SpiralHookV2 exploit analysis

SpiralHookV2's lending market on Ethereum was drained of ~10.7 ETH on 2026-09-12 when the attacker pumped the Uniswap V4 pool's spot price in one tx and borrowed from the lending book across six more in the same block (attack transaction, block 25974146). DeFiHackLabs reconstructs the same-block price manipulation against the verified hook source and the full trace of all 7 attack txs.

SpiralHookV2 is both a V4 hook on a lending pair and the lending book that consumes the hook's slot0 spot price as its oracle. The book had a noSameBlockSwap re-use guard keyed by tx.origin, intended to stop a single attacker from re-using the same-block pump multiple times. The attacker pumped the pool with tx.origin = 0x859E..2f0 in tx0, then ran six borrow txs with tx.origin rotated across six distinct EOAs in the same block. Each borrow tx.origin was fresh, so the re-use guard passed, and each borrow settled against the now-pumped spot price until the lending book was drained. All 7 txs were in block 25974146.

DeFiHackLabs records the loss as ~10.70728 ETH, reproduced exact to the wei on a mainnet fork.

The fix is to key the re-use guard on block.number rather than tx.origin, or to use a TWAP oracle instead of the spot price.