Pendle (yield tokenisation)

Summary

Ketju does not approve Pendle V2 principal tokens (PT), yield tokens (YT) or LP positions: each market adds Pendle’s contracts on top of another protocol’s token, so every market carries its own risks and needs constant specialist monitoring. We judged each use separately. Pendle’s core contracts are audited, and we found no defect in them. Pendle is a permissionless derivatives layer. It wraps another protocol’s yield-bearing token as SY, splits it into principal (PT) and future yield (YT), and trades both through PT/SY pools for each maturity. A PT buyer buys a discounted claim on a named accounting asset at a named maturity and keeps the underlying protocol, wrapper, oracle, liquidity and asset risks. A YT buyer takes leveraged exposure to future yield and points, and the token falls to zero at expiry. An LP holds both sides plus fee, incentive and curve risk. Pendle V2 settled $3.8B of positions at its June 2024 maturity. In the 2024 Penpie exploit, a malicious permissionless SY harmed a protocol built on Pendle even though nobody breached Pendle’s core contracts.

Review triggers
• Ketju will review Pendle again only for one named PT, YT or LP market and maturity; no approval carries across PT, YT and LP or to future markets
• The exact accounting asset, SY adapter, underlying protocol, bridge, oracle, owner, admin, guardian, timelock and deployed code all map to current primary sources and audits
• For PT, the proposed-size redemption at maturity is executable and a sale before maturity costs under 50 basis points after a 200-basis-point implied-yield shock
• For YT, return stays positive after assigning zero value to points and after a 50% decline in realized underlying yield
• For LP, the proposed-size withdrawal costs under 50 basis points and the return stays acceptable with incentives removed and the implied-yield curve moved outside its trailing-30-day range

Ketju checks this memo every night and opens a review if its venues or files show a warning or a cited document changes. The first confirmation is due 2026-10-30.

Research

How it works

Pendle starts with Standardized Yield (SY), a wrapper around an external yield-bearing token such as stETH or aUSDC. Depositing SY mints equal amounts of Principal Token and Yield Token for a given expiry. PT works like a zero-coupon bond. It gives up variable yield and points, trades below the accounting asset, and redeems one-for-one for that accounting asset at maturity. The asset in parentheses in each market name matters. A PT may settle to ETH, USDC, stETH or another token, so “fixed yield” means a fixed USD principal only when the accounting asset is itself a sound dollar claim.

YT receives the underlying yield and points until maturity and then becomes worth zero. It costs only the present value of the future yield, yet it receives the yield of one whole underlying unit, so it is leveraged exposure to realized yield. A YT holder profits only if the yield finally collected exceeds the implied APY paid. Points add another payoff that nobody prices and that the issuer often sets at its discretion.

Pendle’s AMM holds PT against SY and uses flash swaps to build YT trades. Its curve concentrates liquidity in a range of implied yields and narrows toward maturity. Fees are charged on the yield traded and vary with time to expiry. An LP earns underlying yield, PT fixed yield, swap fees and PENDLE incentives, so a single ”LP” label hides how many sources of return one position can hold.

Who controls it

Anyone can create a market on-chain, while the official Pendle interface chooses which markets it displays. That distinction matters. A contract can be a real Pendle market created by the factory without Pendle having endorsed its underlying asset or SY adapter. Pendle’s documentation says most newer SYs are upgradeable proxies, so control must be checked market by market. That means the SY owner, the proxy admin, the adapter, the supply cap, the underlying protocol and any bridge. PT and YT inherit all of those outside controls even when the Pendle market contract itself does not change.

Aave’s governance review of Pendle PT as collateral found no timelock in the architecture it examined. It found an admin assigned to a 2-of-4 Safe and a guardian EOA. The admin and the guardian could pause trading in the PT, YT and SY that Aave assessed, and only the admin could upgrade the governance proxy at once. That review was careful collateral diligence. It does not hold for every new market, which is why the roles must be checked live. PENDLE token governance directs incentives and protocol economics. Token voting does not replace privileged contract roles or the governance of each underlying asset.

Losses and incidents

Pendle says six auditors have audited its V2 contracts. Its security page names Ackee, Dedaub, Dingbats and Code4rena wardens and links the reports in the public core repository. No source we read reports a successful exploit of Pendle V2 core. Pendle’s 2024 recap reports that the 2024-06-26 maturity settled $3.8B of positions over several days, which shows that large scheduled settlements can complete. Audits and maturity history reduce uncertainty about the core contracts and operations. Neither validates a new SY or its underlying protocol.

On 2024-09-03 Penpie, a separate yield optimizer built on Pendle, lost about $27M. Penpie had accepted a malicious SY and market that the attacker created, and the attacker used a reentrancy flaw in Penpie’s reward harvesting. The Pendle contracts allowed permissionless market creation, as designed, and Pendle did not hold the stolen funds. Aave’s review says Pendle detected the suspicious activity, paused contracts and helped protect about $105M. Pendle responded well, and its core was not exploited. The event shows directly that creation by the Pendle factory says where a market came from and says nothing about the asset’s quality. Protocols built on Pendle can confuse the two.

Withdrawals

At maturity, a holder can redeem PT one-for-one for its stated accounting asset. YT has no principal left, though the holder can still claim yield earned earlier. A matured LP can close out in one routed transaction that withdraws, redeems PT, unwraps SY and claims rewards. These contract functions do not guarantee that the accounting asset itself stays redeemable at par. If the underlying lending market freezes, an LST depegs, an RWA gates withdrawals or an SY proxy fails, maturity cannot turn bad collateral into good.

Before maturity, a holder can sell PT and YT only against available pool or limit-order liquidity. Pendle offers a router that converts PT, YT and LP balances into SY before expiry, subject to a minimum output the user sets, at the price of the current implied-yield curve. Selling PT early locks in any rate move. Selling YT early locks in both rate expectations and time decay. Thin liquidity outside a pool’s expected yield range can turn a quoted price into a poor sale price. An adviser must therefore measure whether a position of the proposed size can be sold in the exact market and maturity, and never at the level of all of Pendle.

Comparison

A client who supplies USDC to Aave or Compound holds a variable-rate position in one lending market and can withdraw at will. Buying PT-aUSDC can lock a market-implied return to maturity. It adds Pendle contracts and SY mechanics on top of the same Aave exposure, and it gives up withdrawal at par at will. A Treasury bill is a fixed legal claim on the issuer. A PT is a token claim on another token, and that token can be anything from an LST to a synthetic dollar or a tokenized credit fund. A similar cash-flow shape does not make the credit the same.

YT is closer to an expiring option on yield than to a savings product. An LP position is a market-making strategy that incentives partly pay for. A manager with a rate view, analytics for each position and a book of maturities can use these instruments sensibly. They do not improve a conservative client allocation because an interface converts the discount into a “fixed APY” figure. The fair benchmark is the simpler underlying position after fees and the added ways to fail, and not the highest Pendle rate on display.

Open questions

A new review must cover one market at a time. For each candidate it should identify the accounting asset and every protocol, wrapper, bridge, oracle and upgradeable proxy beneath it. It should record the current owner, admin and guardian addresses and timelocks, and the redemption route at and after maturity. It should measure the depth for a sale after a stressed move in implied yield, the share of return paid in incentives, and whether points are being presented as yield.

The review should also compare the markets Pendle shows in its official interface with those the permissionless factory creates, and document what review Pendle applies before it shows a market. The verdict for Pendle as a whole can change only if the client product is narrowed to a repeatable class of PTs, explained in plain English, with independently verified underlying risk and reliable sales before maturity. Pendle as a name covers many different risks.

Sources

Each claim above comes from one of these sources. Where Ketju could not verify a number, the memo states that.

• Pendle documentation introduction · primary · accessed 2026-08-15
  Supports: protocol scope, yield tokenization, market-specific products
• Pendle Standardized Yield documentation · primary · accessed 2026-08-15
  Supports: SY wrapper, underlying protocol dependency, adapter boundary
• Pendle Principal Token documentation · primary · accessed 2026-08-15
  Supports: PT principal claim, maturity redemption, accounting asset
• Pendle Yield Token documentation · primary · accessed 2026-08-15
  Supports: YT yield entitlement, expiry value, leveraged yield exposure
• Pendle V2 AMM documentation · primary · accessed 2026-08-15
  Supports: PT-SY AMM, implied-yield curve, LP return components
• Pendle security and audits · primary · accessed 2026-08-15
  Supports: security program, named reviewers, core audit record
• Pendle Core V2 audit repository · primary · accessed 2026-08-15
  Supports: audit reports, core-contract scope, review dates
• Pendle 2024 maturity record · primary · accessed 2026-08-15
  Supports: June 2024 maturity volume, issuer-reported settlement record
• Aave governance review of Pendle PT · primary · accessed 2026-08-15
  Supports: reviewed PT control roles, pause and upgrade powers, collateral scope
• Zokyo Penpie exploit analysis · secondary · accessed 2026-08-15
  Supports: Penpie reentrancy, malicious SY integration, Pendle core boundary
• Pendle router exit functions · primary · accessed 2026-08-15
  Supports: pre-expiry exit, post-expiry redemption, minimum-output protection

The asset and the chain

This memo covers the protocol. A position also holds an asset and settles on a chain. Whichever of the three holds the most power over the position decides who can freeze it. These tables describe control and do not judge quality.