Community Trust ScoreVerified
Governance vulnerabilities in the X100 protocol led to a loss of approximately $6 million on Oct. 24 after an attacker used a flash loan to seize Senate seats. Separately, a manipulated voting process on the Arkadiko lending protocol on Oct. 22 caused an estimated loss of $1.09 million.
X100 Senate seats bought via flash loan
X100 governance relies on a Senate where candidates are ranked by frozen X tokens. While lock terms range from one to five years, eligibility is based on current balances without a minimum stake age. This allowed an attacker to buy voting power immediately before a critical vote.
On Oct. 24, the attacker deployed two helper contracts, each freezing 19,000.000001 X tokens under a one-year lock. These contracts entered the Senate ranking and provided the two votes needed to execute proposal 7. Staking, voting, and execution occurred in a single transaction.
Proposal 7 swapped 400,000 X tokens from the X100 treasury into an attacker-created liquidity pool. The Freezer contract received only 35.675313 USDT from the swap. The attacker then extracted tokens from the pool and sold X to repay the flash loan.
The attack used a flash loan of approximately 1.94 million USDT. After repayment, roughly 4.75 million USDT reached the first final recipient. ChainBounty contributor Philippark traced 4.848 million USDT paid to three recipients. The attacker’s stake remained frozen for a year, but immediate treasury access ensured a net profit.
Arkadiko voting window exploited by late purchases
Arkadiko suffered a governance attack following proposal 12, submitted at 20:35 UTC on Oct. 17 and executed at 16:04 UTC on Oct. 22. The governance contract provided a voting interval of 720 Bitcoin blocks, or five days.
Rules required 0.25% of eligible DIKO supply to propose and 5% participation for quorum. However, token holders did not need to possess tokens before the proposal was submitted. The proposing wallet swapped and voted at 15:06:47 UTC on Oct. 22, committing approximately 4.573 million DIKO tokens. The proposal closed with only yes votes.
Bitquery estimates the token purchases cost roughly $51,000, noting 77% of the STX sent to the voting wallet came from a prior StackSwap incident. The malicious contract lacked caller authorization for withdrawals and USDA-minting. It removed sBTC at 16:06 UTC and stSTX at 16:09 UTC on Oct. 22.
Bitquery estimates the total loss at approximately $1.09 million: $780,000 in stSTX, $135,000 in sBTC, and $173,000 in STX from selling unbacked USDA. Arkadiko disabled the malicious contract and paused governance, vault redemptions, and liquidations, noting that affected vaults could not be modified.
Restoration and governance gaps
At 07:57 UTC on Oct. 27, Arkadiko executed proposal 14 to reset vault operations to its legitimate v1-3 contract. This did not recover stolen collateral or compensate users.
These incidents reveal gaps between capital commitment and voting eligibility. X100’s long lock imposed a cost but did not delay authority. Arkadiko’s window allowed late purchases to become immediate voting power. Neither system required a waiting period between a decision and asset movement.
OpenZeppelin documentation distinguishes historical voting power from execution timelocks. The X100 attack showed flash loans can bypass staking friction. The Arkadiko attack showed voting windows can be exploited by purchasing tokens just before the deadline for immediate activation.
Frequently Asked Questions
How much did the X100 attacker profit from the flash loan?
The attacker extracted approximately 4.848 million USDT from three recipients after repaying a 1.94 million USDT flash loan, resulting in a protocol loss of approximately $6 million.
When did Arkadiko restore its legitimate vault operations?
Arkadiko executed proposal 14 to restore its v1-3 contract at 07:57 UTC on Oct. 27, following the Oct. 22 attack that caused an estimated $1.09 million loss.
