On October 2, 2026, an attacker stole ~$115K from GoldPesa's GPXHooks
RootCause: The reBalance function's "USDC Donation Check" only verified excess USDC in the hook vs. Uniswap (if usdcInsideHook > usdcInsideUniswap) but ignored shortfalls; TAKE_PAIR action during modifyLiquiditiesWithoutUnlock shared deltas across callers, allowing the hook to receive far less (~$34K instead of ~$149K).
TX: https://basescan.org/tx/0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9…
Vulnerable hook (GPXHooks): https://basescan.org/address/0x4519e2b040ff1b64fa03abe2aef0bc99d7cceaa8#code…
@EthSecurity1
Post #113475
37
Forwarded from EthSecurity
