The Pennysia vulnerability caused the loss of all user-granted authorizations
SlowMist reports that Pennysia's Ethereum payment contract was exploited through an arbitrary function call vulnerability, allowing attackers to transfer user-approved tokens into the contract that were never used.
11/14/20263 min read
The harmful effects of an unsolicited call from outside the home.
The ERC-20 approval model separates authorization from execution. A user approves a contract to spend a certain amount of tokens, and the contract then calls the `transferFrom` function to actually transfer those tokens. This approval persists until it is revoked, and user interfaces often require unlimited approval so that users are not prompted on each subsequent interaction.
An arbitrary external call vulnerability means the contract can be manipulated to make a call to an address and with call data provided by an attacker. When that is achievable, the attacker instructs the contract to call the token and execute `transferFrom` on behalf of whoever approved it. The call originates from the contract, so from the token's perspective, the expenditure is perfectly legitimate. Nothing is broken in the token. Nothing is broken in the approval process. The contract holding the authorization is simply turned into a tool for the attacker to use.
This is why the advice is to withdraw rather than reclaim funds. Money in a contract is a risk. Money in your wallet behind an active approval is another risk, and most users don't consider the second risk to be a risk.
The problem with the security structure.
Unlimited approvals are the biggest unregulated risk in the conventional use of DeFi, and they are the product of a decision based on user experience rather than a technical need. A user who interacted with the protocol once in 2023 and never returned still has open access, and that access is only secure if the contract holding it remains in existence for an unlimited period of time.
The practical solution isn't to be vigilant after an incident. It's to only approve the necessary funds, which costs an extra transaction each time, and periodically check open approvals with a revocation tool. Almost nobody does both of those things, which is why this type of exploitation continues to be lucrative for long-obsolete protocols.
Role in the cryptocurrency community
The information regarding the vulnerability is very vague. SlowMist has not released any figures on the damages, the contract address has not been mentioned in the articles, and Pennysia itself has not been fully documented. There is no information to determine whether the vulnerability was introduced during the upgrade process, whether the contract has been audited, or whether the project has responded.
For the reader, this means two things. Anyone who has interacted with Pennysia should immediately revoke their certificate and verify the address based on SlowMist's announcement, not from any links in secondary articles, because phishing websites impersonating certificate revocation tools appear just hours after announcements like this. And anyone who takes the lack of damage figures as proof that the damage was minor is understanding that silence is data. A theft involving publicly approved certificates is limited by the amount the approving wallet holds, and that's not a number anyone can estimate from the outside.
Assessment and Conclusion
This is a minor incident in a month full of major ones, and its value lies more in being a reminder than in being news. The Binance breach stole login credentials through a fake job interview. The bee-js attack exploited a legitimate CI process. The Keystone and SafePal data breaches leaked customer data, which is now being used in physical mail scams. None of these breaches broke the encryption layer.
The common thread is that the encryption layer remains intact, but the permission layer surrounding it doesn't. Approval is a permission you've granted and no longer think about, making it the kind of thing that's silently vulnerable to errors. Revoking what you no longer use only takes ten minutes, and that's the most beneficial security action a typical DeFi user can take.
Disclaimer: The content in this article is for informational, research, data analysis, and reference purposes only regarding the cryptocurrency market. All opinions, assessments, forecasts, or opinions reflect the author's perspective at the time of publication and do not constitute investment advice, solicitations for buying or selling, trading recommendations, advertising, marketing, or promotion of any financial products, services, or cryptocurrencies. Mentions of projects, tokens, protocols, exchanges, wallets, or cryptocurrency service providers (CASPs) are for research, analysis, or informational purposes only and should not be construed as endorsements, recommendations, or guarantees in any way. HCCVenture does not broker, advertise, market, promote, or connect users in Vietnam with any cryptocurrency services from CASPs. HCCVenture does not accept asset custody, investment mandates, manage assets, or execute transactions on behalf of clients. All investment decisions are made entirely through the reader's own research (DYOR), evaluation, and responsibility; HCCVenture is not liable for any losses or damages arising from the use of or reliance on the information presented in this article.
Compiled and analyzed by HCCVenture
Join our information channels: https://link3.to/holdcoincventure
Explore HCCVenture group
HCCVENTURE QUANT JSCO
© 2026 HCCVENTURE. ALL COPYRIGHTS RESERVED.
Connect with us
Popular content
Contact to us
Address: 8th Floor, Bach Dang Complex Building, 50 Bach Dang Street, Hai Chau Ward, Da Nang City, Vietnam.
Phone: 1900 1509
Gmail : sp_contact@hccventure.com
Disclaimer: The information on this website is for informational purposes only and should not be considered investment advice. We are not responsible for any risks or losses arising from investment decisions based on the content here.
TERMS AND CONDITIONS • CUSTOMER PROTECTION POLICY
ANALYTICAL AND NEWS CONTENT IS COMPILED AND PROVIDED BY EXPERTS IN THE FIELD OF DIGITAL FINANCE AND BLOCKCHAIN BELONGING TO HCCVENTURE ORGANIZATION, INCLUDING OWNERSHIP OF THE CONTENT.
RESPONSIBLE FOR MANAGING ALL CONTENT AND ANALYSIS: HCCVENTURE FOUNDER - TRUONG MINH HUY
Read warnings about scams and phishing emails — REPORT A PROBLEM WITH OUR SITE.
