What happened
On May 12, 2026, BoostHook's leveraged-long hook on Ethereum was exploited through self-referential liquidity and spot-price manipulation. The incident caused approximately $187,000 of economic harm, combining a 24.06 ETH immediate pool drain with approximately 38.33 ETH of unbacked bad debt.
BoostHook's openLong path borrowed ETH from fully-passed bands and immediately used that ETH to buy SAT1 in the same pool, with no impact cap or fresh-price guard; liquidations then socialized the shortfall as bad debt.
How it happened
The attacker borrowed 120 WETH from Morpho, bought SAT1 to move the Uniswap V4 price, opened nine leveraged longs that borrowed ETH from the same pool, sold the SAT1 at the manipulated price, and repaid the flash loan. The focal transaction left approximately 20.93 WETH with the attacker.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
