Security Incident
GoldPesa Smart Contract Vulnerability: $114.90K Reported Loss
On Base, an attacker exploited GoldPesa’s GPXHooks.
- Reported loss
- $ 114900
- Attack category
- Smart Contract Vulnerability
Incident Overview
The hook rebalanced through a shared, flash-accounted PositionManager without checking that the GPX/USDC currency deltas were zero. The attacker opened an unlock, minted an unsettled WETH/USDC position (about 115,000 USDC of phantom debt), then swapped on the GPX pool to trigger the hourly reBalance. The hook’s burn credit was netted against that debt, and the attacker burned its own position and withdrew about 114,900 USDC from the PoolManager.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.