X100 governance flaws trigger $6M loss due to a flash loan

An attacker still acquired two governance seats on X100, a token project with a Senate-governed treasury, and approved a treasury transaction and repaid a flash loan in a single blockchain transaction on Oct. 24.

At Arkadiko, a lending protocol where users borrow against vault collateral, a roughly five-day vote ended two days early, giving a malicious contract authority over vault assets. People bought voting tokens shortly before the decisive vote, and the proposal took effect when the ballot closed.

The incidents expose different gaps between committing money, qualifying to vote, and executing an approved action. X100 tokens should be locked for a year, so a long token lock can impose a cost without delaying authority.

Meanwhile, a lengthy ballot can provide notice while still admitting late purchases. Neither automatically creates time to respond after a decision becomes executable.

X100’s locked stake bought immediate authority

X100’s Freezer contract holds frozen X tokens and supplies the stake used to rank candidates for its Senate. Its lock terms run for one, three, or five years, but Senate eligibility uses the amount currently frozen, without a minimum stake age.

In the first Oct. 24 attack, two helper contracts each froze 19,000.000001 X under the one-year term. They registered, entered the ranking, and supplied the two supporting votes that executed proposal 7. They completed the stake, votes, and execution in a single transaction.

The governance deadline offered no compulsory waiting period. While a proposal remained open, a majority of the currently ranked Senate seats could authorize execution. Holding two of the three seats gave the helpers enough power to act immediately.

The approved swap sent 400,000 treasury X into an attacker-created pool. The Freezer received only 35.675313 USDT, and the attacker then extracted tokens from that pool and sold X to obtain the cash used for repayment.

The stake stayed frozen while cash from the treasury extraction and token sale funded the repayment, so the attacker did not need to recover the purchased stake first.

The attack borrowed about 1.94 million USDT and repaid the principal plus its premium. After repayment, about 4.75 million USDT reached the first final recipient.

ChainBounty contributor Philippark reconciled 4.848 million USDT paid to three selected recipients. That subtotal excludes unsold X and its changing value, measuring selected payments.

The Freezer also retained a meaningful constraint: after execution, its X balance had to cover the total amount users had frozen. Protecting that quantity of locked principal did not protect external pool liquidity or the token’s market value.

Arkadiko’s ballot admitted late money

Arkadiko’s proposal 12 was submitted at 20:35 UTC on Oct. 17 and executed at 16:04 UTC on Oct. 22. Its governance contract gave an outside proposer a voting interval of 720 Bitcoin blocks, commonly described as five days.

The rules required 0.25% of eligible DIKO supply to propose, 5% participation to reach quorum, and more yes than no votes. The supply calculation subtracted DIKO held in the initial-allocation contract.

Those thresholds and voting rules did not require token owners to have held tokens before the proposal. The proposing wallet made a swap at 15:03:46 UTC on Oct. 22 and a vote at 15:06:47. It committed about 4.573 million DIKO. The proposal closed with the same yes-vote total and zero no votes.

Bitquery estimates the voting-token purchases at roughly $51,000. Its tracing also puts 77% of the STX sent toward the voting wallet as coming from the earlier StackSwap haul.

The attacker committed funds across multiple transactions and dates, so Arkadiko’s case differs materially from X100’s single-transaction borrowing and repayment. The late purchase was key because it became usable voting power during an already-open ballot.

When the ballot closed, the change executed. No separate waiting period existed between that decision and the contract receiving its authority.

The approved malicious contract lacked caller authorization in its withdrawal and USDA-minting functions. Proposal 12 registered it as the vault-operations contract with mint permission. Successful calls removed sBTC at 16:06 UTC and stSTX at 16:09, minutes after activation.

Bitquery estimates Arkadiko’s loss at about $1.09 million: roughly $780,000 of stSTX, $135,000 of sBTC and $173,000 of STX obtained by selling unbacked USDA.

In its Oct. 22 response thread, Arkadiko said it had disabled the malicious contract and paused governance, vault redemptions and liquidations. It said affected stSTX and sBTC vaults could not be modified because their collateral was unavailable.

At 07:57 UTC on Oct. 27, proposal 14, “AIP 32.2 – Restore Vault Operations,” executed, setting the vault-operations entry to Arkadiko’s legitimate v1-3 contract.

An exit window needs an exit

Requiring an older stake or using voting power from an earlier snapshot could have prevented the newly acquired tokens from qualifying immediately, while an execution delay would have separated approval from asset movement.

If every relevant action had to pass through that delay, X100’s exact sequence could not have financed itself and repaid its loan in one transaction.

An attacker using longer-term capital could wait, but limits on what approved contracts may do remain a separate question.

OpenZeppelin’s governance documentation describes historical voting power and execution timelocks as distinct mechanisms.

Applying that distinction to these incidents makes the test a question of when newly acquired capital gains authority, what that authority can move, and how much usable time remains before execution.

X100’s frozen X could not normally be unfrozen before its lock matured, so an execution delay would not erase that withdrawal restriction.

Arkadiko’s legitimate close-vault function provides a conditional exit: an active owner repays debt, pays stability fees, and withdraws collateral when operations are enabled. That requires the necessary funds and available collateral.

The roughly five-day proposal window offered advance notice of a proposed change. The final vote arrived much later, and closure immediately activated the contract. Treating the whole ballot as a guaranteed post-approval withdrawal window would obscure when the danger became executable.