CrowdRingCircle Hack: $201K Drained from CRC/USDT Pool

The attacker used borrowed liquidity obtained within a single transaction. This mechanism allows a large amount of capital to be temporarily borrowed without collateral, used to execute several operations, and repaid before the transaction is completed.

A flash loan is not a vulnerability by itself. It simply provided the attacker with enough capital to exploit the flaw in the CRC contract multiple times.

The target was the CRC/USDT pair on PancakeSwap V2.

Under normal circumstances, when a user sells CRC, they send CRC to the pool and receive USDT in return. The balances of both tokens change, and the price is automatically recalculated based on the ratio between the reserves.

However, the CRC contract contained non-standard logic that was triggered when tokens were transferred to the trading pair address.

When CRC was transferred to the pair, the contract did more than process a regular sale. It also reduced the amount of CRC held in the pool’s own balance.

In other words, the attacker could initiate an operation that caused tokens to be destroyed not only from the sender’s balance, but also directly from the CRC/USDT reserve.

This was the core vulnerability: an external user was able to affect assets belonging to the liquidity providers.

After the CRC balance was reduced, the contract called the trading pair’s sync() function.

This function updates the pool’s internal reserve data to match the actual token balances. As a result, the reduced CRC balance was recorded as the new reserve.

The USDT reserve remained almost unchanged, while the CRC reserve became significantly smaller. Consequently, the pool’s pricing algorithm began to calculate a much higher value for each CRC token.

For example, if the pool contained 200,000 USDT and 40 million CRC, the price would be approximately $0.005 per CRC. If the CRC reserve were artificially reduced to 1 million tokens while the USDT reserve remained unchanged, the calculated price would increase to approximately $0.20.

The token’s real value did not increase. Only the internal reserve ratio within that specific pool was altered.

The attacker repeatedly triggered the vulnerable logic:

• CRC was sent to the trading pair address;
• the contract deducted part of the CRC from the pool’s balance;
• the sync() function recorded the reduced reserve;
• the calculated price of CRC increased further.

After several such cycles, the price of CRC within the pool became significantly inflated.

Once the reserves had been sufficiently distorted, the attacker swapped CRC for USDT.

Because of the manipulation, the pool treated CRC as a highly valuable asset. As a result, a relatively small amount of CRC was sufficient to withdraw a significant portion of the USDT held in reserve.

In effect, the pool released real stablecoins at a price created through the artificial reduction of the CRC reserve.

All actions were performed within a single atomic transaction. After withdrawing the USDT, the attacker repaid the temporarily borrowed liquidity and covered the transaction fees.

The remaining difference became the attacker’s profit. According to public estimates, the losses amounted to approximately $201.4K.

After the attack, almost no USDT remained in the pool, and its reserves were severely disrupted. The primary losses were borne by the CRC/USDT liquidity providers whose funds were held in the trading pair.