-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0313
============================================================

Advisory-ID:  0xCERT-2026-0313
Severity:     Medium
Published:    2026-11-05T07:03:21.000Z
Updated:      2026-11-05T12:45:00.671Z
Chains:       BNB Chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0313

Title: TENDRIL token on BNB Chain: sell-hook flaw lets attacker drain USDT from TENDRIL/USDT pool, about $309K-$555K lost

Summary
- -------
A flaw in the TENDRIL token's sell hook on BNB Chain let an attacker drain almost all USDT from the TENDRIL/USDT pool on 5 Nov 2026. CertiK Alert estimates about $555K net loss; TenArmor first estimated about $309K. Avoid interacting with the TENDRIL/USDT pool and the TENDRIL token.

Details
- -------
Summary
On 5 November 2026 the TENDRIL/USDT pool on BNB Chain was exploited. CertiK Alert reports that TENDRIL's sell hook let sellers debit the pair's token balance and sync reserves before the remaining sell input arrived; the delayed input then withdrew nearly all USDT from the pool. TenArmor Alert independently detected the same attack transaction.

Affected
- - TENDRIL token (BNB Chain) and its TENDRIL/USDT liquidity pool
- - No fix available at time of publication

Impact
An attacker drained nearly all USDT liquidity from the TENDRIL/USDT pool. Exploitation in the wild is confirmed. Loss estimates differ between sources: CertiK Alert puts the net loss at about $555K, while TenArmor Alert's initial estimate was about $309K. Neither source has named the attacker address at the time of publication.

Recommended actions
- - Do not buy, sell, or provide liquidity to TENDRIL or the TENDRIL/USDT pool until the project publishes a post-mortem and remediation.
- - Token developers: sell hooks or burn logic that touch pair balances must not update balances or call sync() before the incoming transfer completes.
- - Monitor the exploit transaction listed below for movement of stolen funds.

Source & attribution
This 0xCERT advisory summarises alerts by CertiK Alert (https://x.com/CertiKAlert/status/2118242639212658985) and TenArmor Alert (https://x.com/TenArmorAlert/status/2118237717574390001), both citing the same exploit transaction. Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/CertiKAlert/status/2118242639212658985
- - https://x.com/TenArmorAlert/status/2118237717574390001
- - https://bscscan.com/tx/0xfdff4fba4327821c204af07944076ecaaee163a994398fdf4063d08712e40059
- - https://www.techflowpost.com/newsletter/143117

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrsonsJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmft8DltQr4zdKT37iALlQm3LToURmkWqY8G7ISS
5jAvghYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACQRwEA3oqtC7AyADAevnbF
FIk3RON+P6GHLp8XOmudGyg0wOsA/3+j7PwcZqnAXuiinAP0LkyZiM0xDAOV
YFcuC7yqyuoC
=KIMc
-----END PGP SIGNATURE-----