SlowMist said Goldpesa was exploited, with losses estimated at about $114,900. According to the security firm, the root cause was in GPXHooks' reBalance() logic. When it performed liquidity operations through a shared PositionManager, it failed to verify whether the GPX/USDC currency delta was zero, leaving the hook's burn credit unisolated from the caller's state. SlowMist said the attacker used an unlock action together with an unsettled MINT_POSITION operation to create a negative delta, then triggered rebalance so the hook generated positive credit. Because TAKE_PAIR could only withdraw the net amount, the hook actually received only about 33,900 USDC, while the difference was offset by what SlowMist described as phantom debt. The attacker then burned their own position, canceled out the debt, and withdrew about 115,000 USDC from PoolManager.
Blockchain security firm SlowMist said Goldpesa was exploited, with losses estimated at about $114,900.
The issue was tied to GPXHooks reBalance()
According to SlowMist, the root cause was that GPXHooks' reBalance() carried out liquidity operations through a shared PositionManager without verifying whether the GPX/USDC currency delta was zero. That left the hook's burn credit not isolated from the caller's state.
How the attack worked
SlowMist said the attacker first used unlock together with an unsettled MINT_POSITION operation to create a negative delta, then triggered rebalance, causing the hook to generate positive credit.
Because TAKE_PAIR could only withdraw the net amount, the hook actually received only about 33,900 USDC, with the difference offset by the phantom debt described by SlowMist. The attacker then burned their own position, offset the debt, and withdrew about 115,000 USDC from PoolManager.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
