TENDRIL tax token exploited via flash loan and oracle manipulation on BNB Chain, draining ~$555K from the TENDRIL/USDT pool.
Security & Exploits ·
TENDRIL, a tax-bearing token on BNB Chain, suffered an exploit that drained approximately $555,000 from its USDT liquidity pool on November 4, 2026. An attacker executed a flash loan attack by borrowing roughly 30.6 million USDT from PancakeSwap's Infinity Vault, then used those funds to repeatedly swap into TENDRIL through the thin TENDRIL/USDT pair.
The attack exploited TENDRIL's 30% transfer tax mechanism combined with oracle manipulation. Each taxed transfer triggered an automatic liquidation function that dumped accumulated TENDRIL holdings into the pool at the spot price. By first skewing the pool's price through their initial swaps, the attacker artificially inflated the value at which the token's controller sold TENDRIL, draining the pair's USDT reserves. The flash loan was repaid from the same vault within the same transaction, allowing the attacker to execute the full cycle.
The pool lost approximately $555,000 in USDT while the attacker's receiving addresses collected roughly $541,000, indicating slippage and transaction costs. The specific mechanics of how the tax-token's auto-liquidation interacts with oracle-based pricing remain the core vulnerability, though it remains unclear whether the exploit exposed flaws in TENDRIL's design, PancakeSwap's vault security, or both.