Pendle (yield tokenisation)

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED for this client across three separately analyzed uses—PT, YT and LP—not because those legs are one uniform LP exposure or because Pendle core lacks quality. Pendle is an audited, permissionless second-order derivatives layer: it wraps another protocol’s yield-bearing token as SY, splits it into principal (PT) and future yield (YT), and trades both through maturity-specific PT/SY pools. A PT buyer is not simply earning a fixed dollar rate; they are buying a discounted claim on a named accounting asset at a named maturity while retaining the underlying protocol, wrapper, oracle, liquidity, and asset risks. A YT buyer is making leveraged exposure to future realized yield and points, with the token decaying to zero at expiry. An LP owns both sides plus fee, incentive, and curve risk. Pendle V2 has a strong core record and processed $3.8B of matured positions in its June 2024 maturity event, but the 2024 Penpie exploit shows how a malicious permissionless SY can harm an integration even when Pendle core is not breached. Every market must therefore be underwritten separately. That is serious infrastructure for professional rate trading, but an unsuitable recommendation for a client mandate that requires the position, risk, and exit to remain legible without continuous specialist monitoring.

Kill criteria: the events that revoke this verdict
• Reopen only for one named PT, YT or LP market and maturity; no approval inherits across product legs or future markets
• The exact accounting asset, SY adapter, underlying protocol, bridge, oracle, owner, admin, guardian, timelock and deployed code all map to current primary records and audits
• For PT, the proposed-size maturity redemption is executable and the pre-maturity exit remains below 50 basis points under a 200-basis-point implied-yield shock
• For YT, return remains positive after assigning zero value to points and after a 50% decline in realized underlying yield
• For LP, the proposed-size withdrawal remains below 50 basis points and the return remains acceptable with incentives removed and the implied-yield curve moved outside its trailing-30-day range

The research file

The mechanism

Pendle starts with Standardized Yield (SY), a wrapper interface around an external yield-bearing token such as stETH or aUSDC. Depositing SY mints equal amounts of Principal Token and Yield Token for a particular expiry. PT is the zero-coupon leg: it forgoes variable yield and points, trades below the accounting asset, and becomes redeemable one-for-one for that accounting asset at maturity. The parenthetical asset in each market name matters—a PT may settle to ETH, USDC, stETH, or another token, so “fixed yield” does not mean fixed USD principal unless the accounting asset itself is a sound dollar claim.

YT receives the underlying yield and points until maturity, then becomes worth zero. Because it costs only the present value of the future-yield leg while receiving the yield of one whole underlying unit, it is leveraged exposure to realized yield. Profit depends on yield ultimately collected exceeding the implied APY paid; points add another unpriced and often discretionary payoff. Pendle’s AMM holds PT against SY and uses flash swaps to synthesize YT trades. Its curve concentrates liquidity in an implied-yield range and tightens toward maturity; fees are charged against yield traded and vary with time to expiry. An LP earns underlying yield, PT fixed yield, swap fees, and PENDLE incentives, so the registry’s LP label understates how many return components a position can contain.

Who controls it

Market creation is permissionless on-chain, while the official Pendle interface curates which markets it displays. That separation is crucial: a contract can be a genuine factory-created Pendle market without Pendle having endorsed its underlying asset or SY adapter. Most newer SYs are upgradeable proxies according to Pendle’s own documentation, so control must be checked market by market: SY owner, proxy admin, adapter, supply cap, underlying protocol, and any bridge. PT and YT inherit all of those external controls even when the Pendle market contract itself is unchanged.

Aave’s governance diligence on Pendle PT collateral found no timelock in the reviewed architecture, an admin assigned to a 2-of-4 Safe, and a guardian EOA; the admin and guardian could pause assessed PT/YT/SY trading, while only the admin could immediately upgrade the governance proxy. This is authoritative collateral-onboarding diligence, not a timeless guarantee for every new market, and is exactly why the open question is live role verification. PENDLE token governance directs incentives and protocol economics, but token voting does not replace privileged contract roles or the governance of every underlying asset.

The record

Pendle says its V2 contracts have been audited by six auditors; its security page names Ackee, Dedaub, Dingbats, and Code4rena wardens and links the reports in the public core repository. No reviewed source identifies a successful exploit of Pendle V2 core. The protocol’s own 2024 recap reports that the 2024-06-26 maturity processed $3.8B of positions over several days, useful evidence that large scheduled settlements can complete. Audits and maturity history reduce core-contract and operational uncertainty; neither validates a new SY or its underlying protocol.

The boundary was tested on 2024-09-03. Penpie, a separate yield optimizer built over Pendle, lost about $27M after accepting an attacker-created malicious SY and market and exposing a reentrancy flaw in Penpie’s reward harvesting. The Pendle contracts performed permissionless market creation as designed; Pendle was not the vulnerable custodian. Aave’s review says Pendle detected the suspicious activity, paused contracts, and helped safeguard about $105M. This was good incident response and not a reason to call Pendle core exploited. It is, however, direct evidence that “deployed by the Pendle factory” is provenance, not an asset-quality review, and that integrations can mistake one for the other.

The exit

At maturity, PT can be redeemed one-for-one for its stated accounting asset; YT has no remaining principal value, though previously earned yield can still be claimed. A matured LP can zap out, redeem PT, unwrap SY, and claim rewards in one routed transaction. These are contract paths, not guarantees that the accounting asset itself remains redeemable or at par. If the underlying lending market freezes, an LST depegs, an RWA gates withdrawals, or an SY proxy fails, maturity does not manufacture sound collateral.

Before maturity, PT and YT can be sold only against available pool or limit-order liquidity. Pendle provides a pre-expiry router exit that combines PT, YT, and LP balances into SY subject to a user-set minimum output, but price is the prevailing implied-yield curve. Exiting a PT early realizes rate movement; exiting YT realizes both rate expectations and time decay. Thin liquidity outside a pool’s expected yield range can turn a mark into a poor executable price. For an advisor, exit capacity must therefore be measured for the exact market and maturity, never at the aggregate Pendle-protocol level.

The comparison

Supplying USDC to Aave or Compound leaves the client with a variable-rate, at-will position in one lending market. Buying PT-aUSDC can lock a market-implied return to maturity, but stacks Pendle contracts and SY mechanics on top of that same Aave exposure and gives up at-will par exit. Buying a Treasury bill provides a fixed legal claim on the issuer; PT provides a token claim on another token, whose economic and legal character can be anything from an LST to a synthetic dollar or tokenized credit fund. Similar cash-flow shape is not equivalent credit.

YT is closer to an expiring option on yield than a savings product, and LP is a market-making strategy subsidized partly by incentives. Those instruments can be rational for a manager with a rate view, position-level analytics, and a maturity book. They do not improve a conservative client allocation merely because an interface translates the discount into “fixed APY.” The relevant benchmark is the simpler underlying position after fees and added failure modes, not the highest displayed Pendle rate.

Open questions

A re-review must be market-specific. For every candidate it should identify the accounting asset; every protocol, wrapper, bridge, oracle, and upgradeable proxy beneath it; current owner/admin/guardian addresses and timelocks; maturity and post-maturity redemption path; executable exit depth under a stressed implied-yield move; incentive share of return; and whether any points valuation is being presented as yield. It should also reconcile Pendle’s official-UI curation to the permissionless factory and document what review curation actually performs. The protocol-wide verdict can change only if the client product is narrowed to a repeatable, plain-English class of PTs with independently verified underlying risk and reliable pre-maturity exits. “Pendle” by itself is not one risk.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Pendle documentation introduction · primary · accessed 2026-08-15
  Supports: protocol scope, yield tokenization, market-specific products
• Pendle Standardized Yield documentation · primary · accessed 2026-08-15
  Supports: SY wrapper, underlying protocol dependency, adapter boundary
• Pendle Principal Token documentation · primary · accessed 2026-08-15
  Supports: PT principal claim, maturity redemption, accounting asset
• Pendle Yield Token documentation · primary · accessed 2026-08-15
  Supports: YT yield entitlement, expiry value, leveraged yield exposure
• Pendle V2 AMM documentation · primary · accessed 2026-08-15
  Supports: PT-SY AMM, implied-yield curve, LP return components
• Pendle security and audits · primary · accessed 2026-08-15
  Supports: security program, named reviewers, core audit record
• Pendle Core V2 audit repository · primary · accessed 2026-08-15
  Supports: audit reports, core-contract scope, review dates
• Pendle 2024 maturity record · primary · accessed 2026-08-15
  Supports: June 2024 maturity volume, issuer-reported settlement record
• Aave governance review of Pendle PT · primary · accessed 2026-08-15
  Supports: reviewed PT control roles, pause and upgrade powers, collateral scope
• Zokyo Penpie exploit analysis · secondary · accessed 2026-08-15
  Supports: Penpie reentrancy, malicious SY integration, Pendle core boundary
• Pendle router exit functions · primary · accessed 2026-08-15
  Supports: pre-expiry exit, post-expiry redemption, minimum-output protection

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.