The attacker manipulated the Uniswap V4 pool spot price. SpiralHookV2.borrow() valued collateral using poolManager.getSlot0() without TWAP or price-change limits. The noSameBlockSwap guard (keyed by tx.origin) was bypassed via 6 different EOAs, allowing borrowing against inflated collateral in the same block as the pump, resulting in a loss of ~10.7 ETH.