Goldpesa Suffers Attack Resulting in Loss of Approximately $114,900

Goldpesa suffered an attack resulting in a loss of approximately $114,900. The cause of the attack was that the reBalance() function of GPXHooks did not verify whether the GPX/USDC currency delta was zero during liquidity operations, leading to the burn credit of the hook not being isolated from the caller's state. The attacker created a negative delta through unlock and unsettled MINT_POSITION operations, triggering a rebalance that generated positive credit for the hook. However, the TAKE_PAIR could only withdraw the net amount, and the hook actually received only about 33,900 USDC, with the difference offset by phantom debt. The attacker then burned their own position and offset the debt, withdrawing approximately 115,000 USDC from the PoolManager.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.