On November 13, SlowMist issued a security alert: the Ethereum settlement contract for a project called Pennysia had been exploited. A vulnerability allowing arbitrary external calls in the contract code let the attacker bypass the normal process and directly transfer out tokens that users had previously approved for the contract but had not yet used.
SlowMist began investigating after receiving several reports from users who had lost funds. The total amount lost has yet to be determined, and Pennysia has not presented a compensation plan. So this isn’t a postmortem—it’s a warning about the approval that may still be sitting in your wallet.
A lot of people get caught out this way: At some point, you approved a project, and the default was unlimited access. To save time, you approved it all at once. Later, you stopped using the project and forgot about the approval. The money was long gone from that project, so you thought it was all behind you. But the approval was still active. If the contract gets compromised, an attacker can use that old approval to drain the same type of tokens from your wallet. And here’s the really bad part: even if you don’t have those tokens in your wallet right now, an attacker can still drain them if you transfer some in later—the old approval is still active.
SlowMist’s exact advice was: Anyone who has approved this settlement contract should revoke that approval immediately. The tools are readily available—you can check and revoke approvals on Revoke.cash or Etherscan.
Three things you can do tonight. First, open Revoke.cash, connect your wallet, and revoke the approval for the Pennysia settlement contract. Even if you’ve never used Pennysia, take a moment to check for any unfamiliar contracts with unlimited approval. Second, don’t take shortcuts when approving things in the future: set a limit whenever you can, revoke it when you’re done, and don’t leave it active overnight. Third, whenever a page asks you to approve something, check who you’re approving and how much before you click. If the domain is wrong or the page looks suspicious, close it immediately.
An approval takes one second to grant, but it stays in your wallet indefinitely. What got stolen today wasn’t anyone’s cash on hand—it was an old approval everyone had long since forgotten about.
When was the last time you cleaned up your wallet approvals?
— Web3 retail investor Xiaokai
This content reflects personal opinions only and does not constitute investment advice. Please make your own judgment.