Skip to content
Pendle logo

Pendle Review

Audit reports filed by component and a single published YT fee

of 10

Pendle scores 7.4 out of 10 in yield aggregators, led by audit reports mapped to each component, a flat 5% yield fee and a core licence whose GPL conversion date has passed. Upgradeable SY wrappers with no documented timelock hold back custody. Desk research of primary sources, checked November 6, 2026.

YT fee

5% of all yield and points accrued by YT

Swap fee

Fee tier / 365 x days to maturity; tier set per market

Core licence

BUSL-1.1, change date 2023-07-01 to GPL-2.0-or-later

Audit reports

Nine auditors, filed by component in pendle-core-v2-public

Admin control

Markets immutable; newer SY upgradeable, owned by pause controller

Custody wording

Terms (rev. Oct 1, 2026): self-directed and non-custodial basis

Scores

Fee disclosure
8.0
Licence & code openness
8.0
Audit disclosure
9.0
Custody & control
6.0
Strategy transparency
6.0

Each criterion carries equal weight. The overall score is the average of these 5 scores — (8.0 + 8.0 + 9.0 + 6.0 + 6.0) ÷ 5 = 7.4.

Pros

  • Audit disclosure 9: reports from nine auditors filed by component in the public core repository
  • Fee disclosure 8: flat 5% fee on YT yield and points, plus a published swap-fee formula and split
  • Licence 8: the BUSL-1.1 change date (July 1, 2023) has passed, granting GPL-2.0-or-later
  • Custody 6: terms state a non-custodial basis and market contracts are immutable once deployed

Cons

  • Custody 6: newer SY wrappers are upgradeable and go to Pendle's pause controller; no timelock documented
  • Strategy transparency 6: docs do not say whether the displayed underlying APY is net of the 5% YT fee
  • Each market's swap fee tier appears only in its specs panel, not in the docs
  • The docs security page names four audit sources, gives no dates and omits later reports

How Pendle scores in yield aggregators

Pendle sits in our yield aggregator ranking, although it does not compound rewards. It splits a yield-bearing token into a principal token (PT) and a yield token (YT) that trade on Pendle's own AMM, so a depositor can fix a rate or trade future yield. This entry rates Pendle V2 only. Boros, Pendle's separate funding-rate market, is not scored. The basis is desk research of Pendle's documentation, its terms of use and the pendle-core-v2-public GitHub repository, checked on November 6, 2026. No position was opened. The category uses five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.

CriterionWhat the sources showMark
Fee disclosureThe fees page states a 5% fee on all yield and points accrued by YT, and a swap fee of (fee tier / 365) x days to maturity. It also states the split of fee revenue and that unredeemed positions pass their yield to the treasury after maturity. The fee tier itself is set per market and shown only in each market's specs.8
Licence & code opennessThe core LICENSE file is Business Source License 1.1 with a change date of July 1, 2023, after which the licence grants GPL-2.0-or-later. Core contracts we sampled carry GPL-3.0-or-later SPDX headers. GitHub reports no recognised licence for the repository.8
Audit disclosureThe repository's audits folder holds reports filed by component: the main codebase (Ackee, ChainSecurity, CMichel, Dedaub, Dingbats, Spearbit, WatchPug, 0xleastwood), market V6 and V7 (HickupHH3, WatchPug), sPENDLE, the PT looping contracts and the oracles (WatchPug). The docs security page names only four sources and gives no dates.9
Custody & controlThe terms, revised October 1, 2026, say the protocol is used on a self-directed and non-custodial basis. Market contracts are immutable once deployed. Newer SY wrappers are upgradeable proxies whose ownership goes to Pendle's pause controller, and no timelock is documented on the pages read.6
Strategy transparencyThe mechanics of PT, YT, SY and the yield-range AMM are documented in detail, and each market names its underlying asset. The docs do not say whether the displayed underlying APY is before or after the 5% YT fee.6

The overall score is the plain average: (8 + 8 + 9 + 6 + 6) / 5 = 37 / 5 = 7.4. The previous overall was 6.0.

Three marks changed at this check. Licence & code openness rose from 5 to 8 because the BUSL change date in Pendle's own licence file has passed, so the file now grants GPL-2.0-or-later, and the contract files carry GPL headers. Audit disclosure rose from 8 to 9 after we read the audits folder, which maps reports from nine auditors to specific components. Custody & control rose from 3 to 6 because the current terms now state the non-custodial basis that the earlier review could not find.

Strongest criteria: audits, fees and the converted licence

Audit disclosure is the highest mark at 9. The mark stops short of 10 because the docs security page has not kept up. It names Ackee, Dedaub, Dingbats and Code4rena wardens, gives no dates, and does not list the later reports that sit in the folder it links to. An audit lowers risk; it does not remove it, and Pendle's FAQ says it is not responsible for losses from exploits in third-party contracts.

Fee disclosure scores 8. The 5% YT fee is a single published rate that covers points as well as yield. Of swap fees, 20% goes to liquidity providers; the remainder and all YT fees go 80% to PENDLE buybacks, 10% to the treasury and 10% to operations. What keeps the mark below the top is that the swap fee tier is a per-market setting read from the market's specs panel, not a figure in the docs.

The licence mark of 8 reflects a licence that has converted. Pendle's LICENSE file still opens with the BUSL notice that it "is not an Open Source license", but its own parameters set July 1, 2023 as the change date to GPL-2.0-or-later. The mark is not 10 because a reader has to apply that clause to reach the open-source grant, GitHub does not recognise the file, and the GPL-3.0 headers in the code do not match the GPL-2.0 change licence.

Weakest criteria: admin controls and the APY basis

Custody & control at 6 is a measured result, not a research gap. The non-custodial statement and immutable markets support it. Against that, the architecture docs say newer SY contracts are upgradeable so mechanisms can be adjusted without a market migration, and that external SY deployers should hand ownership to Pendle's pause controller. The terms add that Pendle may restrict access, including by blacklisting a wallet, and that the contracts are subject to modification. We found no published timelock or signer set for these powers. Peers that document a timelock or state that the team cannot reach deposits score higher here.

Strategy transparency at 6 reflects a gap in what is written. Pendle explains its mechanism well, but the FAQ describes the underlying APY only as a 7-day average of the underlying protocol and does not say whether the 5% YT fee is taken out of the displayed figure.

What the score does not cover

  • Implied and underlying APYs, TVL and returns, which move with each market.
  • The safety of the wrapped asset. PT and YT inherit every risk of the token underneath, and YT goes to zero at maturity.
  • Selling PT before maturity, which happens at the market's implied rate and may give a worse result than the rate locked in.
  • Boros, the PENDLE token and sPENDLE rewards.

Readers who lend against PT should also read our guide to how DeFi lending works, because leverage on PT adds liquidation risk.

Pendle vs Beefy and Idle Finance

CriterionPendleBeefyIdle Finance
Fee disclosure888
Licence & code openness885
Audit disclosure9109
Custody & control696
Strategy transparency676
Overall7.48.46.8

Beefy scores 8.4, a point ahead. It matches Pendle on fees and licence, both 8, and is ahead on custody, audits and strategy transparency. Idle Finance scores 6.8 and matches Pendle on four criteria; the difference is Pendle's converted licence. Peer marks are as currently published and may change when those entries are rechecked.

Who it suits

The score suits a user who wants to fix a yield or trade future yield, and who values audit reports filed by component and a single published YT fee. It suits less well anyone who wants a documented timelock on admin powers, or a stated basis for the APY on screen. Check the fee tier in a market's specs and the risks of the wrapped asset before entering.

How it compares

Sources

Scored from published primary sources rather than hands-on use. Every figure above comes from one of the pages below, on the date shown. Manufacturers change prices and specifications without notice — if something here no longer matches the source, tell us and we will correct it.

  1. 1.Pendle docs: Fees — checked
  2. 2.Pendle docs: Security (audits) — checked
  3. 3.Pendle docs: Terms of use (revised October 1, 2026) — checked
  4. 4.Pendle dev docs: High level architecture — checked
  5. 5.Pendle docs: FAQ — checked
  6. 6.GitHub: pendle-core-v2-public LICENSE (BUSL-1.1, change date 2023-07-01) — checked
  7. 7.GitHub: pendle-core-v2-public audits folder — checked
  8. 8.GitHub: PendleMarketV7.sol (GPL-3.0-or-later SPDX) — checked

Frequently asked questions

Why does Pendle score 7.4?

It is the plain average of five equally weighted marks: fee disclosure 8, licence 8, audit disclosure 9, custody 6 and strategy transparency 6. Well-filed audits and a published fee schedule are offset by admin powers over upgradeable SY contracts.

What holds Pendle's score back?

Custody and strategy transparency, both at 6. Newer SY wrappers can be upgraded and are owned by a pause controller, with no timelock on the pages we read. The docs also do not state whether the displayed underlying APY is net of the 5% YT fee.

Is Pendle's code open source now?

By the terms of its own licence file, yes. The core uses BUSL-1.1 with a change date of July 1, 2023, after which the code is available under GPL-2.0-or-later. The file still carries the BUSL wording, so the mark is 8 rather than 10.

What changed at the November 2026 check?

Licence rose from 5 to 8 on the passed change date, audit disclosure from 8 to 9 on the component-level audits folder, and custody from 3 to 6 on the non-custodial wording in the October 2026 terms. The overall moved from 6.0 to 7.4.

How does Pendle compare with Beefy and Idle Finance?

Pendle's 7.4 sits behind Beefy at 8.4 and ahead of Idle Finance at 6.8. Beefy matches Pendle on fees and licence and marks higher on custody, audits and strategy transparency; Idle matches Pendle on four criteria and trails on licence.

Who is Pendle suited to?

Users who want to fix a yield or trade future yield and are prepared to study each wrapped asset. It is less suited to depositors who want a hands-off vault or a documented timelock on admin powers.

Nothing here is financial advice. Editorial policy · How we score · How we're funded.