BlockSec Estimates About $556,000 Loss in TENDRIL Pool Attack

BlockSec attributed an attack on a TENDRIL/USDT liquidity pool on BNB Chain to a flaw in the token’s 30% sell-tax logic and estimated losses at about $556,000.

The attacker used flash-loan funds to buy TENDRIL and trigger the tax. During tax processing, the _poolControl contract sold tax tokens, then called controlburn() and sync(), leaving the pool’s recorded TENDRIL reserves near zero.

The attacker’s remaining TENDRIL then entered the pool. Later swaps extracted nearly all of the pool’s remaining USDT.