# 慢雾 Warns of Exploit in Pennysia’s Ethereum Settlement Contract

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/56424
Published: 2026-11-13T07:05:55.000Z
Updated: 2026-11-13T07:05:55.000Z
Section: Technology

> The warning says a contract flaw let an attacker move tokens users had approved but not yet used.

慢雾 warned Nov. 13 that Pennysia’s Settlement contract on Ethereum had been exploited, putting tokens users had approved for the contract but not yet used at risk. The warning followed reports of stolen user funds and an investigation by 慢雾.

The security firm identified a flaw that allowed arbitrary external calls from the contract. The flaw let the contract make calls to external code, which the attacker used to move tokens covered by user approvals.

慢雾 said the attacker transferred tokens users had previously approved for the Settlement contract but had not yet used. A token approval gives a contract permission to move tokens on a user’s behalf. The alert focuses on assets still covered by that permission.

慢雾 urged all users who had ever approved tokens for the contract to revoke those permissions immediately. The recommendation applies specifically to approvals for Pennysia’s Settlement contract, because the warning ties the risk to previously authorized tokens left unused.