# Pennysia Settlement Contract Attack Puts Lingering Token Approvals at Risk

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/56426
Published: 2026-11-13T07:06:41.000Z
Updated: 2026-11-13T07:06:41.000Z
Section: Technology

> SlowMist said an arbitrary external-call flaw let an attacker move tokens users had approved but not yet used.

Pennysia users with token approvals still active for the project’s Ethereum Settlement contract face a risk after an attacker exploited a contract vulnerability to transfer previously approved tokens, SlowMist warned.

SlowMist said it began investigating after receiving reports of user funds being stolen. Its investigation found that the Settlement contract deployed on Ethereum by @PennysiaLabs had been attacked. The attacker exploited an arbitrary external-call vulnerability to move tokens users had approved for the contract but had not yet used.

The warning applies to people who granted token permissions to that specific contract. SlowMist urged all users who had ever approved tokens for the Settlement contract to revoke those approvals immediately.

The incident highlights the risk to assets that remain covered by unused approvals after a contract is compromised. Reports of stolen funds prompted the investigation, and SlowMist’s warning focuses on permissions that could still let the contract move tokens.