Dear Penpie Community,
On September 3, 2024, Penpie experienced a sophisticated attack, resulting in the theft of 11,113.6 ETH, valued at approximately $27.3 million, from users across the Ethereum and Arbitrum networks. The attacker exploited a vulnerability within the PendleStakingBaseUpg::batchHarvestMarketRewards() function, using a malicious SY contract to repeatedly harvest market rewards, draining a significant portion of the platform’s assets.
Immediate Mitigation Steps
In collaboration with Pendle Finance, external security experts, and law enforcement, we have taken immediate steps to mitigate further damage:
- Paused all contracts on Penpie and Pendle to prevent additional malicious activity.
- Secured approximately $70 million that could have been at risk of being drained.
- Initiated investigations and collaboration with law enforcement and security partners to track the stolen funds and identify the attacker.
Despite these efforts, we understand that the incident has caused significant loss and disruption to our users. You can read the detailed Post Mortem for a full breakdown of the hack and our mitigation steps. We are committed to addressing this situation responsibly and ensuring that the community is involved in the resolution process.
Penpie and Magpie Financial Overview
To provide a clearer picture of both Penpie and Magpie’s financial standing and their impact on the current situation, we are sharing the following detailed information:
Penpie Financials
- Initial IDO Raised Funds: +$600,000 (raised through Penpie IDO on Camelot)
- Seed Liquidity Allocation: -$240,000 (allocated for PNP liquidity on DEX)
- Audit Expenses: -$112,900 (allocated for audits conducted by AstraSec, WatchPug, and Zokyo)
- Penpie Re-Audit Cost: -$140,000 (allocated for a re-audit currently being conducted by BlockSec, PeckShield, AstraSec, Zokyo, SlowMist and Hacken)
- Security Collaboration: -$112,500 (allocated for collaboration with security firms to track and freeze stolen funds. Based on cost projections from similar past cases.)
- Operational Expenses: -$375,000 (allocated for employee salaries, marketing, and business development over a 15-month period.)
- Penpie Treasury Balance: -$380,400 (Penpie cannot be fully sustained by the funds raised from the IDO, and the current deficit is being covered by the Magpie Treasury.)
Magpie Financials
- Strategic Sale Raised Funds: +$1,000,000 (raised through strategic round)
- IFO Raised Funds: +$1,750,000 (raised through the IFO on PancakeSwap)
- Audit Expenses: -$313,600 (allocated for audits conducted by PeckShield, Zokyo, AstraSec, BlockSec, and Supremacy for Magpie and its SubDAOs that have not yet held their TGE, including Eigenpie, Babypie, Campie, Listapie, and Sympie.)
- Operational Expenses: -$690,000 (Funds allocated for Magpie employee salaries, marketing, and business development over a 23-month period.)
- Operational Expenses from SubDAO: -$950,000 (allocated for employee salaries, marketing, and business development over a 12-month period for SubDAOs that have not yet held their TGE, including Eigenpie, Babypie, Campie, Listapie, and Sympie.)
- Penpie Extra Expenses: -$380,400 (to cover the Penpie Treasury deficit)
- Magpie Treasury Balance: $416,000 (operational funds left in Magpie Treasury)
To further clarify the financial health and ongoing operations of both Magpie and Penpie, we have summarized the key data points, including bribes and emissions:
Magpie and Penpie Revenue Overview
- vlMGP SubDAO Rewards: $208,690 /month (past 3-month average)
- SubDAO Treasury Allocation ( vested over 2 years)
- Penpie 20%
- Radpie 20%
- Cakepie 15%
- Campie 20%
- Eigenpie 15%
- Babypie 20%
- Listapie 20%
- Sympie 20%
Penpie
- Pendle Emission Revenue: +52,260 PENDLE /month (past 3-month average)
- PENDLE emission to mPENDLE pool: 28,505 PENDLE
- PENDLE emission to Treasury: 11,877 PENDLE
- PENDLE emission to vlPNP: 11,877 PENDLE
- vlPNP Bribes: +$88,519.33 /month (past 3-month average)
- vePendle Rewards: +193 ETH /month (past 3-month average)
- vePENDLE base rewards: 82 ETH
- vePENDLE voter rewards: 111 ETH
- Treasury Holdings: as of September 12th
- 32,492 PENDLE
- 295,528 PNP (via buyback)
- 71.5 WETH
- 67,758 mPENDLE
- 23,313 ARB
- 16,281 CAKE
- $626,349 mPENDLE/PENDLE LP on PancakeSwap
- $110,374 mPENDLE LP on Penpie
For further details on Magpie and Penpie’s revenue, including more information on protocol fees, bribes, and emissions, we invite you to explore the Revenue Dashboard as well as the Penpie Treasury Wallet address.
Buyback Program Overview
Here is a brief overview of our ongoing buyback program, which was approved by the community vote on June 10, 2024. This program plays a key role in supporting the stability and growth of the Penpie ecosystem:
- 100% of vePENDLE base rewards are allocated to buying back PNP, which is added to the Treasury, strengthening the protocol’s asset reserves.
- 50% of vePENDLE voter rewards are used to buy back PENDLE and supply it as liquidity for the mPENDLE/PENDLE pair. This ensures the peg between mPENDLE and PENDLE remains stable while also building protocol-owned liquidity.
- 20% of PENDLE emissions to the mPENDLE liquidity pool are used to buy back and burn mPENDLE, reducing its circulating supply.
- Total Buybacks Stats:
- 295,528 PNP
- $626,349 mPENDLE/PENDLE liquidity
- 156,762 mPENDLE burnt
Community Involvement: Compensation Suggestions
We are reaching out to you, our valued users, to gather your suggestions on how compensation should be handled. Your input will be invaluable in helping us design a compensation plan that is fair and effective.
Here’s how you can participate:
- Submit your ideas on compensation strategies by commenting on the Governance Forum under this thread.
Guidelines for Suggestions:
- Propose feasible and community-driven solutions.
- Be clear and detailed in your proposals, explaining how your suggested solution addresses fairness and the scale of losses.
- You may post your suggestions in English, Chinese, or Spanish.
Deadline for Submissions
Important: Please submit your suggestions by [SEPTEMBER 21st] to ensure your participation in shaping the compensation plan.
After this deadline, the Team will draft a compensation plan and post it in the official forum for community feedback and discussion. Once finalized, the plan will be submitted to Snapshot for a governance vote.
We deeply appreciate your engagement, trust, and ongoing support during this challenging time. Our team remains fully committed to finding the best solution possible.
Thank you for being an essential part of the Penpie community.
— The Penpie Team