# PendleReflector: fake limit router drains PT balances

Pendle Reflector trusted caller-supplied market and limit-router calldata, letting an attacker drain its PT token balances via a fake limit router.

- Payout: Real-world hack
- Severity: high
- Program: PendleReflector
- Credited: DeFiHackLabs
- Disclosed: 2025-08-01
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/PendleReflector_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250801-pendlereflector
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Pendle Reflector contract on Arbitrum
**Root cause:** Reflector.reflect(bytes) executed arbitrary caller-supplied Pendle action calldata (market address, limit router) while holding and approving its own PT token balances, so a fake limit router could pull those tokens.
**Steps:**
1. Deploy FakePendleMarketLimitRouter implementing readTokens() returning the target PT token and fill() that transfers PENDLE_ROUTER's token balance to attacker.
2. Call `IPendleReflector(REFLECTOR).reflect(abi.encodeCall(IPendleActionSwapYTV3.swapExactSyForYt, (ATTACK_CONTRACT, address(fakeMarket), exactSyIn, 0, guess, limit)))` with limit.limitRouter = fakeMarket.
3. Reflector scales exactSyIn to its full PT balance, approves PENDLE_ROUTER, and invokes the action; the fake limit router's fill() pulls the router's temporary token balance to the attacker.
4. Repeat for each PT token held by Reflector (PT-mPendle, PT-stk-EPendle).
**How found:** Likely source review: noticed reflect() accepts arbitrary bytes and forwards them to Pendle actions without validating the market or limit router, while the contract holds token balances and grants approvals.
**Exploitation:** Attacker deployed a contract implementing the Pendle limit-router interface. By passing a crafted reflect() payload with a fake market and fake limit router, Reflector approved the real Pendle router for its entire PT balance; the fake limit router's fill() then transferred that balance from the router to the attacker. Repeated for two PT tokens, netting ~2304 USD.
**Insight:** When a contract holds tokens and executes user-supplied calldata that includes an address it will approve or interact with, check whether that address is attacker-controlled; a fake limit router can abuse the temporary approval/balance.