Audit log

Every state-changing event for GoldPesa GPXHooks Uniswap v4 Base Exploit: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-12 04:15:39Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 455,911,358

   sig

   4dwzXwpgYFwi…HcKHu8TAcopyexplorer ↗

   hash

   BT3ZXyKLEbhc…tcVmn5eYcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7862 B) ▸

   {"actor":"system:backfill","investigation_id":"ff9dd4e0-b8ee-4f6a-9ffb-c087c6c8485f","kind":"publish","page_slug":"goldpesa-gpxhooks-uniswap-v4-base-exploit","published_at":"2026-10-12T04:15:39.259Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"GoldPesa GPXHooks Uniswap v4 Base Exploit","sections":[{"content":"GPXHooks is described as a custom Uniswap v4 \"hook\" contract that GoldPesa deployed on the Base network to automatically rebalance protocol-owned GPX/USDC liquidity. According to a report by Crypto Times, the hook performs this rebalancing inside the Uniswap v4 beforeSwap callback, meaning any swap against the pool can trigger a rebalance once an hour has elapsed since the previous one. The hook's rebalance logic interacts with outstanding balances tracked by Uniswap v4's shared PositionManager contract, which nets balances within a single PoolManager transaction. The security-monitoring account Defimon Alerts classified the issue as a \"logic error\" in this rebalancing mechanism. A separate, syndicated report attributed to commentary from the security firm SlowMist (via the account @SlowMist_Team) described the flaw differently, saying the hook's reBalance() function failed to validate currency deltas passed through the shared PositionManager, which allegedly allowed an attacker to mint positions without proper checks. Both accounts agree that the reBalance() function was the point of failure but differ on the precise technical description, and this discrepancy could not be independently resolved from available sources.","heading":"What was reportedly exploited","severity":"high","sources":[{"credibility":2,"name":"Crypto Times — \"GoldPesa's GPXHooks Allegedly Drained for $114K in Base Exploit\"","type":"news_article","url":"https://www.cryptotimes.io/2026/10/03/goldpesas-gpxhooks-allegedly-drained-for-114k-in-base-exploit/"},{"credibility":3,"name":"EdgeX News — \"Goldpesatoken Hit by $114.9K Exploit as Flaw in GPXHooks reBalance() Function Revealed\"","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/goldpesatoken-exploit-defi-loss"}]},{"content":"Per Crypto Times' summary of Defimon Alerts' analysis, the attacker allegedly borrowed 175,000 USDC from the Morpho lending protocol, then used Uniswap v4's PositionManager to open a WETH/USDC position while leaving roughly 115,000 USDC of that position unpaid. The attacker then executed a swap against the GPX/USDC pool, which triggered the GPXHooks rebalance. The report alleges that the hook burned its own protocol-owned liquidity position, receiving about 148,900 USDC, and that this amount was netted against the attacker's outstanding debt within the same transaction, leaving the hook with only about 33,900 USDC and effectively covering the attacker's unpaid position with protocol funds. The attacker is then alleged to have burned their own position, withdrawn roughly 115,000 USDC, repaid the Morpho loan, and converted the remainder to USDT, which was reportedly bridged first to Solana and then to BNB Chain. Crypto Times identified the GPXHooks contract address as 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8 and the exploit transaction hash as 0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9, attributing both to Defimon Alerts and to the attached BaseScan transaction record. These figures and the attack sequence have not been independently corroborated beyond the single Defimon-sourced report and a secondary aggregator article citing SlowMist, so they should be treated as alleged pending a GoldPesa post-mortem or independent on-chain verification.","heading":"Alleged attack sequence and on-chain details","severity":"critical","sources":[{"credibility":2,"name":"Crypto Times — \"GoldPesa's GPXHooks Allegedly Drained for $114K in Base Exploit\"","type":"news_article","url":"https://www.cryptotimes.io/2026/10/03/goldpesas-gpxhooks-allegedly-drained-for-114k-in-base-exploit/"}]},{"content":"A syndicated EdgeX News article reported that GPX trading volume fell to $0 following the exploit announcement, though it did not specify over what time window this was measured. Neither the Crypto Times article nor the EdgeX article could identify any official statement, post-mortem, security update, or compensation plan issued by GoldPesa in response to the alleged exploit. Crypto Times stated it had contacted GoldPesa for comment and would update its reporting if a response was received; no update had been found as of this investigation. Given the thinness of sourcing — a single security-monitoring account's social media post, amplified by a small crypto news outlet and a lower-tier aggregator site — confidence in the precise loss figure, root-cause description, and attacker's post-exploit fund movements remains limited.","heading":"Market impact and absence of official response","severity":"medium","sources":[{"credibility":3,"name":"EdgeX News — \"Goldpesatoken Hit by $114.9K Exploit as Flaw in GPXHooks reBalance() Function Revealed\"","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/goldpesatoken-exploit-defi-loss"},{"credibility":2,"name":"Crypto Times — \"GoldPesa's GPXHooks Allegedly Drained for $114K in Base Exploit\"","type":"news_article","url":"https://www.cryptotimes.io/2026/10/03/goldpesas-gpxhooks-allegedly-drained-for-114k-in-base-exploit/"}]}],"sources_used":[{"credibility":2,"name":"Crypto Times — \"GoldPesa's GPXHooks Allegedly Drained for $114K in Base Exploit\"","type":"news_article","url":"https://www.cryptotimes.io/2026/10/03/goldpesas-gpxhooks-allegedly-drained-for-114k-in-base-exploit/"},{"credibility":3,"name":"EdgeX News — \"Goldpesatoken Hit by $114.9K Exploit as Flaw in GPXHooks reBalance() Function Revealed\"","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/goldpesatoken-exploit-defi-loss"}],"summary":"On October 2, 2026, an attacker allegedly drained roughly $114,000 to $114,900 in protocol-owned liquidity from GPXHooks, a custom Uniswap v4 hook used by the GoldPesa (GPX) token's liquidity pool on Base. Security-monitoring accounts attributed the loss to a logic flaw in the hook's automated rebalancing function, which reportedly let an attacker use a Morpho flash loan and an unpaid position to siphon pooled funds. No official statement from GoldPesa confirming the incident, its cause, or any remediation has been found. This page covers only the exploit itself; it does not restate the trust assessment on the existing GoldPesa entity page.","timeline":[{"date":"2026-10-02","date_evidence":"was confirmed on Base on October 2, 2026, at 1:05:51 PM UTC","event":"Exploit transaction against the GPXHooks contract allegedly confirmed on Base, draining roughly $114,000-$114,900 in protocol-owned GPX/USDC liquidity, according to the attached BaseScan transaction record cited by Defimon Alerts.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/03/goldpesas-gpxhooks-allegedly-drained-for-114k-in-base-exploit/"},{"date":"2026-10","date_original":"2026-10-03","event":"Security-monitoring account Defimon Alerts publicized the exploit on X, and Crypto Times published a report attributing a logic-error root cause to the GPXHooks rebalance function.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/03/goldpesas-gpxhooks-allegedly-drained-for-114k-in-base-exploit/"},{"date":"2026-10","date_original":"2026-10-03","event":"A syndicated news article attributed commentary on the exploit to the security firm account @SlowMist_Team, describing the flaw as a failure to validate currency deltas in the reBalance() function, and reported that GPX trading volume had fallen to $0.","source":"EdgeX News","source_url":"https://pro.edgex.exchange/en-US/news/article/goldpesatoken-exploit-defi-loss"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a66e075f-203e-441f-b076-bca90f70148bcopy