Pendle is the first protocol that enables the trading of tokenized future yield on an AMM system. The project aims to give holders of yield-generating assets the opportunity to generate additional yield and to lock in future yield upfront, while offering traders direct exposure to future yield streams, without the need for an underlying collateral.

Further resources regarding the Pendle can be found at pendle.finance

The bug bounty program is focused around its smart contracts and is mostly concerned with the loss of user funds.

Contracts in Scope

Network: Mainnet Ethereum

Network: Arbitrum

Network: Optimism

Network: Binance Smart Chain

Network: Mantle

Additional scope:

All StandardizedYieldToken, PendlePrincipalToken, PendleYieldToken, PendleYieldTokenV2, and PendleMarket contracts of assets listed under the links below are in scope. Note that each asset will have a different SY but the same PT, YT, and Market.

• Ethereum Markets
• Binance Smart Chain Markets
• Arbitrum Markets
• Optimism Markets
• Mantle Markets

Award Levels

Rewards are capped at 10% of economic impact.

• Very Critical: Up to $2,000,000 USD, minimum payout $200,000 USD
• Critical: Up to $1,000,000 USD, minimum payout $100,000 USD
• High: Up to $100,000 USD, minimum payout $20,000 USD
• Medium: Up to $20,000 USD
• Below Medium: To be awarded at the discretion of Pendle Finance

Severity Definitions

For manipulation that can steal/freeze users' funds (excluding unclaimed yield)

For other manipulation

The Pendle team will exercise its discretion, together with the Cantina team, to judge the severity with the aim of awarding fairly to security researchers.

Out of Scope (all repositories)

If an issue is discovered and is not from the files listed as In Scope above, security researchers are encouraged to report the finding. Awards for out of scope issues to be determined at the discretion of Pendle Finance.

The Pendle team will be very flexible in assessing all submissions, with the goal of prioritizing the security of the protocol.

Known Public Issues

Known issues from previous security reviews are considered out of scope.

• pendle-core-v2-public/audits are considered as out-of-scope.

Known but not Public Issues

Are considered out of scope.

Specific Types of Issues

• Informational findings.
• Design choices related to protocol
• Issues that are ultimately user errors and can easily be caught in the frontend. For example, transfers to address(0).
• Rounding errors.
• Relatively high gas consumption.
• Extreme market turmoil vulnerability.

Prohibited Actions

• Live testing on public chains, including public mainnet deployments and public testnet deployments.
  • We recommend testing on local forks, for example using foundry.
• Public disclosure of bugs without the consent of the protocol team.
• Conflict of Interest: any employee or contractor working with Project Entity cannot participate in the Bug Bounty.