMarketFactoryV6Upg.initialize(_owner, ...) , when _owner is not msg.sender , the setTreasuryAndFeeReserve() call will revert due to the onlyOwner modifier.Pendle MarketV6 audit · WatchPug · 23 Oct 2025Acknowledged
The report gives no description here.
Open the reportLow_boxBridgeToken() fails to validate that msg.value == b.nativeFee.Pendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowConsider bypassing the _ltvCheck for deleveraging operations that don't involve a withdrawalPendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowOwner's isZeroPriceImpact intent is not bound to the swap executionPendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowPendlePTLooper._boxSwapToken() fails to validate minSwapRate when tokenIn == tokenOut.Pendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowPendlePTLooper._boxSwapToken() returns incorrect values when tokenIn == tokenOut.Pendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowRewards that are airdropped to MoneyMarket will be locked in the contractPendle / PT Looping audit · WatchPug · 7 Aug 2026Acknowledged
The report gives no description here.
Open the reportLowIn future upgrades of PendleMarketFactoryV6Upg, any changes to the getMarketConfig interface will break compatibility with previously deployed Market contracts.Pendle MarketV6 audit · WatchPug · 23 Oct 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowInaccurate userRewardOwedPendle V2 Core · ChainSecurity · 15 Aug 2024Acknowledged
The report gives no description here.
Open the reportLowInitial Liquidity Mismatches WhitepaperPendle V2 Core · ChainSecurity · 15 Aug 2024Acknowledged
The report gives no description here.
Open the reportLowMismatches With EIP-5115Pendle V2 Core · ChainSecurity · 15 Aug 2024Acknowledged
The report gives no description here.
Open the reportLowmsg.value Can Be Non-Zero When tokenIn Not Being ETHPendle V2 Core · ChainSecurity · 15 Aug 2024Acknowledged
The report gives no description here.
Open the reportLowNative Token Rewards Cannot Be Received by PYPendle V2 Core · ChainSecurity · 15 Aug 2024Acknowledged
The report gives no description here.
Open the reportLowRounding in Favour of User When Adding LiquidityPendle V2 Core · ChainSecurity · 15 Aug 2024Acknowledged
The report gives no description here.
Open the reportLowgetPtToAssetRate() will revert during the first durationPendle LP Oracle audit · WatchPug · 26 May 2023Acknowledged
The report gives no description here.
Open the reportLowThe units of the variables involved in calculating rateHypTrade should be consistent.Pendle LP Oracle audit · WatchPug · 26 May 2023Acknowledged
The report gives no description here.
Open the reportLowWhen the real index ( SY.exchangeRate() ) is less than YT.pyIndexCurrent() , PendleLpOracleLib may not be working as expectedPendle LP Oracle audit · WatchPug · 26 May 2023Acknowledged
The report gives no description here.
Open the reportLowEnd the Vote a few hours earlier before the next week starts can help avoid leftoverPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Acknowledged
The report gives no description here.
Open the reportShow 5 more
LowThe external rewards should not be distributed according to vePENDLE shares based activeBalancePendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowManipulatable SCY.exchangeRate() can be dangerous for PY tokensPendle v2 (Part 1, Follow up 2) audit · WatchPug · 22 Jul 2022Acknowledged
The report gives no description here.
Open the reportLowAn attacker can front-run the initial liquidity provider and add imbalance PT/SYC liquidity to rug the liquidity providerPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Acknowledged
The report gives no description here.
Open the reportLowIf a newly added rewardToken happens to be the underlying yield token, users’s deposit may be wrongfully distributed as rewardsPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Acknowledged
The report gives no description here.
Open the reportLowThe initial liquidity provider will lose some LP which can never be redeemedPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Acknowledged
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="pendle"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us