POPA ReconX 100 hacked for $4.75M
X 100 hacked for $4.75M Rootcause : Anyone could instantly join the Senate by freezing X tokens (and paying a small candidacy fee, reported as ~100 X). Membership was based on the current frozen stake. There was no snapshot of balances/voting power and no timelock (or other delay) on proposals. A proposal could be created, voted on (with the newly acquired majority), and executed in the same transaction, including calls that invoked the treasury’s own swap functions (e.g., v3Swap). This allowed the attacker to: 1. Flash-borrow USDT (via Aave), buy X tokens, and distribute/freeze them across…
The excerpt is quoted from a public Telegram channel, which owns its text.
Read the original post on Telegram