A 2D second-order polynomial transformation is
\[
X' = a_0 + a_1X + a_2Y + a_3X^2 + a_4XY + a_5Y^2,\qquad
Y' = b_0 + b_1X + b_2Y + b_3X^2 + b_4XY + b_5Y^2.
\]
There are $6$ coefficients for $X'$ and $6$ for $Y'$ $⇒$ 12 unknowns.
Each GCP supplies two equations (one for $X'$, one for $Y'$), so the minimum number of GCPs is
\[
\frac{12\ \text{unknowns}}{2\ \text{equations/GCP}}=6.
\]