Cena Stox

$GRVT An attacker still acquired two governance seats on X100, a token project with a Senate-governed treasury, and approved a treasury transaction and repaid a flash loan in a single blockchain transaction on Oct. 24. At Arkadiko, a lending protocol where users borrow against vault collateral, a roughly five-day vote ended two days early, giving a malicious contract authority over vault assets. People bought voting tokens shortly before the decisive vote, and the proposal took effect when the ballot closed. The incidents expose different gaps between committing money, qualifying to vote, and executing an approved action. X100 tokens should be locked for a year, so a long token lock can impose a cost without delaying authority. Meanwhile, a lengthy ballot can provide notice while still admitting late purchases. Neither automatically creates time to respond after a decision becomes executable. X100’s locked stake bought immediate authority X100’s Freezer contract holds frozen X tokens and supplies the stake used to rank candidates for its Senate. Its lock terms run for one, three, or five years, but Senate eligibility uses the amount currently frozen, without a minimum stake age. In the first Oct. 24 attack, two helper contracts each froze 19,000.000001 X under the one-year term. They registered, entered the ranking, and supplied the two supporting votes that executed proposal 7. They completed the stake, votes, and execution in a single transaction. The governance deadline offered no compulsory waiting period. While a proposal remained open, a majority of the currently ranked Senate seats could authorize execution. Holding two of the three seats gave the helpers enough power to act immediately. The approved swap sent 400,000 treasury X into an attacker-created pool. The Freezer received only 35.675313 $USDT, and the attacker then extracted tokens from that pool and sold X to obtain the cash used for repayment. The stake stayed frozen while cash from the treasury extraction and token sale funded the repayment, so the attacker did not need to recover the purchased stake first. The attack borrowed about 1.94 million $USDT and repaid the principal plus its premium. After repayment, about 4.75 million $USDT reached the first final recipient. ChainBounty contributor Philippark reconciled 4.848 million $USDT paid to three selected recipients. That subtotal excludes unsold X and its changing value, measuring selected payments. The Freezer also retained a meaningful constraint: after execution, its X balance had to cover the total amount users had frozen. Protecting that quantity of locked principal did not protect external pool liquidity or the token’s market value. Arkadiko’s ballot admitted late money Arkadiko’s proposal 12 was submitted at 20:35 UTC on Oct. 17 and executed at 16:04 UTC on Oct. 22. Its governance contract gave an outside proposer a voting interval of 720 Bitcoin blocks, commonly described as five days. The rules required 0.25% of eligible DIKO supply to propose, 5% participation to reach quorum, and more yes than no votes. The supply calculation subtracted DIKO held in the initial-allocation contract. Those thresholds and voting rules did not require token owners to have held tokens before the proposal. The proposing wallet made a swap at 15:03:46 UTC on Oct. 22 and a vote at 15:06:47. It committed about 4.573 million DIKO. The proposal closed with the same yes-vote total and zero no votes. Bitquery estimates the voting-token purchases at roughly $51,000. Its tracing also puts 77% of the $STX sent toward the voting wallet as coming from the earlier StackSwap haul. The attacker committed funds across multiple transactions and dates, so Arkadiko’s case differs materially from X100’s single-transaction borrowing and repayment. The late purchase was key because it became usable voting power during an already-open ballot. When the ballot closed, the change executed. No separate waiting period existed between that decision and the contract receiving its authority. The approved malicious contract lacked caller authorization in its withdrawal and USDA-minting functions. Proposal 12 registered it as the vault-operations contract with mint permission. Successful calls removed sBTC at 16:06 UTC and stSTX at 16:09, minutes after activation. Bitquery estimates Arkadiko’s loss at about $1.09 million: roughly $780,000 of stSTX, $135,000 of sBTC and $173,000 of $STX obtained by selling unbacked USDA. X100’s attacker acted within one transaction despite a year-long token lock, while Arkadiko executed after voting with no separate delay. In its Oct. 22 response thread, Arkadiko said it had disabled the malicious contract and paused governance, vault redemptions and liquidations. It said affected stSTX and sBTC vaults could not be modified because their collateral was unavailable. At 07:57 UTC on Oct. 27, proposal 14, “AIP 32.2 – Restore Vault Operations,” executed, setting the vault-operations entry to Arkadiko’s legitimate v1-3 contract. An exit window needs an exit Requiring an older stake or using voting power from an earlier snapshot could have prevented the newly acquired tokens from qualifying immediately, while an execution delay would have separated approval from asset movement. If every relevant action had to pass through that delay, X100’s exact sequence could not have financed itself and repaid its loan in one transaction. An attacker using longer-term capital could wait, but limits on what approved contracts may do remain a separate question. OpenZeppelin’s governance documentation describes historical voting power and execution timelocks as distinct mechanisms. Applying that distinction to these incidents makes the test a question of when newly acquired capital gains authority, what that authority can move, and how much usable time remains before execution. X100’s frozen X could not normally be unfrozen before its lock matured, so an execution delay would not erase that withdrawal restriction. Arkadiko’s legitimate close-vault function provides a conditional exit: an active owner repays debt, pays stability fees, and withdraws collateral when operations are enabled. That requires the necessary funds and available collateral. The roughly five-day proposal window offered advance notice of a proposed change. The final vote arrived much later, and closure immediately activated the contract. Treating the whole ballot as a guaranteed post-approval withdrawal window would obscure when the danger became executable.

STX/USDT Position 📉 Short: 0.3083 TP: 0.29287438 SL: 0.31686979 R:R: 1:1.8 | Score: 61/100 Always DYOR and manage risk.

TOP 5 CRYPTO PICKS BEFORE THE NEXT ALTSEASON $OP — Optimism $IMX — Immutable $STX — Stacks $Crv — Curve DAO $KAS — Kaspa The next altseason could reward investors who do their research before the crowd returns. These five projects offer exposure to different crypto sectors, including Ethereum scaling, gaming, Bitcoin infrastructure, DeFi, and proof-of-work. But don't buy just because a coin is trending. Token unlocks, valuation, liquidity, and real demand matter. Which of these five would you add to your portfolio before the next altseason? #Altcoins #Crypto #Altseason #CryptoResearch

📊 DeFi: total value locked reaches $90 billion 📌 What's confirmed (October 23, 2026): * Total value locked (TVL) in DeFi rose 0.98% over the week to $90.16B, but it is still about 21% below the start of the year. * Hyperliquid L1 surged 123% on the week, while Solana and Ethereum declined. ⚠️ Risks: * A governance attack on Arkadiko on Stacks knocked the USDA stablecoin off its dollar peg, and its TVL fell by about 90%. * Blast L2 will shut down on October 26 after its TVL fell about 98% from its peak. 💡 DeFi offers profit potential, but it carries risk. This is not investment advice, so do your own research before putting in money. 👇 Your take: Will DeFi recover in 2027? A) Yes 📈 B) Only if security improves ⚖️ Dan A TWO — Crypto Without the Hype. #DeFi: #Crypto #DanATWO $ETH $SOL $BGB