TronCrush's transfer function did not validate that the 'to' and 'from' addresses must be different, allowing an attacker to create tokens without foundation through self-transfers. Over 20 smart contracts and dapps were vulnerable to this same pattern.

The transfer does not determine that to and from cannot be the same address, resulting in an attack that can create more than 15w TCC tokens without foundation.