X100 governance flaws trigger $6M loss due to a flash loan

An attacker still acquired two governance seats on X100, a token project with a Senate-governed treasury, and approved a treasury transaction and repaid a flash loan in a single blockchain transaction on Oct. 24. At Arkadiko, a lending protocol where users borrow against vault collateral, a roughly five-day vote ended two days early, giving a malicious contract authority over vault assets. People bought voting tokens shortly before the decisive vote, and the proposal took effect when the ballot closed. The incidents expose different gaps between committing money, qualifying to vote, and executing an approved action. X100 tokens should be locked for a year, so a long token lock can impose a cost without delaying authority. Meanwhile, a lengthy ballot can provide notice while still admitting late purchases.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CryptoSlate.