GoldPesa GPXHooks (Base): ~$114k via Uniswap v4 rebalance hook
02 Oct 2026 on-chain (Defimon alert 03 Oct; SlowMist-monitored English flashes 04 Oct): GoldPesa's GPXHooks Uniswap v4 hook on Base was drained for about $114k to $115k.
Public write-ups describe a liquidity-rebalance / shared PositionManager logic error where borrowed Morpho USDC and an unpaid position let rebalance credit net against attacker debt, under-paying the hook so the attacker could withdraw profit after loan repay.
Proceeds were reported converted and bridged toward Solana then BNB. GoldPesa had not issued a public response in the first English pieces. Small-firm Watch size. Research snapshot from CryptoTimes, Defimon, and SlowMist-attributed flashes.
369 take
Hook rebalance that shares a PositionManager can treat protocol capital like caller capital if accounting is wrong.
Pulse lesson for any Uniswap v4-style hook or rebalance path: isolate protocol-owned liquidity from the caller's credit in the same unlock.
Sources