SlowMist Warns Pennysia's Ethereum Settlement Contract Was Exploited

Blockchain security firm SlowMist warned on November 13 that Pennysia's Settlement contract on Ethereum had been exploited, and it urged every user who has ever approved tokens for that contract to revoke those permissions immediately.

The warning followed reports of stolen user funds and an investigation by SlowMist. The exposure is specific: tokens that users had approved for the Settlement contract but had not yet used remain at risk, because the attacker moved exactly those assets.

What was the technical flaw?

SlowMist identified a vulnerability that allowed arbitrary external calls from the contract. In practical terms, the contract could invoke external code without adequate restriction.

The attacker used this capability to transfer tokens covered by standing user approvals. On Ethereum, a token approval — executed through the standard ERC-20 approve mechanism — grants a contract permission to move tokens on a user's behalf, up to the approved amount, at any time until the approval is revoked or spent. The exploit weaponized that permission rather than breaking the token contracts themselves.

This distinction matters for practitioners. The token standard functioned as designed. The failure sat in the settlement contract's call surface, which failed to constrain where outbound calls could be directed. Any ERC-20 holding for which Pennysia's Settlement contract held an unspent allowance was, in principle, movable by whoever controlled the exploit path.

Who is exposed?

SlowMist's alert draws the perimeter precisely. The recommendation applies specifically to approvals granted to Pennysia's Settlement contract, and the risk is tied to previously authorized tokens left unused.

Users fall into two categories:

• Approved and unused: tokens still covered by an active allowance to the Settlement contract. These are the assets SlowMist identifies as at risk, and the ones the attacker moved.
• No approval, or approval fully spent and revoked: users in this group fall outside the specific exposure described in the warning.

SlowMist urged all users who had ever approved tokens for the contract to revoke those permissions immediately. For anyone holding an old allowance, the practical step is a revocation through a token-approval tool or a direct on-chain transaction setting the allowance to zero. An approval that sits unused is not a dormant convenience; under this exploit pattern, it is standing attack surface.

What does this change for users and protocols?

For users, the change is procedural. Checking approval history on Ethereum — a routine step most wallets and block explorers now support — becomes the first action after any incident of this type. In this case, the relevant filter is narrow: only allowances pointing at Pennysia's Settlement contract matter.

For protocol teams, the incident is another data point on an established failure mode. Unrestricted external-call capability inside a settlement or routing contract converts every user approval the contract holds into a transferable balance for an attacker. The mitigations are known: whitelisting call targets, limiting call contexts, and treating allowance custody as a privileged function. Each reduces the blast radius of a single contract-level flaw from "every approval the contract holds" to a bounded, auditable set.

The exploit also illustrates the structural asymmetry of the approval model. A user's decision to approve is instantaneous; the risk it creates persists indefinitely. Incidents like this one shift the burden onto users to audit their own standing permissions, because the chain will faithfully execute an old approval for as long as it exists.

What happens next?

SlowMist framed its alert as an active warning rather than a post-mortem, which signals the exposure window is still open for anyone who has not yet revoked. Users with approvals to Pennysia's Settlement contract should treat revocation as immediate, not scheduled — the attacker demonstrated the capability, and unused allowances remain movable until they are cleared.