The Pennysia deployed Settlement contract on Ethereum (address prefix 0x3aad97e5a91b8e43b7dc830) was identified by security agencies in mid-November 2026 as being involved in an authorization abuse type on-chain attack: the contract itself has a vulnerability for arbitrary external calls, allowing attackers to call the token authorization limits that users previously granted to the contract without needing the users' private keys, enabling them to directly transfer assets remaining in authorization from users' addresses. Users have reported abnormal asset transfers to SlowMist, which subsequently launched an on-chain investigation into the related addresses, transactions, and contract behaviors, confirming that the arbitrary external call of the Settlement contract was exploited by attackers, making the unused but not revoked authorizations by the users an avenue for the perpetrators to repeatedly "withdraw." Currently, public material has not disclosed the specific amount stolen and the number of affected users, but SlowMist has issued a security warning, characterizing the incident as a typical authorization abuse attack, and explicitly reminding all users who have authorized tokens to the Settlement contract to immediately revoke related authorizations to reduce the risk of further asset being transferred out.

SlowMist's Alert to Warning: Restoring the Attack Path On-chain

In mid-November, users began to discover abnormal asset behaviors and traced back the transaction records to a transfer path related to the Pennysia Settlement contract, reporting the "stolen" clues to SlowMist. SlowMist immediately initiated an emergency investigation process, meticulously checking all recent inflows and outflows of the reported addresses, focusing on the interaction history between users and specific contracts. As more reports were incorporated into the analysis, a contract with the address prefix 0x3aad97e5a91b8e43b7dc830 repeatedly appeared in key transactions and was identified by multiple public materials as the central target of this incident.

Based on this, SlowMist continued to backtrack the attack path along the on-chain calling stack, confirming that the attackers exploited the vulnerability for arbitrary external calls present in the Settlement contract to bypass normal business logic, directly calling the token authorization limits that users had previously granted but not used up or revoked, transferring assets from user addresses. Since the authorization itself remained valid, attackers could repeatedly withdraw from these "remaining authorizations" without touching the private keys. After completing the technical review, SlowMist issued a security warning, characterizing the incident as an authorization abuse attack and clearly urging all users who have authorized tokens to the above Settlement contract to revoke related authorizations immediately to cut off this potential long-term risk channel prior to further details being disclosed.

Why the Settlement Contract Became an ATM: Explanation of Arbitrary External Calls

To understand why the Settlement contract transformed into an "ATM," the key lies in its internal capability for "arbitrary external calls." By design, such settlement contracts should interact with certain protocols or token contracts only in limited scenarios; however, in the implementation by Pennysia, the contract was allowed to call external contracts without sufficient restrictions, effectively leaving an almost unguarded side door in the system. As long as attackers accurately constructed the call data, they could have the Settlement contract call any target contract interface for themselves, with the most lethal being the ability to directly trigger the token approvals the user had previously granted to the Settlement, converting those "I allow you to spend my money" authorizations into real token transfers.

This is also why SlowMist emphasized that this incident is not a traditional "private key leak": attackers did not breach the key barrier of user wallets, but instead exploited the authority that the Settlement contract had already mastered to visibly execute token transfers on-chain. The authorization itself was entirely legitimate; it was just erroneously exposed to a contract possessing arbitrary external call capabilities, making the attack path more akin to a "design flaw in permissions" rather than "theft of keys". Compared to common DeFi risks, such as manipulating asset pricing through flash loans and oracle price deviations, or repeatedly withdrawing funds using reentrancy vulnerabilities, this time Pennysia has typified an "authorization abuse" attack: attackers do not need to rewrite market rules; they just need to find that door permitting arbitrary external calls and then cash out users' long-unrevoked authorizations into transferable assets one by one.

Remaining Authorizations as Risk Channels: Which Users are at Risk

In this classified "authorization abuse" attack, the ones truly at direct risk are not all on-chain users but rather a relatively clear group: those who had previously authorized tokens to the Pennysia deployed Settlement contract on Ethereum (address prefix 0x3aad97e5a91b8e43b7dc830) but have not yet revoked the authorizations. SlowMist specifically called this type of users in the security warning, reminding them to promptly revoke the authorizations related to this contract, which itself indicates that the current exposure is mainly concentrated on addresses where "authorization has not been cleared." As long as the authorization still exists on-chain, attackers can continue to call the users' token balances through this permission channel without needing any new interaction with users.

The DeFi Authorization Predicament Reflected by the Pennysia Incident

The recent exploitation of the Pennysia Settlement contract is not merely an isolated incident of "an incidental vulnerability," but a concentrated representation of the typical loss of control in authorization models. In DeFi scenarios, to reduce friction in each interaction, users habitually grant contracts large or even "unlimited" token authorizations. Once these authorizations remain on addresses for an extended period, they quietly accumulate layers of invisible risk exposure on-chain. According to AiCoin data, the Settlement contract identified as the attack target with address prefix 0x3aad97e5a91b8e43b7dc830 has directly arranged user assets through the arbitrary external call vulnerability exploited by attackers based on such historical authorizations, while addresses that have never authorized tokens to this contract remain temporarily in a relatively safe zone during this round of attack paths, which sharpens the exposure of the structural problem of authorization abuse.

In the security agencies' review, the Pennysia Settlement contract has been clearly classified as a case of exploitative authorization abuse risk, continuing with the same attack methodology seen in many past similar incidents: it does not seek to seize private keys but instead leverages control deficiencies to pry open the credits users have already signed. For the project party, core contracts like settlement and routing often hold the operational rights of "maximum limits" for users but are under continuous pressure of both permission design and security audit. If they lack basic designs such as minimum privileges and call range isolation, once vulnerabilities arise in these core contracts, they can convert years of accumulated authorizations into systemic risk. The Pennysia incident again reminds the industry that authorization habits and contract permission designs together constitute the underlying structure of DeFi security; any negligence in either end can evolve into an on-chain security problem that the entire ecosystem must seriously confront.

Signals to Keep an Eye On After This Attack

Following this authorization abuse attack on the Pennysia Settlement contract, it is essential to delineate the boundaries of confirmed information: as of November 13, 2026, public materials have not disclosed the specific amount stolen and the number of victim users; various "loss scales" circulating on social platforms lack multiple-source verification and can only be regarded as unverified rumors, thus not forming larger risk conclusions. What has been confirmed is that attackers exploited the vulnerability for arbitrary external calls in the Settlement contract with the prefix 0x3aad97e5a91b8e43b7dc830 on Ethereum, utilizing users' previously granted but unrevoked token authorizations to complete asset transfers. Therefore, SlowMist has issued a security warning, clearly advising all users who have authorized tokens to this contract to revoke the authorizations to prevent residual authorizations from continuing to serve as withdrawal points. The signals worth keeping an eye on next are whether more theft reports related to this contract will emerge on-chain and whether the project party will publicly disclose a more detailed technical review and take measures such as contract upgrades or suspension (currently both are pending verification); these movements will determine whether the risk can be effectively blocked. For ordinary users, the most direct practical reminder from this incident is to elevate "authorization management" to a long-term habit: regularly checking their token authorizations on various contracts, reducing excess authorization limits with high-risk or non-used contracts over time, and promptly revoking unnecessary authorizations after completing interactions, turning remaining authorizations back from a potential systemic risk channel to a controllable, auditable personal security boundary.

Join our community to discuss and become stronger together!
Exclusive Hyperliquid Benefit for AiCoin: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive Aster Benefit for AiCoin: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram Community: https://t.me/AiCoinWhaleData
On-chain Community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin On-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。