GoldPesa
Oct 2, 2026
GoldPesa’s GPXHooks rebalanced protocol-owned GPX/USDC liquidity through Uniswap v4’s shared PositionManager without ensuring its currency deltas were isolated and settled. An attacker created an unpaid WETH/USDC position within the same PoolManager unlock and then triggered GoldPesa’s hourly rebalance.
Because TAKE_PAIR operated on the PositionManager’s net credit, GoldPesa’s legitimate USDC credit offset the attacker’s outstanding debt, allowing the attacker to burn their position and withdraw the resulting USDC. Uniswap v4 itself behaved as designed.
How the exploit worked
View reproducible PoCthe GPX V4 hook rebalances protocol liquidity inside beforeSwap via a burn and TAKE_PAIR that run in the attacker's own open PoolManager unlock, and never checks the PositionManager deltas are settled first, so an unsettled mint debt parked in the same unlock nets against the hook's burn credit and the attacker walks the freed USDC out.
Lost: 114,999.999186 USDC (exactly reproduced) on Base; the GPX/USDC V4 pool's protocol liquidity was burned by the hook's own hourly rebalance, and its 148,868.60…
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Incorrect Share Accounting
- Attribution
- Unknown
- Chains
Event timeline
- Oct 2, 2026Exploit executed — $115K drained via incorrect share accounting
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)