POPA ReconOn October 2, 2026, an attacker stole ~$115K from GoldPesa's GPXHooks
On October 2, 2026, an attacker stole ~$115K from GoldPesa's GPXHooks RootCause: The reBalance function's "USDC Donation Check" only verified excess USDC in the hook vs. Uniswap (if usdcInsideHook > usdcInsideUniswap) but ignored shortfalls; TAKE_PAIR action during modifyLiquiditiesWithoutUnlock shared deltas across callers, allowing the hook to receive far less (~$34K instead of ~$149K). TX: https://basescan.org/tx/0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9… Vulnerable hook (GPXHooks): https://basescan.org/address/0x4519e2b040ff1b64fa03abe2aef0bc99d7cceaa8#code…
The excerpt is quoted from a public Telegram channel, which owns its text.