TENDRIL Sell-Hook Reserve Drain

On November 5, 2026, the TENDRIL token's liquidity pool on BNB Chain was exploited for approximately $555,000 in USDT. A flaw in the token's custom sell hook let an attacker manipulate the pool's reserve accounting and withdraw nearly all of the paired stablecoin. Security monitors ExVul and ScaleBit flagged the attack the same day, publishing the vulnerable contract, the pair address and the attacking transactions.

What happened

TENDRIL traded against USDT in a PancakeSwap V2 pool. The token embedded custom logic that ran on every sale through a PoolControl.sellToken path, paired with a controlled burn operation. By burning tokens from the trading pair, the attacker could deduct the pair's TENDRIL balance and force a reserve sync before the rest of the sell input settled. With the pool's reserves desynchronised, TENDRIL was momentarily priced far higher relative to USDT, and the delayed input then pulled almost all the USDT out of the pool. During the exploit the attacker also routed a fixed 30,000 USDT to a hardcoded beneficiary address baked into the contract. Early estimates ranged from about $309,000 (TenArmor) to roughly $550,000–$555,000 once net losses were tallied.

Aftermath

No funds were recovered at the time of writing, and the team issued no public remediation statement. The attacker's USDT was withdrawn from the pool and moved on-chain.

Why it matters

TENDRIL is the latest in a steady run of custom-token-logic drains on PancakeSwap, where a bespoke transfer, tax or burn hook lets an attacker desync the pool's reserves and siphon the stablecoin side. It is nearly identical in shape to DIP Token — a missing return let that attacker skim/sync a PancakeSwap pool — and to the NemTokenV2 reserve-skim drain weeks earlier, both on BNB Chain. The underlying lesson traces back to Spartan Protocol: any token that manipulates its own balances around an AMM's sync invites reserve-accounting abuse. Unaudited sell hooks remain live attack surface, and the sub-$1M losses they produce rarely come back.