CrowdRingCircle exploit analysis

CrowdRingCircle (CRC) was a BNB Chain token whose ERC20 _update override carried a "sell destroy" branch. When CRC was transferred to any registered DEX pair from a non-exempt, non-blacklisted sender, while a sellDestroyEnabled flag was on, the contract called _safeDeductBalance(to, amount) to compute a burn quantity, called super._update(to, address(0), burnAmount) to burn that CRC straight out of the pair, and then called IUniswapV2Pair(to).sync() to push the now-collapsed reserves to the AMM. A fresh attacker passed both default-open checks. There was no owner gate, no signature check, no cooldown, and no cap on the per-call burn.

The attack ran the public user path against the CRC/USDT PancakeSwap pair, whose pre-attack reserves at the fork block were 209,061.632268 USDT against 35,903,344 CRC. First, the attacker's contract bought about 35.86 million CRC out of the pair, taking the pair's CRC balance down to 40,629.6 CRC. Second, it sold 45,144 CRC into the pair. The 10% sell fee netted exactly 40,629.6 CRC back to the pair, and the sell-destroy branch then burned the lot and synced. The pair's CRC reserve fell to zero. Third, the attacker contract transferred 40,629.6 CRC to the pair and called swap directly on the pair, walking out with the entire USDT side.

DeFiHackLabs records the loss as approximately 201.36K USDT, the EOA's net after the 7,702 USDT (3.7%) the real transaction paid in Moolah-vault flash-loan and Venus/Aave borrow fees that funded the working capital. The full 209,061.632268 USDT the pair held was the gross drain; the realised USDT to the attacker was 201,359.472267. The PoC, which funds the attacker with deal() rather than flash loans, realises the full 209,061.63 USDT as profit and targets the on-chain net with a tolerance that covers the documented financing gap.

What would have prevented it: a sellDestroyEnabled flag that defaults to off, a per-pair cap on CRC burnable per call or per block, an exempt list that defaults to closed, or a sync() that re-reads and rejects an obviously collapsed reserve. The cleanest fix is removing the branch from the ERC20 hook entirely and putting any sell-side tax logic in a router-aware external contract that pairs the burn with the realised USDT.

CrowdRingCircle ran on BNB Chain. The exploit transaction is at block 110,301,524, from 0x34579eA92a07a88F5505dFaA4D99Ab94b2784087, contract creation (one-shot attacker). The verified CRC token is at 0x8581433150F2c48fF2eFE5A22B17C7d405054509; the victim LP is 0xd8799A644850c065388c22DF4eE0C28472922526. The DeFiHackLabs entry for the crowdringcircle anchor is dated 16 July 2026 but has been renamed: the original feed record's headline described a generic "burn from pair, sync" reserve manipulation, while the current README entry names the specific sell-destroy branch in the verified source. This post is written against the current entry.