Our risk assessment concludes that Pendle PT tokens can be safely onboarded to Aave with appropriate risk parameters. While PT tokens represent a significant opportunity for Aave and its user base, several challenges arise when pricing them and determining safe lending parameters. We evaluated two pricing methods - using onchain data from Pendle AMM and adapting the base asset oracle - and recommend the linearly increasing lower bound method, which requires developing a pricing adapter.
The protocol demonstrates robust security with multiple audits and a proven incident response track record. While the $250k Immunefi bounty could be increased given the $5b TVL, protocol mutability is appropriately limited to pause/caps controls - a feature that proved valuable during the September 2024 Penpie incident, where swift action protected ~$105M in assets. Each PT’s single liquidity source makes yield parameter management critical, though limit order functionality helps maintain base asset redemption.
The operational complexity of managing expiring tokens suggests exploring auto-rolling vault solutions to improve user experience. This implementation would need thorough technical and risk reviews by service providers.
For PT-sUSDe-29MAY2025 and other Ethena-related derivatives, we recommend delaying integration until ongoing discussions about Ethena exposure and pricing are resolved. Integration may also be more opportune after the deployment of Umbrella.
Read full Collateral Risk Assessment
1. Asset Fundamental Characteristics
1.1 Asset
Pendle operates as a yield-tokenization protocol that splits yield-bearing assets into two discrete components: Principal Tokens (PT) and Yield Tokens (YT). This mechanism parallels traditional fixed-income strip bonds, separating coupon payments from principal repayment. The protocol architecture requires yield-bearing assets to be initially wrapped as Standardized Yield (SY) tokens to ensure AMM compatibility before PT/YT tokenization.
The protocol enables several distinct use cases, each with specific risk considerations:
- Fixed-yield asset creation (natively absent from DeFi)
- Directional exposure to yield movements (both positive and negative)
- Point/incentive reward speculation
- Yield enhancement through AMM liquidity provision
1.2 Architecture
Yield-tokenization
When an underlying asset splits into PT and YT tokens, the PT token price equals the base asset price minus the expected yield until maturity. In contrast, the YT token price equals the expected yield until maturity. Over time, PT price increases gradually to match the base asset price at maturity, while YT price decreases slowly to $0 at maturity. YT holders profit when the actual yield exceeds the implied yield (determined by current PT and YT market prices) at purchase and lose when the actual yield is lower. This enables yield speculation on assets like wstETH and sUSDe. Conversely, buying and holding PTs functions as holding fixed-yield tokens.
Pendle’s invariant is as follows:
Below is a fictional example of wstETH tokenization with a 4% constant yield (January-December):
|
Jan 1st |
Jun 1st |
Dec 31st |
| wstETH price |
1.1 ETH |
1.122 ETH |
1.144 ETH |
| PT price |
0.96 ETH |
0.98 ETH |
1 ETH |
| YT price |
0.04 ETH |
0.02 ETH |
0 ETH |
| Generated yield |
0 ETH |
0.02 ETH |
0.04 ETH |
Pendle Pool AMM
Through its AMM implementation, Pendle utilizes a single liquidity source for PT/YT tokens. After evaluating various AMM designs for yield-tokenization, Pendle adopted Notional’s AMM for its capital efficiency. The AMM employs two key parameters:
- rateAnchor: Determines the equilibrium point for optimal capital efficiency. In Pendle’s implementation, this parameter is time-dependent and should align with the underlying asset’s expected yield at maturity.
- rateScalar: Controls the liquidity range and should correspond to the underlying asset’s expected yield bounds.
The Notional AMM defines the asset price $p_t(asset)$ relative to the principal price $p_t(principal)$ at time $t$ through:
Where:
- $rateAnchor(t)$ represents the optimal trading price at time $t$, matching accumulated yield from inception
- $rateScalar(t)$ is derived from the fixed $scalarRoot$ parameter:
The AMM’s logit curve exhibits extreme slopes at the liquidity range boundaries, resulting in infinite price impacts at the edges. Pendle configures $scalarRoot$ to map the expected minimum and maximum asset yields to the 0.1-0.9 liquidity range to address this. The exact math needed to estimate the AMM parameters for a given underlying asset can be found in this research paper on the Pendle AMM design.
1.3 Tokenomics
Pendle tokenomics is built around its native $PENDLE token, which functions as the protocol’s core utility asset. A vote-escrowed model, vePENDLE, offers participants enhanced voting power while unlocking premium benefits such as amplified yield opportunities and preferential fee structures.
Source: Pendle documentation, January 8th, 2025
A milestone in Pendle’s token distribution timeline was reached in September 2024, marking the complete vesting of all team and investor allocations. The protocol maintains a calibrated emission schedule, distributing 216,076 tokens weekly as of September 2024. Following a model of a 1.1% weekly decrease until April 2026, the protocol will transition to a terminal inflation rate of 2% annually.
The following addresses are excluded from circulating supply calculations:
PENDLE emissions incentivize liquidity providers in Pendle pools, guaranteeing that PT and YT tokens are always tradable against their underlying tokens. A 3% fee is taken from the yield accrued by YT tokens, 100% of which is directed to vePENDLE holders. In addition, 80% of the swap fee collected by voted pools is distributed proportionately to vePENDLE holders. The protocol also implements a multiplier system that can boost LP rewards by up to 2.5x, with the exact enhancement factor determined by the vePENDLE holders relative to their share in the liquidity pool.
1.3.1 Token Holder Concentration
N/A (asset dependant)
2. Market Risk
2.1 Liquidity
2.1.1 Liquidity Venue Concentration
Each PT token and maturity date combination has its own liquidity pool within Pendle. Pendle pools are ephemeral in that they only last from the beginning of the tokenization period up to their maturity date. Here are the 3 active tokenization periods for sUSDe and their corresponding liquidity pools:
2.1.2 DEX LP Concentration
Source: Etherscan, January 8th, 2025
Here are the top-5 liquidity providers in the PT-sUSDe May 29, 2025 liquidity pool:
- EOA with 28.94% of the liquidity
- SafeProxy contract with 10.25% of the liquidity
- EOA with 7.32% of the liquidity
- EOA with 5.70% of the liquidity
- EOA with 4.89% of the liquidity
Although the biggest liquidity provider provides 28.94% of the liquidity, there are numerous medium to small liquidity providers, which reduces liquidity concentration risks.
2.2 Volatility
PT token prices are correlated to their base asset. The constant ability to trade PT and YT tokens for their underlying in Pendle pools offers profitable arbitrage opportunities that maintain this correlation through time. In addition, depending on changes in expected yield for the underlying, the market will adjust the PT token price to reflect the change in implied expected yield. For instance, a decrease in the expected yield will be reflected in a reduction in the PT token price and an increase in the YT token price, and conversely, if the yield is expected to decrease.
2.3 Exchanges
No CEX currently supports PT tokens, nor is any expected to support them in the future due to the ephemeral nature of each tokenization period.
2.4 Growth
Pendle launched in June 2021 and grew to reach $230m TVL by the end of 2023. The protocol then experienced significant growth, reaching a peak of $6.5b TVL in June 2024. Since then, Pendle’s TVL has strongly correlated with overall market sentiment.
Source: DefiLlama.com, January 8th, 2025
Currently, sUSDe tokenization periods represent 50.15% of the protocol’s TVL, followed by WBTC at 16.79% and USD0++ at 11.02%. The high proportion of sUSDe can be attributed to its high and volatile yield from Ethena, which increases demand for Pendle’s yield-tokenization services.
Source: DefiLlama.com, January 8th, 2025
3. Technological Risk
3.1 Smart Contract Risk
Yield-tokenization of an underlying yield-generating asset brings an additional layer of smart contract risks on top of the existing ones. For instance, in the case of wstETH, Pendle would be the second layer of smart contracts. Pendle has been audited by 2 auditing firms, which overall outlined professional security practices from the Pendle engineering team. ChainSecurity (August 15, 2024) found 2 medium security findings and 9 low-security findings, with no critical or high-security findings. Spearbit (July 26, 2024) found 1 high-security, 2 medium-security, and 5 low-security findings, with no critical security findings.
Several established Code4Arena auditors have audited the protocol. All audit reports are available on Github.
3.2 Bug Bounty Program and Incident Response
A $250k bug bounty is also available on Immunefi, which, given the $5b TVL of the protocol, could benefit from increasing. On September 4, 2024, the Pendle team detected a suspicious contract funded via TornadoCash interacting with Pendle. The breach occurred in Penpie, an external protocol built on top of Pendle. Acting swiftly, the team paused all contracts and safeguarded ~$105M from further loss. A detailed post-mortem highlights their exemplary security practices and incident response.
3.3 Price Feed Risk
We analyzed two approaches for pricing PT tokens in Aave: a conservative method using the discounted base asset price and a dynamic method using Pendle pools’ TWAP oracle.
Option 1 - Linearly Increasing Lower Bound Method
At the tokenization start, the market-estimated yield is reflected in two ways:
- PT tokens trade at a discount to the base asset price
- YT tokens are priced at this discount
As time progresses, the PT token price asymptotically approaches the base asset price while the YT price approaches zero. Given the positive yield assumption on yield-bearing assets, the PT price is guaranteed to increase over time and ultimately equal or exceed its initial price.
Since Pendle AMM is the only liquidity source for a given asset/maturity date, an Aave liquidator has two options:
- Sell PT tokens pre-maturity for base asset (with potential slippage but flash loan capability)
- Hold until maturity for guaranteed base asset redemption (no flash loans, opportunity cost)
Since scenario 2 is likely undesirable for liquidators due to the opportunity cost of capital lockup, we can implement pricing constraints to make scenario 1 viable. The Pendle AMM concentrates liquidity within an expected yield range, allowing us to calculate a safe lower-bound price.
Mathematically:
- Let $p_t(PT)$ be PT price at time $t$ in base asset terms
- Let $maxYield$ be the maximum expected yield at maturity
- Then: $p_t(PT) \geq 1 - maxYield$
Red is the PT token price with a 4% expected yield upon maturity, and Black is the lower bound using an expected maximum yield of 8%
We can improve this static bound with a dynamic approach that increases linearly over time:
Red is the PT token price with a 4% expected yield upon maturity, Black is linearly increasing lower bound at $p=0.92$ using an expected maximum yield of 8%
To account for increased volatility near maturity, we can add a 5% safety margin:
Red is the PT token price with a 4% expected yield upon maturity, and Blue is linearly increasing lower bound using an expected maximum yield of 8% and 5% margin of safety applied to the maximum expected yield upon maturity
Example using wstETH (max yield 8%, realized 4%):
|
Jan 1st |
Jun 1st |
Dec 31st |
| wstETH price |
1.1 ETH |
1.122 ETH |
1.144 ETH |
| PT price |
0.96 ETH |
0.98 ETH |
1 ETH |
| YT price |
0.04 ETH |
0.02 ETH |
0 ETH |
| Generated yield |
0 ETH |
0.02 ETH |
0.04 ETH |
| Constant bound |
0.92 ETH |
0.92 ETH |
0.92 ETH |
| Linear bound |
0.92 ETH |
0.96 ETH |
1 ETH |
| Safe linear bound |
0.92 ETH |
0.958 ETH |
0.996 ETH |
This provides a conservative yet capital-efficient pricing method. The fixed lower bound offers maximum safety but reduced efficiency, while the linear bound optimizes efficiency but requires consideration of near-maturity volatility.
Option 2 - Pendle Pool TWAP Oracle
Pendle Pools provides an on-chain pricing mechanism for PT tokens through a built-in price oracle inspired by UniswapV3’s pool design. The system achieves capital efficiency by concentrating liquidity within ranges closer to expected trading prices. When users provide liquidity to Pendle pools, it is automatically distributed across a range corresponding to the expected minimum and maximum yield of the underlying asset at maturity. Pendle pools maintain a priceCumulative array that enables efficient on-chain computation of average prices up to 9 days prior, sufficient for providing outlier-resistant price feeds.
The cumulative price mechanism works as follows:
Let $p_i$ be the asset price at time $i$, and $log_{1.0001}(p)$ be the logarithm of price with base $1.0001$ (corresponding to 1 basis point spacing between ticks). The implementation accounts for varying tick durations, while we assume uniform tick duration for simplicity.
The priceCumulative value at time $t$ is:
The Time Weighted Average Price (TWAP) between times $t_1$ and $t_2$ can be computed efficiently on-chain:
As demonstrated in the UniswapV3 whitepaper, this TWAP calculation produces the geometric mean of prices over the interval.
UniswapV3 TWAP Oracle Design. Source: UniswapV3 blog, March 23, 2021
Aave could utilize this dynamic on-chain oracle for PT pricing to capture both time-based value appreciation and real-time market dynamics while maintaining high capital efficiency and ensuring trustless price discovery. However, this approach may expose borrowers to increased volatility during market turbulence or low liquidity conditions, requiring careful monitoring of pool depth.
While built-in TWAP oracles are typically not used as primary price sources for lending platforms due to manipulation risks, they are particularly suitable for PT tokens. Since Pendle pools are the exclusive liquidity source for these tokens, their built-in TWAP oracle provides the most direct and trustless price feed available. The mechanism is fully on-chain and transparent, with historical data readily available for the past 9 days. It is uniquely qualified as a reliable price source for PT tokens in Aave’s lending markets.
Comparison with other protocols
As a point of comparison, here is how other lending protocols are pricing PT tokens:
|
Method |
Safety mechanism |
| Moonwell |
Linearly increasing lower bound |
Hardcoded discount |
| ZeroLend |
Built-in TWAP Oracle |
Upper/Lower limit |
| SiloFinance |
Built-in TWAP Oracle |
None |
| Morpho |
Linearly increasing lower bound |
Hardcoded discount |
Both Morpho and Moonwell are using the PendleSparkLinearDiscountOracle contract developed by Pendle, which implements a linearly increasing lower bound where the discount is hard coded.
3.4 Dependency Risk
Pendle pool parameters
Optimal parameter selection for Pendle pools is critical for maintaining capital efficiency. Efficiency deteriorates significantly at the liquidity curve edges, potentially preventing trading altogether. Incorrect ranges for minimal and maximum expected yield at maturity pose a direct risk by potentially blocking profitable liquidations in Aave.
Two critical mitigation strategies ensure continuous liquidation functionality:
- Pendle’s AMM limit order book enables trading beyond pool price ranges, crucially maintaining liquidation capability for Aave’s risk management
- The protocol can deploy new pools with optimized parameters, allowing liquidity migration from suboptimal pools. This solution relies on active protocol management by the Pendle team
Loss of principal from underlying
While underlying yields are typically positive, negative yields resulting in principal loss remain possible. These tail-end risks, already present in Aave’s base asset markets, can materialize through:
- Smart contract vulnerabilities in Pendle, partially mitigated by external audits and a $250,000 bug bounty program
- Smart contract vulnerabilities in underlying protocols (Lido, Ethena)
- Oracle exploits, though the risk is limited due to the recommended PT pricing mechanism using Pendle pool parameters alongside existing Oracle infrastructure
Pendle values PT and YT tokens using the underlying protocol’s internal exchange rate. For sUSDe, a USDe depeg from USD wouldn’t affect protocol operations, as the sUSDe/USDe exchange rate remains stable - users would only realize dollar losses when converting redeemed USDe. However, for LSTs like wstETH, slashing events would affect the wstETH/ETH exchange rate, reducing both the PT token and YT token redemption value at maturity.
4. Counterparty Risk
4.1 Governance and Regulatory Risk
Governance
The Pendle governance is partly decentralized through vePENDLE, a vote-escrowed token. Through a dynamic locking mechanism, PENDLE token holders can commit their tokens for up to two years to receive vePENDLE, incorporating a decay function over time. This time-weighted voting power model creates an incentive structure, encouraging participants to actively manage their positions by extending their lock periods or increasing their positions to maintain influence. vePENDLE holders can vote to direct liquidity incentives to specific pools. This voting power is complemented by a revenue-sharing model that rewards active participation in protocol governance.
Source: vePENDLE dashboard, January 8th, 2025
A significant proportion of the circulating supply is being locked for vePENDLE rewards. Additionally, the average lock duration of over a year signals a long-term commitment from token holders.
Legal
The Pendle team retains significant control over the protocol, with no publicly disclosed plan for this to change. The assets to onboard, the tokenization periods, and the pool’s parameters are all decisions the development team makes in a centralized manner. The use of partly immutable contracts somewhat alleviates that issue.
While the Terms of Use do not explicitly identify the operating entity, an examination of the governing law provisions suggests that the entity managing https://www.pendle.finance/ and its associated applications is domiciled in the British Virgin Islands (BVI), as evidenced by the choice of BVI law as the governing jurisdiction. A noteworthy jurisdictional nuance emerges in the dispute resolution provisions, where Singapore is designated as the arbitration venue, creating an interesting divergence from the BVI governing law clause.
The structural similarities between Pendle’s PT tokens and traditional zero-coupon bonds necessitate a thorough legal analysis within the regulatory framework that can be attributed to Pendle’s operations. In this context, the Pendle team has procured a legal opinion from a Singapore law firm in 2023, addressing the regulatory status under two key pieces of legislation: the Securities and Futures Act and the Payment Services Act. The opinion provides valuable insights regarding the potential exemption status of the Pendle Earn interface from the Monetary Authority of Singapore (MAS) licensing requirements.
The legal analysis conclusively determines that PTs fall outside several regulated categories. Specifically, they do not meet the statutory definition of “securities”, cannot be classified as units in a “collective investment scheme”, fall outside the scope of “spot foreign exchange for leveraged foreign exchange trading,” and cannot be prescribed as “capital market products”. Moreover, the opinion presents compelling arguments against classifying PTs as derivatives contracts.
The professional determination that PTs do not constitute capital markets products under Singapore law provides a sound foundation for the current asset onboarding procedure. It is prudent to note that this conclusion remains valid until circumstances necessitate a fresh legal examination or regulatory changes warrant a reassessment.
4.2 Access Control Risk
The following contracts are deployed when a new tokenization period is created for an asset in Pendle:
The PendleGovernanceProxy contract, deployed behind a ERC1967Proxy contract, has two roles:
- the guardian role is assigned to an EOA wallet.
- the admin role is assigned to to a 2/4 Safe multisig.
The admin and the guardian can pause all listed contracts (including the PendleSY contracts) in a single transaction. Only the admin can upgrade the PendleGovernanceProxy contract.
4.2.1 Contract Modification Options
Two contract modifying functions are available:
- pause() and unpause() in the PendleMarketV3 contract, accessible to the guardian and admin roles.
- updateSupplyCap in the PendleSY contract, only accessible to the guardian and admin roles.
4.2.2 Timelock Duration and Function
No Timelock is currently present in the architecture, although this absence is mitigated by the almost immutable nature of the deployed contracts. The PendleGovernanceProxy contract can be upgraded immediately, and the trading of PT tokens can be paused instantly.
4.2.3 Multisig Threshold / Signer identity
The admin role, which can pause PT/YT/SY trading and upgrade the PendleGovernanceProxy contract, is assigned to a 2/4 Safe multisig with signers:
Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.
While we do not recommend immediate onboarding of PT-sUSDe-29MAY2025, we use this asset as a starting point to present our thoughts on parameterizing PT tokens on Aave.
We recommend using the linearly increasing lower bound method with a 10% margin of safety at maturity.
This review was independently prepared by LlamaRisk, a community-led non-profit decentralized organization funded in part by the Aave DAO. LlamaRisk serves as a member of Ethena’s risk committee.
The information provided should not be construed as legal, financial, tax, or professional advice.
