🚨According to Beosin Alert, Penpie, a DeFi protocol built on Pendle, was hacked and about $27 million in crypto assets were stolen! 💸

The attacker re-entered the staking through the claimRewards function in the market contract, cleverly increased the balance of the staking contract, and then extracted the excess tokens and staked assets for profit. The specific steps are as follows:

1. Create an attack contract and build a market contract;

2. Call the batchHarvestMarketRewards function of the staking contract to update the reward;

3. Use the re-entry attack to extract excess assets;

4. Return the flash loan and make a profit.

What do you think of this attack? Welcome to discuss in the comment area!