Security Alert: Pennysia Ethereum Settlement Contract Exploited, Authorized Users Must Revoke Immediately

BlockBeats news, November 13 - SlowMist issued a security alert stating that after investigating reports of user fund theft, it found that the Settlement contract deployed by the Pennysia protocol on Ethereum was attacked due to an arbitrary external call vulnerability, allowing attackers to exploit residual token allowances from users to transfer funds.

SlowMist reminds users who have ever authorized tokens to this Settlement contract to revoke authorization immediately. The contract address is 0x3aad97e5a91b8e43b7dc830aceb004307678795e. The attacker's address is 0x813a5ab666adeba907548235fbac087642878300. On-chain data shows that the relevant attack transaction occurred at 21:59 on November 12, during which the attacker transferred out 5,006.133489 USDC, 0.05 wstETH, and 101,000 YUNO.