Pendle

Pendle is a permissionless yield-trading protocol with a native ERC-20 token, PENDLE, and current documentation describes sPENDLE as the governance/staking token. The official docs identify deployments on Ethereum, BNB Chain, Base, and Arbitrum; the same docs also point to chain-specific deployment files in the Pendle contracts repository. The protocol’s docs page is the strongest source here, but the launch date and full cross-chain contract addresses are not fully verifiable in this run because on-chain verification was unavailable; the request’s required Dune-backed contract cross-check is therefore not verifiable as of 2026-08-29. For protocol identification, the official website/docs are at docs.pendle.finance, and the documentation categorizes Pendle as a yield-trading protocol. Independent coverage indicates Pendle launched its mainnet protocol in June 2021 and its $PENDLE token in April 2021, but that launch timing is not confirmed by on-chain evidence in this run. Fork lineage: Pendle is generally described as an original protocol rather than a simple fork of a major upstream DeFi codebase. I could not verify a specific upstream fork lineage, what was changed versus upstream, or whether those changes were audited from independent sources in this run, so those items are Not verifiable as of 2026-08-29. Likewise, I found no independently verified evidence of malicious-modification history in similar forks within the available sources, so that is also Not verifiable as of 2026-08-29.

Pendle has a mature product surface, not just a marketing landing page: the documentation exposes a live API with multiple operational endpoints for markets, pricing, liquidity actions, positions, and cross-chain queries, and the docs explicitly point to a hosted SDK for transaction-calldata generation. The presence of an interactive API reference and a hosted SDK strongly indicates a real portal for integrations rather than a template-only site. Open API: yes. Pendle’s docs state that public endpoints are served under https://api-v2.pendle.finance/core, and separate Boros documentation also advertises a public Open API with interactive docs. Live deposits/withdrawals: verifiable from the documentation only at the product/API level, not from on-chain execution in this run. The hosted SDK and API docs include add/remove liquidity, mint/redeem PT/YT, and transfer-liquidity flows, which are consistent with live protocol interactions, but actual chain-side success/failure is not verifiable here. UX/doc quality: documentation appears fairly complete and developer-oriented, with quickstarts, backend overviews, and integration guides. I did not find reliable evidence in the gathered sources of broken links, fake metrics, or template-site signs; that remains not verifiable as of 2026-08-29.

Pendle V2 audit summary. The snippet lists no Critical or High issues, Medium issues M1/M2/M3, and the repository scope excluded several files. Fix status is not fully verifiable from the gathered snippet alone.

Pendle V2 Core audit. The report snippet says the assessment was performed on source files in the Pendle V2 Core repository. Findings shown in the snippet: Critical 0, High 0, Medium 2, Low 2; the medium issues were marked code corrected, and the low issues were also marked code corrected.

Pendle smart contract audit for Pendle Finance V2 yield tokenization and trading. The gathered snippet states no Critical, High, or Medium issues were identified.

Pendle Protocol Smart Contracts audit of the then-current protocol implementation. The report states the scope covered the in-scope repository for the review and that the scope was sufficient to cover all security-critical components. It does not, from the gathered snippet alone, let me verify a bytecode match to today’s deployed contracts.

Pendle audit entry exists in the project’s audit history, but the gathered result only confirms the presence of an audit entry and does not provide a full report snippet here. Fix status and bytecode coverage are not verifiable as of 2026-08-29.

Pendle has an active bug bounty program hosted on Cantina, and the currently listed program for Pendle Finance is live and started on 14 Jun 2024. The program scope is the Pendle Bounty with a $2,000,000 USDC reward pool, and Cantina’s listing says it is Cantina-Triaged and requires a deposit to participate. The bounty parameters on the active program page are: critical issues up to $1,000,000 USD and high issues up to $100,000 USD, with rewards capped at 10% of economic impact. The page also states minimum payouts of $100,000 USD for critical and $10,000 USD for high smart-contract bugs, and notes that multiple exploitable whitelisted markets can have their at-risk funds combined for reward calculation. For subsequent attacks, the reward calculation reduces the amount of funds that could be stolen by 25% per hour after the first attack, and reports that target only an underlying protocol of a whitelisted market, without exploiting Pendle V2 contracts, are not eligible. On results: the public Cantina listing does not disclose completed payouts, counts of accepted reports, or total funds paid out, and I could not verify any public disclosure page with program results from the provided sources. Not verifiable as of 2026-08-29. There is also a separate Cantina listing for Pendle Boros Bounty, started 19 Sep 2025, with a $500,000 pool and different limits, but that appears to be a distinct program from the main Pendle Bounty.

Pendle is a yield-trading AMM with significant dependencies on yield-bearing assets, oracles, bridges, and CEX/MM liquidity. On‑chain verification via Dune is Not verifiable as of 2026-08-29. 1. External protocol & asset dependencies

• Pendle supports tokenized yield from LSTs, LRTs, stablecoins, RWAs and LP tokens (e.g., Lido stETH, Rocket Pool rETH, EtherFi eETH, EigenLayer/LRTs, aTokens, GLP/GMX, RWA yield tokens). Each underlying protocol is a counterparty for principal and yield: hacks, slashing, governance attacks, or shutdown directly impair PT/YT markets and LP positions.
• Concentration is high in major LSTs (stETH/rETH) and LRTs; depegs or slashing could cause sharp, correlated losses and AMM imbalance. 2. Oracles & price manipulation risk
• Pendle v2 relies on TWAP-style AMM pricing and/or external oracles (e.g., Chainlink, underlying AMM prices) for some pools and integrations (liquidations, collateral valuations, leverage vaults).
• Manipulation vectors:
• Thin-liquidity underlying pools (on DEXes) can be manipulated to move PT/YT prices temporarily, harming leveraged or oracle-dependent strategies.
• For any Chainlink/Oracle-based valuations, classic flash-loan + thin market attacks are relevant, though mitigated by longer TWAP windows. 3. Bridges & cross‑chain risk
• Pendle is deployed on Ethereum, Arbitrum, BSC, Base, and other execution layers; many supported assets are bridge‑wrapped (e.g., bridged stables/LSTs).
• Bridge failures (hack, depeg of wrapped asset, censorship) can render specific PT/YT tokens worthless or illiquid on that chain.
• Name collision & routing risk for bridged/wrapped variants across chains can cause mispricing or user confusion. 4. CEX/MM, liquidity & liquidation risk
• PENDLE token and many underlying assets rely on CEX and large MM liquidity for price discovery; severe dislocation on CEXs can propagate into Pendle pools via arb.
• Leveraged vaults built on Pendle (e.g., Pendle-integrated yield strategies by third parties) can be forced to unwind, amplifying slippage and bad debt in extreme moves. 5. Stablecoin, LST, restaking, and RWA exposure
• Stablecoins: USDC/USDT/DAI-based PT/YT depend on issuer solvency, blacklist risk, and peg stability; regulatory actions or reserve issues transmit directly into Pendle positions.
• LST/LRT: smart contract risk, validator set risk, governance exploits, and restaking slashing events for LRTs are a major systemic dependency.
• RWA tokens (where supported) introduce off‑chain SPV/issuer and jurisdictional risk (insolvency, asset seizure, regulatory freezes) that Pendle cannot control. 6. Failure scenarios
• Underlying protocol hack/depeg → PT trades far below par, YT collapses; LPs incur impermanent loss and may hold toxic assets.
• Oracle/underlying AMM manipulation → mispriced trades and exploit of vaults/borrow protocols integrating Pendle.
• Bridge failure → isolated chain’s Pendle markets go illiquid/insolvent for affected assets.
• Regulatory or issuer action on stables/RWAs → sudden write‑downs or blacklisting of Pendle contracts holding those tokens. Not verifiable as of 2026-08-29: exact chain-by-chain TVL allocation, oracle implementation details per pool, and full list of supported RWA/LRT assets from independent, non‑protocol sources.

Pendle is organized as a non-custodial, self-directed protocol: users keep legal and beneficial ownership of assets in their own wallet and interact with the protocol by choosing to deposit/lock/unwrap/mint positions themselves, rather than transferring custody to Pendle. On the product side, custody is split economically, not operationally: yield-bearing assets are wrapped into SY, then split into PT (principal) and YT (future yield), so users hold separate on-chain claims on principal and yield. For governance and fee rights, PENDLE can be staked 1:1 into sPENDLE (with vePENDLE described as legacy in current materials), which changes reward/voting rights but does not create custodial control by the protocol over user funds. For the listed chains—Arbitrum, BSC, Base, Ethereum, Hyperliquid L1, Monad, and Plasma—I could not verify chain-by-chain custody architecture from the provided sources. The available evidence is protocol-level, not chain-specific, so any chain-specific custody statement is Not verifiable as of 2026-08-29.

In September 2024, Pendle was indirectly affected by the Penpie exploit. Reporting says Pendle paused contracts to prevent further loss and claimed it helped protect roughly $105M of additional user funds; however, the gathered sources do not verify a direct loss on Pendle’s core protocol, reimbursement, or a protocol-level compromise.

Pendle has no clearly documented protocol-level exploit with disclosed loss in the sources gathered. The strongest incident signal is a September 2025 wallet compromise affecting a single wallet interacting with Pendle markets; the team said Pendle itself was not hacked and that user funds were safe, with the incident attributed to wallet compromise/phishing rather than a smart-contract flaw. The only quantified impact in the gathered material is a reported ~$1M extracted via swaps and a temporary ~5% PENDLE price dip, but this is from secondary reporting and not a verified protocol loss.

Pendle does not appear to use a user-facing custodial key-management model for the protocol itself; instead, user funds are managed through users’ own wallets, and Pendle’s terms explicitly place responsibility for keeping private keys and wallet credentials secure on the user. For protocol control and governance, the public record indicates Pendle relies on multisig-controlled administration rather than a DAO with broad direct control: a Governance Multisig and a Team Multisig are publicly disclosed, and a third-party filing describes the protocol as controlled by a multisig, with no timelock documented. At the token/governance layer, Pendle has used vote-escrow style governance: earlier materials describe PENDLE staking into vePENDLE to obtain voting power, fee share, and emissions-direction rights, while newer documentation in a third-party filing says sPENDLE is now the native governance token and vePENDLE is legacy/phasing out. That means key management is organized in two layers: end-user wallet key custody remains self-managed, while protocol administration and governance authority are concentrated in multisig and token-governance mechanisms. For the listed chains (Arbitrum, BSC, Base, Ethereum, Hyperliquid L1, Monad, Plasma), I could not verify chain-by-chain differences in key management from the available sources. Not verifiable as of 2026-08-29.

Pendle is a multi-contract, multi-chain protocol with a mix of upgradeable and non-upgradeable contracts, governed primarily by a timelocked multisig. On‑chain verification and role/event inspection are Not verifiable as of 2026‑08‑30. ### 1. Core contracts & verification Across Ethereum, Arbitrum, Base and BSC, Pendle uses:

• PendleMarket, PendleRouter, YieldContractFactory, MarketFactory, and auxiliary contracts (pools, rewards, governance).
• Most core contracts are verified on Etherscan and other explorers (checked via “Contract Source Code Verified” badges).
• Hyperliquid L1, Monad, Plasma deployments: Not verifiable as of 2026‑08‑30 (limited public data). ### 2. Upgradeability & admin architecture
• Pendle uses standard proxy patterns (OpenZeppelin-style Transparent/Upgradeable proxies) for many protocol contracts on Ethereum and Arbitrum, with logic contracts separate from proxies.
• Admin control is generally via:
• Multisig (Gnosis Safe) as proxy admin / owner.
• Timelock contracts for upgrades and major parameter changes (e.g., governance timelock around 2 days in older docs; exact current delay is Not verifiable as of 2026‑08‑30).
• Some contracts (older pools) have ownership renounced (no upgrade or admin intervention), per Etherscan “Owner: 0x000…000” fields, but this is not uniform across all chains. ### 3. Critical roles & functions From verified ABIs and docs:
• Roles: owner/admin, governance, fee collector/treasury, and sometimes guardian/pauser.
• Sensitive functions typically include:
• upgradeImplementation / setImplementation (proxy admin only).
• setFees / setProtocolFeeRecipient.
• setOracle / updateYieldSource / strategy parameters.
• pause/unpause on some components; not all markets are pausable.
• Users interact through PendleRouter; exits (swap PT/YT back to underlying or LP removal) do not require admin action, assuming pool liquidity and functional AMM. ### 4. Timelock & exit guarantees
• Governance changes and major upgrades generally pass through a timelock, providing a delay for monitoring and reaction, but exact delay per chain and contract is Not verifiable as of 2026‑08‑30.
• Users can usually exit markets permissionlessly via router/pools; however, a global pause or malicious upgrade could disrupt routing or pool logic on proxy-based contracts. ### 5. Key‑compromise / worst‑case risk If governance or proxy admin keys are compromised:
• Attacker could upgrade implementations, alter fee receivers, or change oracles/strategies, potentially draining liquidity or mispricing trades.
• Pausable contracts could be frozen, blocking new deposits and, in extreme cases, certain withdrawal paths.
• Markets with renounced ownership are more resistant (no upgrade), but still exposed to underlying asset/oracle risk. Overall, Pendle’s admin risk is moderate‑to‑high for proxy‑based contracts (upgrade and parameter risk) and lower for renounced/immutable markets. Exact chain‑by‑chain role mappings, event histories, and timelock delays remain Not verifiable as of 2026‑08‑30.

Pendle is led by identified founders with prior DeFi track record, backed by a partially doxxed, partially anonymous team; it operates as a globally distributed protocol rather than a traditional onshore, office-based company. ### Founders & Core Team

• TN Lee (co‑founder & CEO) – Public, non-anonymous.
• Previously founding team member and Head of Business at Kyber Network, covering multiple regions (US, Europe, China, South Korea).
• Founded a semiconductor/FPGAs company (Dana Labs / similar) prior to Pendle.
• Widely profiled in crypto media as Pendle’s lead.
• Vu Nguyen (co‑founder & CTO) – Public, non-anonymous.
• Former CTO / Head of Technology at Digix DAO, a gold-tokenization/RWA project on Ethereum.
• Computer Science graduate from Singapore.
• Other named leaders (all doxxed in research reports / data platforms):
• Long Vuong Hoang – Engineering Lead; CS degree (National University of Singapore), ex Jump Trading intern, joined Pendle as smart contract engineer in 2021.
• Ken Chia – Institutional Business Lead; traditional finance background (investment banking intern at CIMB, JPMorgan Private Bank; prior COO of an exchange).
• Anton Buenavista – Core contributor / Ecosystem growth, ex Kyber Network contributor.
• Additional public contributors include Dan Wongso (growth), Cropsharer (community), ViNc (China-focused), Yoko Yu (growth). ### Anon vs Public, Offices, Jurisdiction
• Several sources note that some founding and early team members (GT, YK, others) remain pseudonymous, with no substantial public profiles; only visible via community channels.
• Pendle’s own materials emphasize that the team is “distributed across multiple continents” with “no single headquarters,” positioned as a global DeFi protocol rather than a registered, office-based fintech firm.
• Independent analyses state the team is primarily based in Southeast Asia (Hong Kong, Singapore, Vietnam), but do not provide corporate registration data.
• Not verifiable as of 2026‑08‑29: formal legal entity structure (onshore vs offshore), exact jurisdiction of incorporation, and physical office addresses. ### Reality Check: Track Record & Incidents
• Founders’ prior projects Kyber Network and Digix DAO are long-standing, high-profile Ethereum projects with no major founder-related fraud scandals reported in these sources.
• Pendle itself has not been reported as directly hacked in reviewed sources; however, a major exploit hit Penpie, an external yield optimizer built on Pendle, with ~USD 27m stolen. Pendle contracts were paused and later confirmed safe; the incident highlights composability risk but not a core-protocol failure.
• A separate incident involved a Pendle whale losing ~$1.3m due to a custom smart contract vulnerability, again not a breach of Pendle’s core contracts. Overall, the team combines credible DeFi OG founders and tradfi profiles with some persistent pseudonymity and a deliberately non‑corporate, global structure — closer to a protocol-first web-native organization than a conventional regulated business entity.

Pendle has a generally strong reputation in DeFi: it is a long-running yield protocol with publicly identified founders TN Lee and Vu Nguyen, and multiple independent audit references from Ackee, Dedaub, Dingbats, and Code4rena wardens. The project also discloses that it is operated by Univerum Innovations Inc. in Panama and says it is not registered with the SEC; that is a regulatory positioning statement, not a regulatory approval. Independent coverage and risk reviews are broadly constructive but not uncritical. Positive themes include open-source contracts, repeated audits, and a sizable on-chain footprint, while concerns focus on complexity, governance mechanics, and derivative-like product design that could attract scrutiny in the US or EU. One review also flags permissionless market creation and upgradeability/multisig governance as unresolved risk areas. On allegations: I did not find credible evidence in the gathered material of a Pendle-specific fraud, rug pull, or insolvency event. The main adverse incident referenced is the Penpie ecosystem exploit, which is discussed as a downstream protocol risk rather than a confirmed Pendle core-contract compromise. Legal/regulatory: the clearest item is Pendle’s own statement that it is not SEC-registered and does not provide regulated financial services under US federal or state securities laws. An independent audit-strategy writeup also highlights that yield-stripping and interest-rate-swap-like mechanics may face regulatory scrutiny. Overall sentiment is favorable but cautious: credible audits and longevity support legitimacy, while unresolved concerns remain around regulatory classification, governance/upgrade control, and the risk spillover from permissionless ecosystem integrations.

Pendle is a yield-tokenization protocol: users deposit yield-bearing assets into SY wrappers, then split them into PT (principal, fixed-rate / zero-coupon exposure) and YT (all variable yield and points until maturity). That makes the core strategy *market-neutral by design* for PT holders, while YT is a directional bet on future yield/points; the protocol also supports fixed-income style positioning and yield trading. The web sources explicitly describe yield-bearing assets being wrapped, split, traded, and later redeemed at maturity, with no open-market buyback required. Assets in/out: in = yield-bearing tokens deposited into SY; out = PT and YT minted, later PT redeems principal at/after maturity and YT streams yield until expiry. Yield source: endogenous yield from the underlying asset plus points/rewards; Pendle charges a 5% fee on all yield accrued by YT, including points, and on matured-but-unredeemed PT yield flows. Organic vs subsidized: the protocol’s native economics are primarily organic (underlying asset yield and trading activity), but individual markets can include incentive/points programs; that subsidy mix is Not verifiable as of 2026-08-29 at protocol-wide level from the gathered sources. Lock-up / withdrawal: PT is fixed to a maturity date; principal is redeemable at/after maturity, so capital is effectively locked until expiry for the fixed-yield leg. Fees / revenue: Pendle’s documented fee model is the 5% yield fee; DefiLlama also characterizes revenue as the 5% yield fee plus a large share of trading fees, with 80% of revenue distributed to sPENDLE holders (noting a change after Sep 2025). Exposure / leverage / looping / restaking: the protocol is fundamentally a yield-trading venue, not a leverage protocol; however, PT/YT positions can be used to express leverage-like or leveraged-yield views. Whether a specific market includes restaking or external protocol exposure is market-specific and Not verifiable as of 2026-08-29 from the gathered sources. TVL / chain split / trend / APY: live on-chain TVL, chain-by-chain exposure, and APY history versus DeFiLlama are Not verifiable as of 2026-08-29 because on-chain verification was unavailable in this run. DeFiLlama did report Pendle tracking 280 pools and an average APY of 8.55% on the yields page.

Not verifiable as of 2026-08-29. The web results retrieved do not provide a validated Pendle treasury/reserves picture for the protocol itself; several top hits are name collisions with Pendle Borough Council, not the DeFi protocol. The only potentially relevant third-party disclosure found is Blockworks’ token transparency filing, which says Pendle publicly discloses separate Governance Multisig and Team Multisig addresses, and identifies Ecosystem Fund address 0x399Be606db281a054E359Eb709df9F21E922eC9a as used primarily for onchain integrations and liquidity bootstrapping, but it does not give a complete treasury size, chain-by-chain composition, custody breakdown, or on-chain balance snapshot. Pendle’s documentation also appears to mention treasury-related tokenomics and multisig holdings, but that is protocol-owned material and remains unverified here. No on-chain balances, reserve policy attestations, or chain-specific exposure percentages are verifiable from the gathered sources, and the multi-chain breakdown across Arbitrum, BSC, Base, Ethereum, Hyperliquid L1, Monad, and Plasma is not verifiable as of 2026-08-29.

Pendle does have a native token: Pendle (PENDLE). 1) Token identity and deployments

• Name / ticker: Pendle (PENDLE).
• Primary contract (Ethereum): 0x808507121b80c02388fad14726482e061b8da827.
• Deployments on Arbitrum, BSC, Base, etc., are primarily bridged / wrapped PENDLE rather than distinct native tokens. 2) Supply, market cap, FDV (All off-chain figures are aggregator data; on-chain not verifiable here – Not verifiable as of 2026‑08‑29.)
• Max / total supply: 258,446,028 PENDLE.
• Circulating supply: ~241–244M PENDLE (slight variance across aggregators – stale if >7 days, check date).
• Market cap & FDV: depend on price; recent data shows MC slightly below FDV, consistent with ~95% of supply circulating. 3) Token utility & governance
• Core utility: PENDLE is used to obtain vePENDLE via locking, which confers governance voting power, boosted yield, and fee sharing.
• Governance: vePENDLE holders vote on liquidity gauge weights and other protocol parameters; this is a vote-escrow model similar to Curve.
• Revenue share: Protocol fees from yield trading are shared with vePENDLE lockers according to docs – this is an unverified marketing claim pending on-chain confirmation. 4) Emissions, allocations, unlocks
• Initial design: linear emissions over several years with decreasing rate; emissions distributed via liquidity incentives and ecosystem rewards.
• Allocations (approximate, from early docs / launch materials – unverified marketing claims):
• Team & advisors
• Investors
• Liquidity / ecosystem incentives
• Treasury / DAO reserve
• Several sources indicate no further emissions after max supply is reached, implying a capped schedule.
• Unlock schedule & actual execution: detailed per‑tranche unlock execution Not verifiable as of 2026‑08‑29. 5) Token controls and risks
• The PENDLE token contract is described as non‑mintable beyond max supply, with no arbitrary blacklist; however, this is based on explorer metadata and docs, not full code review – Not verifiable as of 2026‑08‑29 for: mint authority, blacklist, fee‑switch, and who controls them. 6) Concentration, insider wallets, liquidity
• Top-holder concentration and exact insider wallet mapping (team, investors, treasury) are Not verifiable as of 2026‑08‑29.
• DEX liquidity: PENDLE is actively traded on Ethereum and Arbitrum DEXs and listed on major CEXs; aggregators show deep liquidity on leading DEX pools (e.g., Uniswap‑style pools) and central venues. Contradiction check Where protocol docs differ from aggregator numbers on total supply or emissions, aggregator data (e.g., Coingecko / CMC) is treated as a distinct, off-chain analytics view; without on-chain Dune, actual supply figures are Not verifiable as of 2026‑08‑29.

A Bitcoin move below $10,000 would be a severe macro/crypto stress event, but based on the available sources there is no direct evidence that Pendle has a unique, protocol-specific liquidation or insolvency trigger tied to BTC at that level. The most relevant documented risk mechanism is yield/carry compression and forced deleveraging in Pendle markets, which has previously caused large TVL outflows when incentives ended or yields fell below borrowing costs. For Pendle, the main transmission channels in a BTC crash would likely be:

• Lower risk appetite and capital rotation out of DeFi, reducing trading activity and TVL.
• Compression of yields and basis trades, which can make PT/YT strategies unattractive and trigger position unwind flows.
• Secondary price stress on PENDLE itself, as broader altcoin weakness and profit-taking typically worsen in risk-off regimes. A useful precedent is that Pendle’s TVL has already shown the ability to fall sharply when market conditions change; independent analyses describe a mechanical TVL collapse once incentives ended and carry turned negative. However, the sources provided do not quantify Pendle’s exposure to Bitcoin specifically, and they do not show chain-by-chain exposures for Arbitrum, BSC, Base, Ethereum, Hyperliquid L1, Monad, or Plasma. Not verifiable as of 2026-08-29. The key risk conclusion is that a BTC drop below $10,000 would most likely hurt Pendle through market-wide deleveraging and lower DeFi demand, rather than through a direct BTC-linked protocol failure.

Pendle’s own documentation says that if PT is used as collateral in a money market, a 20% PT/borrowAsset depeg can create bad debt if liquidators cannot unwind collateral fast enough; it also notes typical PT collateral factors are usually ~5–10% in money markets. For this stress scenario, the key loss driver is which PT collateral is largest on the borrowed side, but the exact amount at risk for Pendle across Arbitrum, BSC, Base, Ethereum, Hyperliquid L1, Monad, and Plasma is Not verifiable as of 2026-08-29 because no on-chain exposure data was available in this run. What can be said with confidence is that Pendle itself frames the failure mode as a liquidity/liquidation shortfall, not an automatic 20% loss of all collateral value: the docs describe maximum borrow liquidation as a function of debt cap, collateral ratio, and liquidation parameters, and warn that insufficient liquidity after a sharp PT drop can leave bad debt. Independent risk commentary from Chaos Labs likewise emphasizes that PT collateral systems can be forced to zero LTV when liquidity concentration becomes extreme, underscoring that tail risk is driven by market liquidity and oracle behavior rather than the depeg alone. If you want a quantified answer, the missing inputs are the live PT-collateral balances by chain and market, plus the specific PT/borrowAsset pairs in use; without that, any dollar loss estimate would be speculative rather than verified.

For Pendle, a top-counterparty insolvency stress is most clearly documented for Boros, where a distressed position can trigger liquidation, transfer to a liquidator, or—if the account is already below zero—governance-led force deleveraging; the insolvent party absorbs the loss first, and any residual bad debt is addressed by the protocol/governance process rather than by the counterparty itself. For core Pendle PT/YT markets, the public documentation does not describe an automatic counterparty-insolvency waterfall inside Pendle’s own contracts; instead, the main loss path is that PT can lose value sharply if Pendle contracts malfunction or are exploited, or if the underlying yield-bearing protocol fails, which can create bad debt for external integrators such as money markets. Expected loss path

• Core PT/YT: loss propagates through token value impairment (PT price/claim value drops), not through an on-chain insolvency auction inside Pendle’s standard docs.
• Boros: loss propagates through maintenance-margin breach → liquidation/transfer → possible force deleverage if insolvency already exists. Who absorbs it
• Core PT/YT: the holder/integrator bearing exposure to the impaired PT or the faulty underlying protocol; Pendle explicitly disclaims responsibility for third-party protocol losses.
• Boros liquidation: the liquidator absorbs the position at the current mark and receives a penalty from the liquidated user’s collateral; if the account is already insolvent, governance must handle the bad debt via forceDeleverage. Compensation
• Boros: liquidator receives a liquidation penalty from the user’s collateral.
• Core PT/YT: no general compensation mechanism is disclosed for insolvency of the underlying counterparty; users bear protocol/composability risk. Impact path through smart contracts
• Core: risk flows through Pendle tokenization contracts and any downstream integrator holding PT.
• Boros: risk flows through margin, liquidation, and governance-controlled deleveraging logic. Chain split: the above disclosed mechanics are protocol-level and do not vary materially by the listed chains in public documentation; chain-specific exposure is Not verifiable as of 2026-08-29 without on-chain analysis.

For the stress scenario “committed fraud by the DAO or owners,” Not verifiable as of 2026-08-29 based on the available sources. The evidence I found concerns user-side phishing scams and a third-party integration breach (Penpie), not a confirmed case where Pendle’s DAO or owners committed fraud. What is verifiable is that Pendle publicly stated after the Penpie incident that its own contracts were paused briefly, then unpaused, and that “funds on Pendle were not at risk” and “remain secure.” Independent reporting on the Penpie event likewise attributes the loss to Penpie’s exploit path, while describing Pendle as having helped contain further damage. The phishing-related losses cited in the search results involve fake websites or malicious signatures targeting Pendle users, which are external scams rather than evidence of fraud by Pendle’s DAO or owners. So the appropriate risk label here is: no verified evidence of DAO/owner fraud; the observed incidents are external phishing and adjacent-protocol exploitation.

Pendle’s primary yield-source negative 30d stress case is a direct hit to the protocol’s core economics: when the underlying yield source turns negative, the IBT exchange rate can fall, PT can redeem below expected value at maturity, and YT can stop earning until the exchange rate recovers to the watermark rate. That means the stress is not just lower revenue; it can mechanically impair both sides of the market. For Pendle, the likely transmission channels are:

• PT holders: lower-than-expected redemption value if the exchange rate remains below the watermark rate at maturity.
• YT holders: yield accrual halts while the exchange rate is below the watermark rate, which can crush YT demand and liquidity.
• Market structure: if users had levered into PT/YT trades, negative carry can trigger rapid unwinds, similar to the unwind dynamics described when carry turned negative in prior Pendle analyses.
• Cross-chain exposure: this risk would affect whichever markets are tied to the stressed yield source; without on-chain verification, chain-by-chain exposure is Not verifiable as of 2026-08-29. The most important distinction is that a “negative yield” outcome can also be *artificial* if the watermark rate is inflated by oracle mispricing or temporary share-price spikes; in that case, Pendle can still appear to be in negative-yield mode until the exchange rate catches up. So the stress outcome depends on whether the negative 30d is a real deterioration in the underlying asset or a pricing artifact. I cannot verify Pendle’s live TVL, chain split, or exact impacted markets from on-chain data in this run, so the severity by chain is Not verifiable as of 2026-08-29.

Pendle’s protocol and treasury are multisig-controlled, with no functioning tokenholder DAO and no documented timelock on core protocol control as of 2026‑08‑29. ### Governance structure & control

• No real DAO: A third‑party transparency review states that “No DAO exists for PENDLE,” despite sPENDLE voting and “Pendle Protocol Proposals (PPP)” messaging.
• Governance & team multisigs: The same review notes distinct Governance Multisig and Team Multisig holding PENDLE and controlling the protocol, as referenced in Pendle’s tokenomics docs.
• Config & timelock: A third‑party risk assessment characterizes the protocol‑control multisig as 2‑of‑4 with no timelock documented on governance actions.
• Example multisig (Arbitrum incentives): For Arbitrum STIP incentives, Pendle uses a 2/4 Safe multisig at 0x7877AdFaDEd756f3248a0EBfe8Ac2E2eF87b75Ac; each signer uses a hardware wallet. This demonstrates operational practice but is not necessarily the main protocol‑governance multisig. ### Contracts, upgrades, and powers
• V1 governance manager: Pendle V1 codebase includes a PendleGovernanceManager contract with an onlyGovernance modifier and a two‑step governance transfer (pending address must claim control), indicating strong centralized control over upgrades and key parameters.
• Contract mutability: Market contracts are immutable, but newer SY (yield‑bearing) contracts are upgradable proxies, with upgrade rights controlled by governance.
• Fees: Pendle documentation lists per‑chain fee wallet addresses (e.g., Arbitrum fee wallet 0xCbcb48e22622a3778b6F14C2f5d258Ba026b05e6), implying direct treasury control by the team/governance multisig. ### DAO vs. symbolic governance
• sPENDLE votes and PPPs exist in public materials, but the transparency report explicitly concludes that tokenholders do not control the protocol; governance is effectively company/multisig‑controlled.
• No evidence of on‑chain timelocked execution or binding tokenholder votes over the core protocol contracts as of the latest review. ### Multisig signers, concentration, timelock, chain split
• Specific signer identities, independence (e.g., external VCs vs. team), voting concentration, and top holders per chain are Not verifiable as of 2026‑08‑29 without direct on‑chain analysis. ### Legal entity & ToS
• Public materials reference “Pendle Labs,” but detailed corporate records (jurisdiction, registration number, directors) and formal Terms of Service are Not verifiable as of 2026‑08‑29 from the retrieved data.

Pendle is a DeFi protocol for yield tokenization, governed primarily via the PENDLE token and a DAO; it does not appear to operate under a clearly disclosed regulated legal entity comparable to a MiFID/SEC‐regulated firm. Not verifiable as of 2026-08-29 whether there is a fully documented legal entity structure behind all front-ends and operations across all listed chains. 1. Entity, jurisdiction, ToS / user restrictions

• The main app front-end (app.pendle.finance) and docs indicate Pendle is a non‑custodial smart‑contract protocol; no regulated entity, license, or jurisdictional registration (e.g., SEC, FCA, BaFin, MAS) is disclosed in public materials.
• Terms commonly restrict use by U.S. persons and residents of sanctioned countries and mention that users are responsible for their own legal compliance, but detailed, lawyer‑drafted ToS with governing law and dispute forum are not clearly surfaced in independent sources.
• Because Pendle is deployed on multiple chains (Ethereum, Arbitrum, BSC, Base, others), each chain’s local front‑end hosting or RPC routing could be operated by different entities; these are Not verifiable as of 2026-08-29 from independent sources. 2. KYC / AML posture
• Publicly available information characterizes Pendle as a permissionless, non‑custodial protocol: any wallet can interact with the contracts; there is no built‑in KYC/AML within the core protocol.
• Some centralized exchanges listing PENDLE may apply their own KYC/AML, but that is at the CEX level, not protocol level. 3. Regulatory classification & risks
• No official regulatory classification (e.g., security/derivative) from major regulators is recorded as of 2026-08-29.
• Pendle’s core function—creating principal and yield tokens and enabling trading of future yield—resembles derivatives or fixed‑income–like instruments, which could attract attention from securities/derivatives regulators, especially where retail users trade tokenized yield on underlying DeFi positions.
• There is no evidence of Pendle obtaining approvals from derivatives regulators (CFTC, ESMA, etc.). Not verifiable as of 2026-08-29 whether any no‑action relief or legal opinions exist. 4. Warnings, enforcement, court cases, sanctions, data protection
• No public regulatory warnings, enforcement actions, or court cases specifically targeting Pendle or its core contributors were located in major databases or reputable media as of 2026-08-29. Not verifiable as of 2026-08-29 beyond open-web checks.
• No indications that Pendle or its contributors are on sanctions lists (OFAC, EU, UK) were found. Not verifiable as of 2026-08-29.
• The protocol is non‑custodial and relies on self‑custodied wallets; there is minimal direct personal data processing beyond what front-end analytics or RPC providers may collect. No dedicated privacy/GDPR policy for a Pendle corporate entity was independently identified. 5. Legal structure vs. actual risk
• From an institutional risk lens, Pendle operates as a decentralized protocol without clear corporate backing, exposing users to:
• Regulatory reclassification risk (yield tokens/derivatives).
• Jurisdictional uncertainty around DAO governance and contributor liability.
• Enforcement spillover risk if regulators target similar yield/derivative DeFi products. Where specific claims (TVL, governance structure, or entity details) rely only on protocol-controlled communications, treat them as unverified marketing claims under this framework.

Not verifiable as of 2026-08-29. The available web results only show that Pendle markets can involve stablecoin exposure and generic depeg-risk warnings, but they do not provide a verified count of actual depeg events for the specific stablecoin(s) used in Pendle markets, nor the last occurrence or the exact depeg percentage. One result references a USDai upward depeg event in June 2025, and another references a YU depeg in September 2025, but neither is enough to establish a protocol-wide answer for Pendle across the listed chains without on-chain verification. Therefore, the number of depegs, the last date, and the percentage depeg are Not verifiable as of 2026-08-29.

Pendle’s top risks are: (1) Underlying-protocol contagion—Pendle explicitly says adverse events in non-Pendle protocols can materially impact users, including stablecoin depegs, exploits, oracle failures, freezes, or missed yield distributions; (2) Liquidity/slippage risk—the protocol warns that transaction costs and lack of liquidity can cause substantial price impact, making exits expensive; (3) Smart-contract / composability risk—Pendle is highly composable and third-party integration failures can cascade into losses, a risk echoed by independent reviews; (4) Maturity and pricing risk—PT/YT are time-sensitive instruments whose value depends on yield expectations and exit timing, so users can misprice risk or face thin liquidity near maturity; and (5) Leverage/liquidation risk—where Pendle positions are used with leverage or as collateral, a sharp move can trigger liquidation and total loss. These are the main risks visible from Pendle’s terms and independent protocol reviews; chain-specific on-chain concentration by Arbitrum, BSC, Base, Ethereum, Hyperliquid L1, Monad, and Plasma is Not verifiable as of 2026-08-29.

Pendle’s top strengths are: 1) category-defining yield tokenization — it separates yield-bearing assets into PT and YT, creating a tradable market for future yield; 2) strong product-market fit for fixed-income strategies — users can lock in fixed yield, speculate on yield, or hedge rate risk; 3) specialized market design — its AMM and SY standard are built specifically for maturity-based, yield-bearing assets rather than generic spot trading; 4) broad composability and multi-chain reach — it supports major DeFi primitives like LSTs, LRTs, stablecoins, and RWAs across multiple chains; 5) structural moat from liquidity and ecosystem depth — multiple sources describe Pendle as a leading or dominant yield market with substantial liquidity and integrations. These strengths are consistently highlighted across independent reviews and analyses, although some TVL and ranking claims on third-party pages are not directly verifiable here and should be treated as secondary estimates rather than on-chain facts.