Pendle Finance security record
As of 30 Oct 2026, Pendle Finance has 12 audit reports by 3 security firms on Trustblock; the latest is by WatchPug, dated 7 Aug 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits12
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Pendle / PT Looping audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle MarketV6 audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle Boros Markets | Security firm: ChainSecurity | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Pendle SparkLinearDiscountOracle audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle V2 Core | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Pendle LP Oracle audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle PT Oracle audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 2) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 1, Follow up 2) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 1, Follow up 1) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle v2 (Part 1) audit | Security firm: WatchPug | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Pendle | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings82
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 9 |
| Medium | 3 | 3 | 9 |
| Low | 1 | 22 | 34 |
CriticalHigh Priced Buy Order on Empty Orderbook Can Generate Bad DebtPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportHighWeak Margin Check Allows Creating Bad DebtPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportHighWhen the real index ( SY.exchangeRate() ) is less than YT.pyIndexCurrent() , PendlePtOracle may not be working as expectedPendle PT Oracle audit · WatchPug · 26 May 2023Fixed
The report gives no description here.
Open the reportHighPendleYieldToken._beforeTokenTransfer() should not call _setPostExpiryData() without checking if isExpired()Pendle v2 (Part 1, Follow up 2) audit · WatchPug · 22 Jul 2022Fixed
The report gives no description here.
Open the reportHigh_swapScyForExactYt() When current exchangeRate is lower than the highest history exchangeRate , the user will be charged for extra SCY and lose part of the PT minted to the marketPendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportHighPendleYearnVaultScy.sol Wrong decimals for exchangeRate()Pendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportHighPendleYearnVaultScy.sol Wrong implementation of _redeem()Pendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportHighImproper handling of deposit with a baseToken that is also a rewardToken may result in users losing the rewardsPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Fixed
The report gives no description here.
Open the reportHighImproper handling of redeem() with a tokenOut that is also a rewardTokenPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Fixed
The report gives no description here.
Open the reportHighPendleYearnVaultScy.sol#_redeem() When withdrawing from a yvVault , some of the shares tokens may not be used but still burned from the user’s balancePendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumPendleLpOracleLib is incompatible with older markets that don’t have the market.reentrancyGuardEntered() functionPendle MarketV6 audit · WatchPug · 23 Oct 2025Fixed
The report gives no description here.
Open the reportMediumTWAP Manipulation by Orderbook ClearingPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportMediumUnsafe Use of Narrow Type in Inline AssemblyPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportMediumLP Oracle Library ManipulationPendle V2 Core · ChainSecurity · 15 Aug 2024Fixed
The report gives no description here.
Open the reportMediumLP Oracle Library Reverts After ExpiryPendle V2 Core · ChainSecurity · 15 Aug 2024Fixed
The report gives no description here.
Open the reportMediumWhile converting the PTs in the totalHypotheticalAsset to Asset, rateOracle should be used instead of rateLastTrade .Pendle LP Oracle audit · WatchPug · 26 May 2023Fixed
The report gives no description here.
Open the reportMediumWrong implementation of PendleVotingControllerUpg#vote() will revert when there are pools that get more weights than beforePendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportMediumPendleRouter#_callbackSwapYtForScy may not pay enough SCY to the PT AMM marketPendle v2 (Part 1, Follow up 2) audit · WatchPug · 22 Jul 2022Fixed
The report gives no description here.
Open the reportMediumPendleYieldToken.sol transfer of YT tokens may revert or cause loss of rewards after expirationPendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportLowAaveMoneyMarketView._liquidity calculates borrowable liquidity using the physical balance of aTokens.Pendle / PT Looping audit · WatchPug · 7 Aug 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowBox owners should be allowed to terminateSession.Pendle / PT Looping audit · WatchPug · 7 Aug 2026Fixed
The report gives no description here.
Open the reportLowConsider adding token out amount to the TokenSwapped eventPendle / PT Looping audit · WatchPug · 7 Aug 2026Fixed
The report gives no description here.
Open the reportLowOutdated comment about PendleYieldContractFactory’s upgradeabilityPendle MarketV6 audit · WatchPug · 23 Oct 2025Fixed
The report gives no description here.
Open the reportLowPendleGaugeController may need to be upgraded to add marketFactory5 to support markets created by the new PendleMarketFactoryV6UpgPendle MarketV6 audit · WatchPug · 23 Oct 2025Fixed
The report gives no description here.
Open the reportLowFee Can Make Liquidations UnprofitablePendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportLowForce Cancel Risky Users Can Be BlockedPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportLowforceDeleverage() Does Not Follow SpecificationPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportLowMain Account Has Priority When Increasing CollateralPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportLowMargin Rounding Allows Exiting With Open PositionsPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportLowNo Minimum Position Size RequirementPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowPREVRANDAO Opcode Behavior on L2 ChainsPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportLowsignedSize Internal Method Returns Incorrect ResultPendle Boros Markets · ChainSecurity · 8 Aug 2025Fixed
The report gives no description here.
Open the reportLowlatestRoundData() can revert due to underflow issue when interest rates are high and maturities are long.Pendle SparkLinearDiscountOracle audit · WatchPug · 2 Oct 2024Fixed
The report gives no description here.
Open the reportLowIncorrect Required CardinalityPendle V2 Core · ChainSecurity · 15 Aug 2024Fixed
The report gives no description here.
Open the reportLowNot All Functionality Paused in SYPendle V2 Core · ChainSecurity · 15 Aug 2024Fixed
The report gives no description here.
Open the reportLowAdding mainchain gaugeController into sidechainContracts is confusing and unnecessaryPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowAvoid unnecessary storage read can save gasPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowDuplicate event emissionsPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowExpired markets should be excluded from PENDLE rewards automaticallyPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowIt’s possible that the pool address can be the same on different networks, and we should avoid thatPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowPendleVotingControllerUpg.sol#_broadcastResults() Precision loss due to div before mulPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowUsers will not naturally update others’ activeBalancePendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowvePENDLE.sol Combine two external calls into one can save gasPendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowVotingEscrowPendleMainchain#_broadcast() should refund the unspent crosschain message feePendle v2 (Part 2) audit · WatchPug · 2 Aug 2022Fixed
The report gives no description here.
Open the reportLowActionCallback._callbackSwapScyForExactYt() Wrong implementation to guard against precision issue while calculating totalScyNeedPendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportLowActionSCYAndYTBase.sol#_swapScyForExactYt() Wrong return valuePendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportLowAvoid unnecessary expensive external calls can save gasPendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportLowPendleQiTokenSCY.sol decimals of the SCY token should not be fixed as 18Pendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportLowPendleYearnVaultScy.sol decimals of the SCY token should not be fixed as 18Pendle v2 (Part 1, Follow up 1) audit · WatchPug · 15 Jul 2022Fixed
The report gives no description here.
Open the reportLow_updateAndDistributeInterest will overflow when exchangeRateCurrent > 3e38Pendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Fixed
The report gives no description here.
Open the reportShow 3 more
LowNew YieldContract can be created with the permisionless createYieldContract() with a non-uponly SCYPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Fixed
The report gives no description here.
Open the reportLowReuse arithmetic results can save gasPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Fixed
The report gives no description here.
Open the reportLowSending the rewards to the treasury in every token transfer after the expiry is gas inefficientPendle v2 (Part 1) audit · WatchPug · 28 Jun 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="pendle"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us