# Shared-Accounting Hooks Become an Exploit Class

Protocols that run self-funded rebalancing logic inside other users' swaps will keep losing capital to attackers who exploit shared settlement accounting, because audits test the hook alone rather than within a hostile session.

- Conviction: 26 / 100 (weakening)
- 7-day move: -14
- Horizon: Emerging (watchlist)
- Tracking since: 2026-10-05T00:00:00.000Z
- Last updated: 2026-10-12T14:07:13.213Z
- Canonical: https://polylog.news/crypto/trends/hook-composability-exploits
- Publisher: Polylog
- Affected regions: Global

## Recent score history

- 2026-10-11: 28
- 2026-10-12: 26

## Recent evidence

- [confirms] Uniswap v4 hook rebalancing flaw drains about $115,000 from GoldPesa on Base, and MALT loses treasury DAI on Polygon (2026-10-05): Attackers took about $115,000 from GoldPesa's Uniswap v4 hook on Base and drained treasury DAI from MALT on Polygon. In both cases a rebalance funded by the protocol ran inside a user's swap without separating the protocol's capital from the caller's, and flash loans captured the difference. Two separate protocols losing money the same way shows this is a repeating exploit class, not a one-off bug.