X100Senate exploit analysis

An attacker netted roughly 4.75 million USDT from X100 on 24 October 2026 because its Senate can be bought, voted and executed inside a single transaction. DeFiHackLabs rebuilds the attack against the live contract and records the attacker netting 4,749,726.10 USDT in one atomic transaction. DeFiHackLabs describes the loss as drained from the X100 treasury, but what the treasury gave up was 400,000 X, sold for about 35 USDT. The USDT came out of the deep Uniswap X/USDT pool when the attacker resold that X. The attack transaction is 0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0 on Etherscan, included in block 26263022 at 14:11:47 UTC.

The governance path had no delay and no access control

The X100 Senate, Freezer and DexTreasury are one contract at 0x79f35a33fe2813414851c4ae8daeacd14d822a46, verified on Sourcify as an exact match to the deployed source. The Senate is a stake-weighted council of three seats, and every step from membership to execution is open to anyone.

• applyForSenate() is external and permissionless, registering the caller for a 100 X candidacy fee plus whatever the applicant freezes.
• Seats go to the nodes with the largest live frozen stake. There is no snapshot, so the ranking is read when execution happens.
• propose() records the proposer's vote as For straight away, and vote() tallies immediately.
• execute() checks only that the proposal passed and the deadline has not passed. With no minimum voting delay, propose, vote and execute can all land in one block.
• Passage is support times two greater than the seat count, so two of three seats is a majority.
• execute() runs the proposal data as a call from the contract to itself. DexTreasury.v3Swap is on the proposable allowlist and is guarded only by a check that the caller is the contract itself, which the self-call satisfies.

Two residual checks remain: a cap on treasury DEX sells, and a post-execution requirement that the treasury's X balance stay at or above total frozen stake. Neither blocks a sell inside the cap.

What the attacker did in one block

The proof of concept rebuilds the same path against a fork of Ethereum at the parent block.

1. Flash-borrow 1,942,457.64 USDT from the Aave V3 pool.
2. Buy 38,200 X on the deep Uniswap V3 X/USDT pool, spending 1,942,356.64 USDT of the loan.
3. Deploy two helper senators and move 19,100 X into each. Each freezes 19,000.000001 X and pays the 100 X fee, one wei above the incumbent 19,000 X seat, which takes two of the three seats.
4. Create a PancakeV3 X/USDT pool priced at about 0.0001 USDT per X, seeded with a single-sided 100 USDT position across ticks -100000 to -92000. The pool price is whatever the attacker set.
5. Senator A proposes a DexTreasury.v3Swap selling 400,000 treasury X into that pool, senator B votes For, and execute() runs in the same block. The treasury receives about 35 USDT for its 400,000 X.
6. Burn the PancakeV3 position to reclaim about 399,987 X from the thin pool, sell 131,702.92 X of it back into the deep Uniswap pool for about 6.69 million USDT, repay the flash loan and keep the surplus.

The flash loan was repaid in the same transaction and 4,749,726.10 USDT reached the attacker's address. The other 268,283.88 X reclaimed from the thin pool was not sold in this transaction and stayed in the attack contract.

The attack was still running after the first transaction

The Defiant reported that two transactions turned treasury tokens and liquidity positions into about 4.85 million USDT, above the 4.75 million USDT single-transaction figure from DeFiHackLabs, and that Blockaid warned the attack on Ethereum was ongoing. In a third transaction, a different sender routed about 549,916 X and 1,909 USDT to a new beneficiary, and the affected pool was left holding less than 200 USDT. The Defiant also reported that the first exploiter swapped about 4.75 million USDT into ether and split it into four wallets of 400 ETH each, with the distribution wallet keeping a further 423 ETH.

The same pattern elsewhere in the corpus

Three other incidents here work the same way, with voting weight manufactured on the open market and then spent on a proposal. At StrongBlock the DAO had been abandoned and its 200,000-vote quorum was cheap to manufacture: the attacker swapped 22 ETH into about 200,984 STRNGR, credited the votes through mineForVotesOnly(), and voted its own proposal in. At YamFinance a dormant DAO let 504,427 YAM, about 3.3% of supply, clear both the proposal threshold and the passage quorum on its own. At TermFinance the entire wrapped voting supply was 0.05 gtmvETH, so a single depositor who wrapped one share already held the majority on a 50% support threshold.

What separates X100 is the flash-funded seat. StrongBlock's attacker spent 22 ETH and still had to sit through a voting delay and a 4320-block voting period, and Yam's bought its YAM with real capital and went through a 5-day timelock. The X100 Senate had no waiting period at all, so the seats were bought with a flash loan and repaid in the same transaction, and the attacker carried no capital at risk.

What would have prevented it

The DeFiHackLabs entry names the two missing controls: a snapshot of frozen stake for seat ranking and vote weight, and a timelock between proposal and execution. Either one would have stopped a majority bought with a flash loan from acting inside the transaction that funded it.