Protocol: Pendle Finance

Version Assessed: As of June 2025

1. Summary of Protocol Functionality

Pendle enables users to tokenize future yield and trade it separately from the principal. This is achieved by splitting yield-bearing tokens (YBTs) into:

• Principal Token (PT) — representing the underlying principal
• Yield Token (YT) — representing the right to future yield until maturity

Users can provide liquidity, use the system for fixed yield, leveraged yield, or long/short yield strategies.

2. Risk Categories

A. Smart Contract Risk

Assessment: Moderate

• Pendle is a smart contract-based protocol with complex logic for yield accrual, redemption, and AMM mechanisms.
• It has undergone multiple audits (Ackee, Dedaub, Dingbats, and some of the top wardens from Code4rena), but complexity always introduces non-zero risk.
• Pendle integrates with external protocols (Aave, Lido, Rocket Pool, etc.) to access YBTs, increasing composability risk.
• Mitigation: Audits, bug bounty programs, time-locked governance changes, and modular upgrades.

Key Concern: Exploits via integration with upstream protocols or AMM math vulnerabilities.

B. Oracle Risk