BoostHook was exploited via a flash loan attack that manipulated the ETH/PERP Uniswap v4 pool price. An attacker used a 120 WETH Morpho flash loan to temporarily push the pool price upward, opened nine leveraged long positions at the inflated price through BoostHook.openLong(), then reversed the price move. The protocol's hard-capped MAX_LIQS_PER_BLOCK limit prevented liquidation of all toxic positions, leaving four 8 ETH-debt positions open and causing significant bad debt.