SlowMist (@SlowMist_Team) “🚨SlowMist TI Alert🚨 💸 @Goldpesatoken Loss: ~$114.9k 🔍 Root Cause: GPXHooks'” — TopicDigg

🚨SlowMist TI Alert🚨 💸 @Goldpesatoken Loss: ~$114.9k 🔍 Root Cause: GPXHooks' reBalance() performs liquidity operations through the shared, flash-accounted PositionManager inside an attacker-controlled PoolManager unlock without verifying that the PositionManager's GPX/USDC currency deltas are zero, so the hook's burn credit is not isolated from the caller's state. The attacker opens an unlock, mints a WETH/USDC position via MINT_POSITION without settling (leaving the shared PositionManager with a −114,999.999187 USDC delta), then swaps on the GPX pool to trigger the hourly rebalance: the hook burns its real position and earns a +148,868.602189 USDC credit, but TAKE_PAIR can only withdraw the net positive delta, so the hook receives just 33,868.603002 USDC while the attacker's phantom debt absorbs the difference. Burning its own position cancels that debt and the attacker takes 114,999.999186 USDC straight out of the PoolManager — a missing delta-isolation / zero-delta check on a shared PositionManager. 📌 Attacker: 0x4a5FD2e9357cC87DF4cD6A1808174DBc8646899F 📌 Victim: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8 📌 Vulnerable Contract: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8 Powered by Tx: