-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0350
============================================================

Advisory-ID:  0xCERT-2026-0350
Severity:     Low
Published:    2026-11-13T06:57:31.000Z
Updated:      2026-11-14T16:41:38.671Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0350

Title: Pennysia Settlement contract on Ethereum exploited via arbitrary external call to drain leftover token approvals

Summary
- -------
An arbitrary external call in Pennysia's Settlement contract on Ethereum let an attacker spend users' leftover ERC-20 approvals, taking about $5.1K from four users per DefiLlama. Anyone who approved tokens to 0x3aad97e5a91b8e43b7dc830aceb004307678795e should revoke now (SlowMist).

Details
- -------
Summary
SlowMist reports that Pennysia's Settlement contract on Ethereum was exploited through an arbitrary external call, which let the attacker spend users' leftover ERC-20 approvals to that contract. SlowMist says it investigated after users reported stolen funds. DefiLlama's hacks dataset records the incident on 12-13 November 2026 with about $5,131 taken from four users (USDC, wstETH and YUNO).

Affected
- - Pennysia Settlement contract on Ethereum: 0x3aad97e5a91b8e43b7dc830aceb004307678795e (the vulnerable protocol contract, listed so users can revoke approvals; it is not an attacker indicator)
- - Any wallet that has ever approved tokens to that contract
- - Fix: none announced at time of publication

Impact
Per SlowMist, an attacker can use the arbitrary external call in the Settlement contract to transfer tokens out of any wallet that still has an allowance to it. Per DefiLlama, the attacker deployed malicious tokens to get past spending checks in executeSwap() and then used existing allowances to pull USDC, wstETH and YUNO directly from users' wallets. Exploitation in the wild is confirmed. Losses reported so far are small (about $5.1K), but any approval left in place is still exposed until it is revoked.

Recommended actions
- - Revoke every token approval granted to 0x3aad97e5a91b8e43b7dc830aceb004307678795e on Ethereum now (for example with revoke.cash or Etherscan's token approval checker).
- - Wallets and security tools: block the attacker address listed below and warn users who sign approvals to the Settlement contract.
- - Wait for Pennysia's official post-mortem before interacting with the protocol again.

Source & attribution
This 0xCERT advisory summarises a SlowMist TI Alert (https://x.com/SlowMist_Team/status/2121135351377047735), which names the attacker address and attack transaction, corroborated by DefiLlama's hacks dataset (https://defillama.com/hacks). Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/SlowMist_Team/status/2121135351377047735
- - https://etherscan.io/tx/0x2716c50e450272240f68f2827bcb4a336c2ac520951e0e530154566c295b732d
- - https://defillama.com/hacks

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0Fgmr4/W0JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfaBYk2jn2F0kH6+hCwQPL0Efrlkxr4q3WuTl8i
DPFZORYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABIFAD9GgXWCCbuqD6clPNj
xvU3icmM9kvLSv5pkyzjIR261O8A/jLrnuC9NkCYduhXXfeuK487MOp99PNr
YrYCpLoXVewE
=kFSf
-----END PGP SIGNATURE-----