Flash-Loan Seizes X100 Senate Seats and Triggers $4.85M Theft

On October 24, an attacker leveraged a flash loan to win two of the three Senate seats that govern X100. The attacker then pushed a proposal through the Senate in a matter of seconds, compelling the treasury to sell X tokens into a liquidity pool that had been deliberately under-priced. Three rapid transactions drained the treasury of $4.85M in USDT, while the attacker retained 828,094 X tokens.

The attack unfolded in a single block. The attacker borrowed a large amount of capital via a flash loan, used the borrowed funds to acquire Senate voting power, and submitted a proposal that mandated a forced liquidation of treasury holdings. Because the proposal passed instantly, the treasury had no opportunity to contest or delay the sale. The liquidity pool had been manipulated to offer a steep discount, ensuring that the treasury received a fraction of the token’s true market value.

Governance Thresholds and Flash-Loan Pressure

X100’s Senate consists of only three seats, each holding equal voting weight. The attacker’s flash loan allowed them to acquire two seats, giving them a 66.7 % majority. The governance model lacks a time lock or a higher quorum requirement, meaning that a single majority can enact sweeping changes without a delay. This design flaw enabled the attacker to push the liquidation proposal through before any other stakeholders could react.

The rapid passage of the proposal highlights a broader risk in many DeFi protocols: low voting thresholds combined with flash-loan liquidity can lead to instant governance takeover. Protocols that rely on a small number of voting nodes are especially vulnerable if those nodes can be cheaply acquired.

Liquidity Pool Manipulation

The treasury’s forced sale occurred in a pool that had been deliberately under-priced. By flooding the pool with the attacker’s borrowed capital, the attacker drove the price of X tokens down, ensuring that the treasury received a minimal amount of USDT per token. The manipulation was executed within the same transaction that triggered the liquidation, leaving no room for external market participants to intervene.

The attacker’s wallet still holds 828,094 X tokens, a significant amount that could be sold later at a more favorable price. The current market value of those tokens is unclear, but the sheer volume suggests that the attacker could recover a substantial portion of the stolen USDT if they choose to liquidate.

Impact on X100 Users and Token Holders

Token holders now face a reduced treasury balance and a sudden drop in the perceived security of the protocol. The forced liquidation likely depressed the market price of X tokens, affecting holders who had not participated in the governance process. Users who had deposited liquidity or staked X tokens may see their positions devalued.

The incident also raises questions about the protocol’s risk management. The lack of a multi-signature requirement for treasury moves, coupled with a low governance threshold, created a perfect storm for the attack. Protocol developers will need to reassess their governance architecture to prevent similar exploits.

What to Verify and Watch

  • Governance Structure: Check whether X100 has a quorum requirement or a time lock on treasury proposals. A low threshold can expose the protocol to flash-loan attacks.
  • Liquidity Pool Health: Monitor the depth and volatility of the X/USDT pool. A sudden influx of large trades can signal manipulation.
  • Token Holdings: Track the attacker’s wallet for any large sales of X tokens. A coordinated dump could further depress the token price.
  • Protocol Updates: Look for announcements from X100’s development team regarding changes to governance or treasury controls.

Protocol liquidity stats

More from our coverage

The mechanics of flash-loan-based governance attacks were also highlighted in the recent Crypto Swap Flash Loan Loss: 2,022 ETH Vanishes After USDT Flash article, which details how a similar strategy can wipe out large amounts of stablecoin in a single transaction.

Explore more on this topic