慢雾 Warns of Exploit in Pennysia’s Ethereum Settlement Contract

慢雾 warned Nov. 13 that Pennysia’s Settlement contract on Ethereum had been exploited, putting tokens users had approved for the contract but not yet used at risk. The warning followed reports of stolen user funds and an investigation by 慢雾.

The security firm identified a flaw that allowed arbitrary external calls from the contract. The flaw let the contract make calls to external code, which the attacker used to move tokens covered by user approvals.

慢雾 said the attacker transferred tokens users had previously approved for the Settlement contract but had not yet used. A token approval gives a contract permission to move tokens on a user’s behalf. The alert focuses on assets still covered by that permission.

慢雾 urged all users who had ever approved tokens for the contract to revoke those permissions immediately. The recommendation applies specifically to approvals for Pennysia’s Settlement contract, because the warning ties the risk to previously authorized tokens left unused.