SlowMist Alert: Pennysia Ethereum Settlement Contract Under
On November 13, 2026, SlowMist issued a security alert stating that the Settlement contract deployed by Pennysia on Ethereum had been attacked. The attacker exploited an arbitrary external call vulnerability to transfer tokens that users had previously authorized but not yet used, and reminded all relevant users to revoke authorization immediately.
Event Timeline
- [11-13 07:00] SlowMist: Pennysia Ethereum Settlement contract attacked; users' residual authorized funds at risk (Odaily Planet Daily)
- [11-13 07:01] SlowMist: Pennysia Ethereum Settlement contract attacked; users' residual authorized funds at risk (PANews)
Background and Impact
On November 13, 2026, SlowMist issued a security alert. According to reports by Odaily Planet Daily at 07:00 and PANews at 07:01, SlowMist launched an investigation after receiving reports of stolen user funds and determined that the Settlement contract deployed by @PennysiaLabs on Ethereum had been attacked. The core facts in the two reports are consistent: the attacker exploited an arbitrary external call vulnerability in the contract to transfer tokens that users had previously authorized but not yet used. The two outlets published about one minute apart, with the same headline and conclusion.
The direct risk point of this incident is "residual authorization." When users interact with contracts, they typically pre-set token authorization limits; the unused portion remains on-chain after actual use. Once the contract itself has call logic that can be exploited, this portion of the allowance becomes a target. SlowMist characterized the vulnerability as "arbitrary external call" and defined the affected parties as "all users who have ever authorized tokens to this Settlement contract." It should be noted that neither report disclosed the specific loss amount, the number of affected addresses, or the attack transaction hash, nor did they state whether Pennysia has paused the contract or responded. Regarding the subject description, Odaily wrote "deployed by @PennysiaLabs," while PANews wrote "deployed by Pennysia"; both refer to the same entity, differing only in detail.
From a handling perspective, SlowMist's recommendation is clear and singular: users who have ever authorized tokens to this Settlement contract should immediately revoke authorization. Because the revocation action does not depend on whether the attacker continues to act, the urgency of this reminder is directly related to the emergence of theft reports. For users who need to check asset or authorization status, common entry points include Zhima Gate.io registration APP download, Bitget registration APP download, Binance registration APP download, OKX registration APP download, HTX registration APP download, and other channels; regardless of which platform is used to check, whether the revocation takes effect should be based on the on-chain authorization record.
At present, the confirmable timeline remains at the alert stage: SlowMist issued the notice on November 13, the two media outlets relayed it in sync, and no further public information on attack details or follow-up progress has been seen. Based on the disclosed information, the vulnerability is located in the contract's call link, and the affected scope is defined as all users with residual authorization allowances; before Pennysia or SlowMist publishes a more complete range of affected addresses and loss data, judgment of the incident's scale still lacks a basis, and subsequent developments await supplementary explanation from relevant parties.
FAQ
### Which users need to revoke authorization immediately?
According to SlowMist's reminder, the scope is "all users who have ever authorized tokens to this Settlement contract," meaning anyone who has ever authorized tokens to this contract deployed by Pennysia on Ethereum, whether or not they actually used them, should immediately revoke authorization.
### Have the stolen amount and number of affected addresses been published?
No. Reports by Odaily Planet Daily and PANews only mentioned that the attacker exploited an arbitrary external call vulnerability to transfer tokens users had previously authorized but not yet used; they did not disclose the loss amount, number of affected addresses, or attack transaction hash.
### What nodes are worth watching going forward?
Watch whether SlowMist updates details of the alert, whether Pennysia explains the contract's current status and handling plan, and whether the range of affected authorization addresses and further loss statistics are published.