X100’s attacker repaid a flash loan from theft proceeds while its stake stayed locked, and Arkadiko’s ballot accepted late token purchases.
An attacker still acquired two governance seats on X100, a token project with a Senate-governed treasury, and approved a treasury transaction and repaid a flash loan in a single blockchain transaction on Oct. 24.
At Arkadiko, a lending protocol where users borrow against vault collateral, a roughly five-day vote ended two days early, giving a malicious contract authority over vault assets. People bought voting tokens shortly before the decisive vote, and the proposal took effect when the ballot closed.
The incidents expose different gaps between committing money, qualifying to vote, and executing an approved action. X100 tokens should be locked for a year, so a long token lock can impose a cost without delaying authority.
Meanwhile, a lengthy ballot can provide notice while still admitting late purchases. Neither automatically creates time to respond after a decision becomes executable.
X100’s Freezer contract holds frozen X tokens and supplies the stake used to rank candidates for its Senate. Its lock terms run for one, three, or five years, but Senate eligibility uses the amount currently frozen, without a minimum stake age.
In the first Oct. 24 attack, two helper contracts each froze 19,000.000001 X under the one-year term. They registered, entered the ranking, and supplied the two supporting votes that executed proposal 7. They completed the stake, votes, and execution in a single transaction.
Source link
