defi ·
X100 governance flaws trigger $6M loss, Arkadiko ballot accepts late token purchases
An attacker successfully acquired two governance seats on X100, a token project featuring a Senate-governed treasury, and subsequently authorized a treasury transaction while repaying a flash loan…
An attacker successfully acquired two governance seats on X100, a token project featuring a Senate-governed treasury, and subsequently authorized a treasury transaction while repaying a flash loan, all within a single blockchain event on October 24.
In a separate event, the Arkadiko lending protocol experienced a roughly five-day vote concluding two days ahead of schedule, which granted a malicious contract control over vault assets.
These incidents highlight disparate vulnerabilities concerning capital commitment, eligibility for voting, and the execution of sanctioned actions.
For X100, the one-year token lock duration means that a prolonged lock period can incur costs without impeding authority. Conversely, a protracted voting period can offer advance warning while still permitting late token acquisitions.
The X100 Freezer contract holds frozen X tokens and supplies the stake used to rank Senate candidates. Though lock terms are one, three, or five years, Senate eligibility relies on the currently frozen amount, absent a minimum stake age.
During the initial October 24 attack, two helper contracts each froze 19,000.000001 X under the one-year term. These entities registered, entered the ranking, and provided the two supporting votes that executed proposal 7 in one transaction.
The governance deadline lacked any mandatory waiting period, meaning a majority of currently ranked Senate seats could authorize execution while a proposal remained open. The approved swap moved 400,000 treasury X into a pool established by the attacker.
The Freezer only received 35.675313 USDT; the attacker then drew tokens from that pool and sold X to secure the funds needed for repayment. The stake remained frozen while the treasury extraction and token sale funded the repayment, bypassing the need for the attacker to reclaim the purchased stake first.
Arkadiko's proposal 12 was submitted at 20:35 UTC on October 17 and activated at 16:04 UTC on October 22. Its contract allowed an outside proposer a voting interval of 720 Bitcoin blocks, commonly termed five days.
The rules for Arkadiko required 0.25% of eligible DIKO supply to propose, 5% participation for quorum, and more yes votes than no votes. These stipulations did not mandate that token holders possess tokens prior to the proposal.
The proposing wallet executed a swap at 15:03:46 UTC on October 22 and cast a vote at 15:06:47, committing approximately 4.573 million DIKO. Bitquery estimates the voting-token purchases amounted to around $51,000, with 77% of the STX sent to the voting wallet stemming from an earlier StackSwap haul.
The late purchase in Arkadiko was critical because the acquired voting power became active during an already open ballot, and the change executed immediately upon ballot closure, with no intervening waiting period.
These events illustrate how protocols manage the transition from governance approval to asset movement, questioning when newly acquired capital grants authority and what actions that authority can perform before execution.
Why it matters
These exploits reveal critical vulnerabilities in the operational mechanics of decentralized governance systems, specifically around timing and voting power acquisition. Readers should watch how protocols adapt their lock-up periods and voting mechanisms to prevent immediate post-vote exploitation.
