# CrowdRingCircle: sell-destroy burns pair reserve, drains USDT pool

CrowdRingCircle's sell-destroy branch burns the DEX pair's CRC reserve on any sell, collapsing the pool so a follow-up swap drains ~201K USDT.

- Payout: Real-world hack
- Severity: critical
- Program: CrowdRingCircle
- Credited: DeFiHackLabs
- Disclosed: 2026-07-16
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-10/CrowdRingCircle_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260716-crowdringcircle
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** CRC/USDT PancakeSwap v2 pair on BNB Chain
**Root cause:** CRC's ERC20 _update override burns CRC out of any registered DEX pair on a transfer to that pair from a non-exempt sender, then calls sync(), letting any seller collapse the pair's CRC reserve.
**Steps:**
1. Buy ~35.86M CRC from the pair via `swapTokensForExactTokens`, leaving ~40,629.6 CRC and inflating USDT reserve.
2. Sell 45,144 CRC via `swapExactTokensForTokensSupportingFeeOnTransferTokens`; the 10% fee nets 40,629.6 CRC to the pair, which the sell-destroy branch burns entirely and syncs CRC reserve to ~0.
3. Transfer 40,629.6 CRC to the pair and call `swap` directly to extract ~185.2M USDT against the collapsed reserve.
**How found:** Source review of the verified CRC _update override revealed a permissionless sell-destroy branch that burns the pair's own balance and syncs reserves, with no owner gate, cooldown, or max-sell limiter.
**Exploitation:** Attacker flash-borrowed working capital (Moolah vault + Venus/Aave), bought most CRC out of the pair, triggered the sell-destroy burn to zero the pair's CRC reserve, then swapped a small amount of CRC for the pool's USDT, netting ~201K USDT after ~7.7K financing fees.
**Insight:** When a token's transfer hook calls sync() after burning from the pair, check whether any non-exempt sender can trigger it; a small sell can zero one reserve and let a direct swap drain the other.