🚨 GoldPesa.com - Loss $114K (2026-10-02)

Network: Base
Type: Logic Error

GoldPesa's Uniswap v4 hook (GPXHooks) rebalances its protocol-owned GPX/USDC liquidity inside beforeSwap, and any swap can trigger it once an hour has passed since the last rebalance. reBalance() calls PositionManager.modifyLiquiditiesWithoutUnlock with BURN_POSITION + TAKE_PAIR. TAKE_PAIR collects the PositionManager's full net credit, and that delta is shared by every caller in the same PoolManager unlock.

The attacker borrowed 175K USDC from Morpho. Inside its own unlock, it minted a WETH/USDC position through the PositionManager and never paid for it, leaving roughly 115K USDC of debt on the PositionManager. It then swapped on the GPX pool to trigger the rebalance. The hook burned its position for 148.9K USDC, but TAKE_PAIR netted that against the attacker's debt, so the hook received only 33.9K. In effect the hook paid for the attacker's position. The attacker burned that position for 115K USDC, repaid the loan and swapped the profit to USDT. The stolen USDT was bridged to Solana and then to BSC to hide traces.

TX: https://basescan.org/tx/0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9
Attacker: https://basescan.org/address/0x4a5fd2e9357cc87df4cd6a1808174dbc8646899f
Laundered to: https://bscscan.com/address/0xE38e9bb74b8f1eE322f6F07CebbA283C838E6fBF
Vulnerable GPXHooks: https://basescan.org/address/0x4519e2b040ff1b64fa03abe2aef0bc99d7cceaa8
X: https://x.com/Goldpesatoken

@defimon_subscription_bot