Pendle
KLEAR3 ResearchPublished 2026-08-19Updated
ArbitrumBNB ChainOptimismBaseAvalanche
PENDLEPendle, a decentralised finance protocol that splits a yield-bearing token into its principal and its future yield so each can be traded separately, has been publishing code since December 2022. It takes 5% of the yield it handles, its team tokens finished unlocking in September 2024, and its licence is not what most directories claim.
How Pendle works
One deposit becomes two tokens, and a single date settles both: the capital climbs back to its full value, the yield token ends at nothing.
- 1You deposit an asset that already earns a yield.
- 2Pendle separates it into two tokens at a chosen maturity date.
- 3Each token trades on its own, at its own price.
What does Pendle actually do?
Pendle cuts a yield-bearing token in two, so the capital and the future income can be sold to different people. One receipt redeems the original deposit at a chosen date; the other collects whatever yield accrues until then. It is the split a bond market makes between a zero-coupon and its coupons, applied to on-chain deposits.
Someone who wants a known return buys the first receipt and ignores the rest; someone betting that rates will rise buys the second. Neither side needs the other to be wrong. They want different halves of the same deposit, and before this existed on-chain there was no way to hold one without the other.
That is worth spelling out, because it decides who this is for. If you buy the principal token you have fixed your rate: you know today what the deposit returns on the maturity date, and a rate rally afterwards is no longer yours. If you buy the yield token you own a claim that pays as long as rates hold and is worth nothing on the maturity date.
It is the closest thing on-chain to buying interest without buying the capital, and it expires.
The organisation names on its own repository a second product, Boros, for margin trading on yield. We have not examined it, so this page says nothing about it beyond its existence.
Source GitHub https://api.github.com/orgs/pendle-finance, read 2026-08-19
Is the code actually open?
It is published, and it is not open source. Those are two different things, and almost every directory we checked conflates them. Anyone can read the contracts; nobody has been granted the right to reuse them. For a reader deciding whether to build on top, that distinction decides everything, and one API call settles it.
The repository is readable by anyone. Its licence field returns NOASSERTION, which is not a licence — it is what GitHub reports when no recognised open-source licence is detected. That is not a permissive licence, and it is not a missing file either: it is GitHub saying it could not tell. Directories that print a green licence badge here are filling in a blank.
Source GitHub https://api.github.com/repos/pendle-finance/pendle-core-v2-public, read 2026-08-19
8 firms have published reports here, which is more than most protocols offer. We opened one of them, ChainSecurity's review of the V2 core, and it is the only thing on this page that says what an audit actually found: 0 critical, 0 high, 2 medium, both mediums corrected.
Here is what that does not tell you, and it matters more than the counts. The report stops at code dated 2023-11-25. Every commit since has been read by nobody outside the team. An audit is a photograph of a codebase on a day, taken by people with a fixed budget and a written scope.
What protects a protocol over time is not the stamp but the years it spends under pressure without losing money. Of the 9 low-severity findings, four were acknowledged and two accepted as risk rather than fixed.
Source GitHub https://api.github.com/repos/pendle-finance/pendle-core-v2-public/contents/audits, read 2026-08-19 · ChainSecurity .../audits/main codebase/ChainSecurity-2024/ChainSecurity.pdf, read 2026-08-20
Is anyone still working on it?
Yes, and modestly: 15 commits over 90 days from 4 distinct Git identities, the last on 2026-08-06. That is a maintained codebase rather than a busy one, which for a protocol holding deposits is arguably the better shape. The repository publishes no versioned releases at all.
So anyone claiming a given number of shipped versions this quarter is reading something other than the repository. The history lives in the commits, and that is where we counted it, one window at a time rather than from a summary. 4 identities are not 4 people: one contributor can sign with several, and several can share one.
Source GitHub https://api.github.com/repos/pendle-finance/pendle-core-v2-public/commits?since=2026-05-22T00:00:00Z, read 2026-08-20 · GitHub https://api.github.com/repos/pendle-finance/pendle-core-v2-public/releases?per_page=5, read 2026-08-19
- Core repository made public
- Start of the 90-day window we measured
- Most recent commit at the time of reading
- This page, checked and published
Where does it actually run?
On Ethereum, where we checked the token contract ourselves, and on a dozen other networks an aggregator lists. Deposits are not spread evenly across them: Ethereum holds the bulk, and the rest trail behind. Where a protocol runs decides what a transaction costs you and who has to stay online for it to keep working.
The practical consequence is the part directories skip. Each extra network is another bridge, another set of contracts, and another team keeping a node alive. A deposit on a small chain carries the risk of that chain on top of the risk of the protocol, and the cheaper the transaction the more likely that trade has been made.
We asked an Ethereum node directly whether the token address holds deployed bytecode; it does. The network count and the split of deposits come from DefiLlama, a specialised database we did not audit, and this page says so rather than passing it off as ours.
Source Ethereum https://ethereum-rpc.publicnode.com, read 2026-08-19 · DefiLlama https://api.llama.fi/protocol/pendle, read 2026-08-19 · DefiLlama https://api.llama.fi/protocol/pendle, read 2026-08-19
ArbitrumBNB ChainOptimismBaseAvalanche
Mantle
Sonic
Berachain
MonadX LayerPlasmaHyperliquid L1Each mark above was fetched from the project's own domain and stored with the address it came from, checked on 2026-08-20. Where a project publishes only a lockup, we crop it to its symbol by its viewBox and never redraw one. An approximate mark would be a forgery, and a forgery on a page about verification is worse than a blank.
What the token actually does
PENDLE pays for governance and captures a share of the fees. Locking it one-for-one into sPENDLE gives a vote, and the protocol routes most of what it collects into buying the token back. Team and investor allocations finished unlocking in September 2024, which removes the overhang a reader should worry about first.
The protocol takes 5% of all yield accrued by every yield token in existence, and 20% of swap fees go to liquidity providers. 80% of the fees collected go to buying PENDLE back. That is the whole business model in one line: the protocol earns when deposits earn, not when they move.
Source Pendle Docs https://docs.pendle.finance/pendle-v2/ProtocolMechanics/Mechanisms/Fees, read 2026-08-20
Supply is capped in practice rather than by decree. Weekly emissions were 216,076 PENDLE in September 2024 and fall 1.1% every week until 2026-04, after which the protocol settles at 2% a year forever. Total supply read on-chain is 281,527,448.459, of which 172,172,847.735 circulates.
Source Ethereum https://ethereum-rpc.publicnode.com, read 2026-08-20 · CoinGecko https://api.coingecko.com/api/v3/coins/pendle, read 2026-08-20 · Pendle Docs https://docs.pendle.finance/pendle-v2/ProtocolMechanics/Mechanisms/Tokenomics, read 2026-08-20
Governance runs through sPENDLE, at 1:1, with a 14-day exit or 5% immediately. Rewards require an actual vote, which is rarer than it sounds: most governance tokens pay holders for locking, not for deciding. The older vePENDLE mechanism is winding down, so anyone still holding it has a migration to make.
Source Pendle Docs https://docs.pendle.finance/pendle-v2/ProtocolMechanics/Mechanisms/sPENDLE, read 2026-08-20
- What PENDLE is used fordirectly verified
- Total and circulating supplydirectly verified
- Emissions and unlocksdirectly verified
- Distributiondirectly verified
- Governance rightsdirectly verified
- Which contract is the official tokenthird-party supported
KLEAR3 rating
- Open code3
public repository · 15 commits in 90 days
What holds it back licence unresolved: readable but not reusable · no published release
- Audits5
8 firms on the core · overlapping reviews · 7 audited scopes · report opened: 0 critical, 0 high, 2 medium · no critical or high finding
What holds it back 7 low findings not fully fixed · audit stops at 2023-11-25: the code has moved since
- Business model5
business model published by the protocol · paid by le détenteur de rendement et celui qui échange · collected by les fournisseurs de liquidité et les votants · 80 % des revenus servent à racheter du jeton
- Governance4
governed through sPENDLE · 14-day exit · rewards conditioned on actually voting
What holds it back older vePENDLE mechanism winding down: a migration to make
- Token alignment5
total supply read on-chain · circulating share known · emission schedule published · team and investors fully vested since 2024-09 · terminal inflation 2% a year
- Maturity5
3 years of public code · 1 network verified by us · 13 networks in total
We rate the protocol: how it is built, how much of it can be checked, how its token lines up. Never an investment. A high score is not advice to buy, and a low one is not advice to sell.
What we could not establish
Two things, and neither is incidental. Nobody is named as building Pendle anywhere we looked: no team page on the site, no public members on the GitHub organisation. And the address everyone calls the PENDLE token rests on an aggregator, because the project documentation page for it returns 404.
Anonymity is common in this field and it is not evidence of anything by itself. It does mean that if something goes wrong, there is no one to call and no jurisdiction to point at. The contract gap is smaller but stranger: the bytecode at that address is real and we read it, yet the project's own documentation does not confirm it is theirs.
Source GitHub https://api.github.com/orgs/pendle-finance, read 2026-08-19 · DefiLlama https://api.llama.fi/protocol/pendle, read 2026-08-19
Frequently asked questions
Does an audited protocol mean a safe protocol?
No, and the numbers show why. Eight firms have reports in the Pendle repository, which is more transparency than most protocols offer. We opened ChainSecurity’s: zero critical, zero high, two medium, both corrected. That is a good result and it establishes exactly one thing, that this code was examined on that date and those problems were fixed.
It stops at code from November 2023, and everything committed since has been read by nobody outside the team. Nine low-severity findings were closed by acknowledging them or accepting the risk rather than by changing anything.
An audit is a photograph taken by people with a fixed budget and a written scope. What protects a protocol is time under pressure with real money in it, which no report grants in advance.
One more thing the badge hides: the audits directory holds seven separate scopes, and the core codebase is only one of them. A clean report on one scope says nothing about the other six.
What do I get for holding PENDLE rather than depositing?
A vote and a share of the fees, on condition that you lock it. PENDLE on its own does nothing: you convert it one-for-one into sPENDLE, and that is what carries governance weight. Getting out takes fourteen days, or you leave immediately and keep five percent.
Rewards are conditioned on voting rather than on merely locking, which is unusual and worth knowing, because a passive holder collects nothing. Meanwhile eighty percent of collected fees go to buying the token back, so demand is tied to how much yield the protocol handles.
That buyback is the part worth watching over time: a quiet year shows up in the token first. The older vePENDLE mechanism still exists but is winding down, so a holder who locked under the previous system has a migration to make rather than a decision to postpone.
Is there a wall of team tokens waiting to be sold?
No, and it is the clearest good news on this page. The protocol documentation states that team and investor allocations finished vesting in 2024-09, which removes the overhang that sinks most tokens in their second and third year. What remains is emissions, and those are scheduled rather than discretionary: 216 076 PENDLE a week at that date, falling 1.1% every week until 2026-04, then a terminal rate of 2% a year.
Total supply read from the contract is 281 527 448, of which 172 172 848 circulates, a little under two thirds. Two caveats keep this honest: the circulating figure comes from CoinGecko rather than from the chain, and a schedule only binds while governance leaves it alone, which is precisely what governance is for.
The rest is not a cliff waiting to drop, it is the schedule above, arriving slowly and in public.
peak 13.08 bn$ (2025-09-22) · today 1.18 bn$ · value deposited in the protocol · DefiLlama GET https://api.llama.fi/protocol/pendle, read 2026-08-21
Where to read on, at the source — every address answered 200 on 2026-08-21.
Related: how a rollup works explains the networks listed above, our profile of Arweave reaches the opposite balance on a network that keeps everything on its own chain, and our methodology sets out what counts as a source here.
Ask an assistant to summarise it and check what it claims.