TENDRIL Tax Token: Burn-and-Sync Sell Hook Drained the USDT Pool

~$555K pool loss, per Defimon and CertiK; ~308.96K USDT attacker profit in the attack tx, per BlockSec Phalcon; ~$309K, per TenArmor. Phalcon later attributes most profit to TENDRIL bought cheaply in an attacker-created V3 pool.

Root cause: Per BlockSec Phalcon: "unsafe sell-tax logic that allowed the pool’s TENDRIL balance to be burned and its reserves synchronized before the seller’s remaining tokens entered the pool." Defimon frames it as spot-price manipulation of the tax auto-liquidation.

Timeline, as sourced: Defimon alert 5 Nov 06:29 UTC, dating the loss 4 Nov; TenArmor 07:03 UTC; CertiK 07:22 UTC; Phalcon 11:41 UTC, update 13:33 UTC.

Per BlockSec Phalcon (analysis (opens in a new tab)): on BNB Chain the attacker used ~30.64M USDT in flash-loan funds to buy TENDRIL and skew the pool. A sale triggered the token's 30% tax and its tax-handling contract, which sold the tax tokens, returned part of the USDT to the pair, then called controlburn() and sync() to cut the recorded TENDRIL reserve to nearly zero. The seller's remaining tokens then entered the pair, and the next swap extracted virtually all of the remaining 4.42M USDT reserve. The loan was repaid in the same transaction; ~308.96K USDT profit was transferred out.

Per BlockSec Phalcon (update (opens in a new tab)): most profit came from ~33.06B TENDRIL acquired for less than $10K through a liquidity position in an attacker-created V3 pool before the attack; the burn-sync step added only $10K+. Phalcon asks whether this was "A rug pull or phishing?" Unconfirmed.

Per CertiK (alert (opens in a new tab)): ~$555K net loss. Per Defimon (alert (opens in a new tab)): a Tornado-funded contract ran the attack; the pool lost ~555K USDT and attacker payout addresses received ~$541K. Defimon lists attacker 0xb81e4aafa347b27112b7f6f5de6cf7cd516021ff (opens in a new tab) and the tax controller 0xd00be871eb7a5cb8a69aea41e4c95affc92e54fe (opens in a new tab).

Unknown: who sold TENDRIL into the V3 pool and why; any statement from the token team.