GoldPesa accounting flaw causes a reported $114,900 loss

What happened

GoldPesa’s GPX trading hook lost about $114,900 on Base, according to SlowMist. An attacker left a debt open in shared trading accounts, then triggered the hook’s rebalance so the hook’s money paid that debt.

The transaction occurred at 13:05 UTC on 2 October; the researcher published its report on 3 October. The gross withdrawal was about 115,000 USDC, while the attacker’s final receipt after swaps was about 96,389 bridged USDT. This entry uses SlowMist’s approximate protocol-loss estimate. The hook failed to check that its currency balances were settled before rebalancing.