X100 governance flaws trigger $6M loss due to a flash loan

An attacker still acquired two governance seats on X100, a token project with a Senate-governed treasury, and approved a treasury transaction and repaid a flash loan in a single blockchain transaction on Oct. 24.At Arkadiko, a lending protocol where users borrow against vault collateral, a roughly five-day vote ended two days early, giving a malicious contract authority over vault assets. People bought voting tokens shortly before the decisive vote, and the proposal took effect when the ballot closed.The incidents expose different gaps between committing money, qualifying to vote, and executing an approved action. X100 tokens should be locked for a year, so a long token lock can impose a cost without delaying authority.Meanwhile, a lengthy ballot can provide notice while still admitting late purchases. Neither automatically creates time to respond after a decision becomes executable.X100’s locked stake bought immediate authorityX100’s Freezer contract holds frozen X tokens and supplies the stake used to rank candidates for its Senate. Its lock terms run for one, three, or five years, but Senate eligibility uses the amount currently frozen, without a minimum stake age.In the first O...