Goldpesa Suffers About $114,900 Loss in Attack Linked to GPXHooks Rebalance Flaw

Goldpesa suffered an attack that caused losses of about $114,900, according to SlowMist monitoring. According to Foresight News, the issue stemmed from GPXHooks' reBalance() function, which used a shared PositionManager to execute liquidity operations without checking whether the GPX/USDC currency delta was zero, leaving the hook's burn credit unisolated from the caller's state.The attacker used unlock and an unsettled MINT_POSITION operation to create a negative delta, then triggered rebalance to generate a positive credit for the hook. However, TAKE_PAIR could only withdraw the net amount, so the hook actually received about 33,900 USDC, with the difference offset by the resulting phantom debt. The attacker then burned its own position and cleared the debt, withdrawing about 115,000 USDC from PoolManager.