X100 governance flaws trigger $6M loss due to a flash loan

An attacker still acquired two governance seats on X100, a token project with a Senate-governed treasury, and approved a treasury transaction and repaid a flash loan in a single blockchain transaction on Oct. 24.

At Arkadiko, a lending protocol where users borrow against vault collateral, a roughly five-day vote ended two days early, giving a malicious contract authority over vault assets. People bought voting tokens shortly before the decisive vote, and the proposal took effect when the ballot closed.

The incidents expose different gaps between committing money, qualifying to vote, and executing an approved action. X100 tokens should be locked for a year, so a long token lock can impose a cost without delaying authority.

Meanwhile, a lengthy ballot can provide notice while still admitting late purchases. Neither automatically creates time to respond after a decision becomes executable.

X100’s Freezer contract holds frozen X tokens and supplies the stake used to rank candidates for its Senate. Its lock terms run for one, three, or five years, but Senate eligibility uses the amount currently frozen, without a minimum stake age.

In the first Oct. 24 attack, two helper contracts each froze 19,000.000001 X under the one-year term. They registered, entered the ranking, and supplied the two supporting votes that executed proposal 7. They completed the stake, votes, and execution in a single transaction.

The governance deadline offered no compulsory waiting period. While a proposal remained open, a majority of the currently ranked Senate seats could authorize execution. Holding two of the three seats gave the helpers enough power to act immediately.

The approved swap sent 400,000 treasury X into an attacker-created pool. The Freezer received only 35.675313 USDT, and the attacker then extracted tokens from that pool and sold X to obtain the cash used for repayment.

The stake stayed frozen while cash from the treasury extraction and token sale funded the repayment, so the attacker did not need to recover the purchased stake first.

The attack borrowed about 1.94 million USDT and repaid the principal plus its premium. After repayment, about 4.75 million USDT reached the first final recipient.

ChainBounty contributor Philippark reconciled 4.848 million USDT paid to three selected recipients. That subtotal excludes unsold X and its changing value, measuring selected payments.

The Freezer also retained a meaningful constraint: after execution, its X balance had to cover the total amount users had frozen. Protecting that quantity of locked principal did not protect external pool liquidity or the token’s market value.

Arkadiko’s proposal 12 was submitted at 20:35 UTC on Oct. 17 and executed at 16:04 UTC on Oct. 22. Its governance contract gave an outside proposer a voting interval of 720 Bitcoin blocks, commonly described as five days.

The rules required 0.25% of eligible DIKO supply to propose, 5% participation to reach quorum, and more yes than no votes. The supply calculation subtracted DIKO held in the initial-allocation contract.

Those thresholds and voting rules did not require token owners to have held tokens before the proposal. The proposing wallet made a swap at 15:03:46 UTC on Oct. 22 and a vote at 15:06:47. It committed about 4.573 million DIKO. The proposal closed with the same yes-vote total and zero no votes.

Bitquery estimates the voting-token purchases at roughly $51,000. Its tracing also puts 77% of the STX sent toward the voting wallet as coming from the earlier StackSwap haul.

The attacker committed funds across multiple transactions and dates, so Arkadiko’s case differs materially from X100’s single-transaction borrowing and repayment. The late purchase was key because it became usable voting power during an already-open ballot.

When the ballot closed, the change executed. No separate waiting period existed between that decision and the contract receiving its authority.