Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pendle-finance/pendle-core-v2-public

              main @ 0fcebf7
            

Fixes

CVEs

HIGH

Peak severity

61.5%

Coverage

Highlights

Reentrancy: 5 prior fixes. Scrutinize any change in this area.

contracts/core/YieldContracts/PendleYieldToken.sol: most-fixed (3 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reentrancy: Multiple reentrancy fixes across yield token functions that call external contracts (SCY rewardIndexesCurrent, exchangeRate) and transfer tokens (safeTransfer). Missing nonReentrant on one path could allow callback-based fund drain.

Access Control: Two fixes address bypasses in scoped access and selector-admin checks. Per-selector admin enforcement is critical to prevent privilege escalation via multi-selector aggregate calls.

Reentrancy: Mint/redeem/mintNoPull/redeemNoPull and claimRewards lacked reentrancy guards; external calls during these operations could be re-entered. Guard must cover all entry points including NoPull variants.