X100 governance flaws trigger $6M loss due to a flash loan
Two governance attacks exposed weaknesses in X100 and Arkadiko’s voting and execution rules. On Oct. 24, X100 attackers used flash-borrowed funds to acquire two Senate seats and approve a treasury swap in one transaction, extracting about 4.85 million USDT in payments. At Arkadiko, a wallet bought roughly $51,000 of DIKO near the end of a five-day vote, helping pass a proposal that immediately granted a malicious contract vault authority. It drained assets estimated at $1.09 million. Arkadiko later disabled the contract and paused operations, then restored its legitimate vault contract through a new proposal. The cases show that long ballot periods and token locks do not necessarily prevent newly acquired voting power from acting immediately. Historical voting snapshots and execution delays could separate approval from asset movement, though they address different risks.
