X100 Exploit: A Flash-Loaned Senate Drained $4.75M

On 24 October 2026, a single Ethereum transaction exploited a weakness in X100's governance system to drain $4.75 million worth of the project's treasury. The attack took advantage of three design flaws in the protocol: instant, permissionless Senate entry, seats ranked by live balances, and the ability to propose, vote, and execute in the same transaction without any delay.

X100 is an ERC-20 token project whose Senate decides where the project's liquidity sits. Holders lock (freeze) their X tokens in a contract called the Freezer, and the three largest frozen positions among Senate applicants hold the three seats. In this case, the seats were held by stakeholders with 20,500 X, 19,000 X, and 1,000 X.

The attacker rented a seat by paying a 100 X fee and froze 19,000.000001 X, just one millionth of a token more than the current largest frozen position. Using a flash loan, the attacker purchased roughly 38,200 X from Uniswap V3 and used that X to pass a proposal calling the Freezer's v3Swap function, which swapped 400,000 X to a pool the attacker had created earlier. The treasury sold the X at a loss, realizing about $4.75 million in USDT.