SlowMist has issued a security alert revealing that Pennysia's Ethereum Settlement contract was exploited, putting users' leftover authorized funds at risk. The attacker leveraged an arbitrary external call vulnerability in the contract to transfer tokens that users had previously approved but not yet used. The blockchain security firm urges all users who have granted token approvals to the Pennysia Settlement contract to revoke their permissions immediately to prevent further unauthorized transfers.