Crypto DAO Pro Token Vault — Missing Access Control Drain

T0 — July 28, 2026: The attacker (0x427671b2C8e91034A91FE698F9B7259b2345F45D) begins calling a publicly accessible, state-changing vault function on the Crypto DAO Pro token contract (0xf00bC28D...6D77850ac) — labeled natively by BscScan as 'Attack'. Reconstruction from on-chain event logs of the first traced transaction (0x9979306d4dbec70770f0e7b8882bd717ac743a693c9f8116e30ce9326b3de67b, block 112653699): the PancakeSwap V2 pool 'Pro-CDAO' sends 56,792.41 Pro tokens to the vault; the vault forwards a small portion (1,419.81 Pro) to a fee/team address (0x543302E9...B66050832) and the remainder (55,372.60 Pro) to the main BSC-USD-Pro 17 pool, which in exchange returns a disproportionate 3,001,693.69 USDT (~$2,998,598.94) — a heavily imbalanced swap reflecting reserve manipulation. A helper contract (0xc44f2acC...f52a04A3C) then repeats this small-Pro-for-large-USDT pattern in a tight loop (hundreds of near-identical iterations visible in the event logs), sending 1.25 Pro to the fee address and 48.75 Pro to the pool each time, extracting a slightly decreasing amount of USDT (~2,455 down to ~2,365 USDT per iteration) as the pool's reserves are progressively drained — a mechanism closely resembling the reserve-manipulation pattern later seen in the July 28 LULA token exploit on the same chain. This single transaction concludes with the vault forwarding its accumulated balance to the pool (~2,990,824.87 USDT) and sending 10,868.81 USDT (~$10,857.61) directly to the attacker. The attacker repeats the overall 'Attack' call at least 12 times total (confirmed via the attacker's transaction history), accumulating the full $8.2 million loss. July 28, 2026: Blockaid flags the ongoing exploit publicly, noting ~$8.2M USDT was 'currently held by the exploiter and winning addresses' — later analysis by The Merkle clarifies this cluster of addresses appears to have 'won early from the attack, whether through front-running the exploit transaction or simply being positioned to benefit from the chaos that followed,' suggesting these are not confirmed co-conspirators. DeFiLlama logs the event the same day under 'Protocol Logic (Solidity).' As of reporting, @CryptoDAOGlobal has issued no statement, post-mortem, or acknowledgment of the incident, and no funds have been recovered.