BlockSec: TENDRIL/USDT liquidity pool on BNB Chain attacked, with losses of approximately $556,000

Odaily reports: BlockSec has posted that its system detected an attack on the TENDRIL/USDT liquidity pool on BNB Chain several hours ago, causing losses of approximately $556,000. The root cause of the attack lies in a security flaw in the token's sell tax logic: after the attacker used flash loan funds to buy TENDRIL, by triggering the 30% sell tax and the tax-processing contract (_poolControl), the tax tokens were sold, and the contract further called controlburn() and sync(), causing the TENDRIL reserve recorded by the liquidity pool to drop to nearly zero, while the seller's remaining tokens only entered the pool afterward, allowing the attacker to extract nearly all remaining USDT in the pool through subsequent swaps.

Specifically, the attacker used approximately 30.64 million USDT in flash loan funds to manipulate the pool's price and reserves, ultimately extracting approximately 4.42 million USDT from the liquidity pool, repaying the flash loan within the same transaction, and transferring approximately $308,960 in profit.