$6M loss on X100 due to governance flaws, Arkadiko vote accepted late purchases

Two distinct vulnerabilities were exposed through recent incidents: one involving X100 governance flaws resulting in a $6M loss via a flash loan, and another concerning Arkadiko's ballot accepting late token acquisitions.

On October 24, an attacker managed to secure two governance seats on X100, a token project whose treasury is governed by a Senate, and successfully authorized a treasury transaction while simultaneously repaying a flash loan, all within a single blockchain transaction.

In the case of Arkadiko, a lending protocol where users borrow against vault collateral, a voting period spanning approximately five days concluded two days ahead of schedule, thereby granting a malicious contract control over the vault's assets. Before the decisive vote, individuals purchased voting tokens, and the proposal took effect immediately upon the ballot's conclusion.

These two events highlight different weaknesses concerning the processes of committing funds, gaining voting eligibility, and carrying out an action that has been approved.

For X100, where tokens are meant to be locked for a year, a prolonged token lock can impose a financial burden without delaying the exercise of control. Conversely, a protracted ballot can offer a period of warning while still permitting late purchases. Nevertheless, neither situation automatically creates a window for a response once a decision is ready to be executed.

The Freezer contract for X100 holds frozen X tokens and provides the stake necessary for ranking candidates for its Senate. Its terms for locking run for one, three, or five years, but Senate eligibility is based on the amount currently frozen, without requiring a minimum age for the stake. In the initial attack on October 24, two auxiliary contracts each froze 19,000.000001 X under the one-year term. These contracts registered, entered the ranking, and furnished the two supporting votes that implemented proposal 7. They finished the stake, votes, and execution in one transaction. The governance deadline provided no mandatory waiting period; a majority of the presently ranked Senate seats could authorize execution even while a proposal remained open. Possessing two out of the three seats granted these helpers the immediate power to act. The approved swap moved 400,000 treasury X into a pool created by the attacker. The Freezer only received 35.675313 USDT, after which the attacker pulled tokens from that pool and sold X to acquire the cash needed for the repayment. The stake remained frozen while the repayment was funded by cash from the treasury extraction and the token sale, meaning the attacker did not need to recover the purchased stake first. The attack borrowed approximately 1.94 million USDT and subsequently paid back the principal along with its premium. Following the repayment, approximately 4.75 million USDT reached the first designated recipient. ChainBounty contributor Philippark accounted for 4.848 million USDT distributed to three chosen recipients; this figure excludes the value of unsold X and its fluctuations, measuring the specified payments. The Freezer also maintained a significant safeguard: after execution, its X balance had to cover the total amount users had frozen. However, safeguarding that quantity of locked principal did not protect the liquidity of external pools or the market valuation of the token.

Proposal 12 on Arkadiko was lodged at 20:35 UTC on October 17 and was executed at 16:04 UTC on October 22. The governance contract allowed an external proposer a voting interval of 720 Bitcoin blocks, which is commonly referred to as five days. The rules stipulated that 0.25% of the eligible DIKO supply was needed to propose, 5% participation to meet quorum, and that yes votes needed to outnumber no votes. The supply calculation excluded DIKO held within the initial-allocation contract. These thresholds and voting rules did not necessitate that token holders possessed tokens prior to the proposal. The wallet that proposed made a swap at 15:03:46 UTC on October 22 and cast a vote at 15:06:47. They committed around 4.573 million DIKO. The proposal concluded with the same total of yes votes and zero no votes. Bitquery estimates that the purchases of voting tokens amounted to roughly $51,000. Its tracing also indicates that 77% of the STX sent to the voting wallet originated from the earlier StackSwap haul. Because the attacker committed funds across several dates and transactions, Arkadiko's situation differs substantially from X100's single-transaction borrowing and repayment. The late purchase was crucial because it became usable voting power during an already-open ballot, and the change took effect when the ballot closed, as no separate waiting period existed between that decision and the contract acquiring its authority.

The approved malicious contract lacked authorization from a caller within its withdrawal and USDA-minting functions. Proposal 12 listed it as the vault-operations contract with permission to mint. Successful calls removed sBTC at 16:06 UTC and stSTX at 16:09, minutes after activation. Bitquery estimates Arkadiko's financial loss at approximately $1.09 million, broken down into roughly $780,000 of stSTX, $135,000 of sBTC, and $173,000 from selling unbacked USDA. In its response thread on October 22, Arkadiko stated that it had deactivated the malicious contract and paused governance, vault liquidations, and redemptions. It noted that affected stSTX and sBTC vaults could not be altered since their collateral was unavailable. At 07:57 UTC on October 27, proposal 14, titled “AIP 32.2 – Restore Vault Operations,” was executed, setting the vault-operations entry to Arkadiko’s legitimate v1-3 contract.

Preventing the newly acquired tokens from qualifying immediately could have been achieved by mandating an older stake or by utilizing voting power from an earlier snapshot, whereas an execution delay would have separated the approval from the movement of assets. If every pertinent action had to pass through such a delay, X100's exact sequence could not have financed itself and repaid its loan in one transaction. An attacker utilizing longer-term capital could wait, but the limitations on what approved contracts are permitted to do remain a separate issue.

OpenZeppelin’s governance documentation characterizes historical voting power and execution timelocks as separate mechanisms. Applying this distinction to these incidents frames the test around when newly acquired capital gains authority, what actions that authority can perform, and how much usable time remains before execution. Since X100’s frozen X could not normally be unfrozen before its lock matured, an execution delay would not negate that withdrawal restriction. Arkadiko’s legitimate close-vault function offers a conditional exit: an active owner repays debt, pays stability fees, and withdraws collateral once operations are reinstated, which requires the requisite funds and available collateral. The approximately five-day proposal window gave advance notice of a proposed alteration, but the final vote arrived much later, and the closure immediately activated the contract. Viewing the entire ballot as a guaranteed post-approval withdrawal window would obscure the moment the danger became executable.

Liam Wright, known as "Akiba," is a reporter, podcast producer, and Editor-in-Chief at CryptoSlate, and he holds the belief that decentralized technology possesses the capacity to make… Gino Matos is a journalist with six years of experience in the crypto industry and a law school graduate, whose expertise primarily concentrates on the Brazilian blockchain.