Pennysia Settlement Contract Exploited, Unused Token Approvals at Risk

Blockchain security firm SlowMist has confirmed an attack on Pennysia's Settlement contract on Ethereum, warning that an attacker exploited an arbitrary external-call vulnerability to move tokens users had approved but never spent. Users who granted approvals to the contract remain exposed until they revoke them.

SlowMist opened its investigation after receiving reports of stolen user funds. The probe traced the losses to the Settlement contract deployed by Pennysia Labs, where the vulnerability gave the attacker a way to pull tokens that users had already authorized.

How did the attacker move tokens the victim never sent?

The mechanics matter here. On Ethereum, a token approval under the ERC-20 standard lets a smart contract spend up to a set amount of a user's tokens. The approval sits in place until the user revokes it or the contract uses it. Most users approve once, transact, and forget the permission exists.

That forgetfulness is the attack surface. SlowMist found the attacker exploited an arbitrary external-call flaw in the Settlement contract — a defect that let the contract be steered into calling out to other contracts in ways its developers never intended. With that primitive, the attacker could invoke token transfers against approvals that users had granted but had not yet consumed.

The victims did nothing wrong at the moment of theft. Their loss was pre-authorized, sometimes long before the exploit. What does this change for ordinary Pennysia users? It converts a forgotten permission into an open liability, and the only fix is a manual one.

Who needs to act right now?

SlowMist's warning is specific and narrow. It applies to anyone who has ever approved tokens for Pennysia's Settlement contract on Ethereum — not to approvals for other Pennysia contracts, and not to users who never interacted with the Settlement contract at all.

The firm's instruction is blunt: revoke those approvals immediately. Every hour an approval stays live is an hour the attacker could sweep the remaining allowance. Users can revoke approvals through token-approval tools or directly through their wallets, and doing so costs only gas.

The practical checklist for affected users:

• Check every wallet address that interacted with Pennysia's Settlement contract on Ethereum.
• Identify outstanding token approvals granted to that contract.
• Revoke each approval in full, then verify the revocation on-chain.
• Watch for follow-up statements from SlowMist or Pennysia Labs on additional affected contracts.

SlowMist did not state a total value for the stolen funds, name the attacker's address, or say whether Pennysia Labs has paused the contract. Its advisory centers on the residual risk: the permissions that could still let the compromised contract move tokens today.

Why unused approvals keep biting

This incident joins a well-worn pattern in decentralized finance. Exploits rarely need to break the token itself. They break a contract holding live permissions, then harvest whatever allowances users left behind. The damage is bounded not by what victims hold, but by what they once authorized.

SlowMist's framing underscores the point. Reports of stolen funds triggered the investigation, and the resulting warning targets permissions rather than a single theft event — the exploit is best understood as an ongoing drain on any approval still standing.

For Pennysia Labs, the operational consequences extend past the immediate losses. The project now faces questions about its contract audit history, whether the flawed Settlement contract can be paused or replaced, and how it will compensate or notify affected users.

Until Pennysia publishes a contract fix or a formal incident report, the effective deadline sits with users themselves: every lingering approval remains spendable by the attacker, and revocation is the only protection available on the user side.