According to Beosin Alert monitoring, the DeFi protocol Penpie built on Pendle was hacked and about $27 million in crypto assets were stolen. Beosin's brief analysis of the incident is as follows: The attacker uses the claimRewards function in the market contract to re-enter the pledge to increase the balance of the staking contract, and then withdraws the excess tokens and pledged assets of the taking contract for profit 1. The attacker first creates an attack contract and builds the corresponding market contract through the official factory 2. Call the batchHarvestMarketRewards function of the staking contract to update the reward of the market 3. When updating the reward, the attack contract claimRewards function will be called back, and this function will re-enter and pledge the assets obtained by the lightning loan, so that the assets of the staking contract form a quantity difference and extract the excess. 4. The attacker withdraws the pledged assets and returns the lightning loan for profit