Over the weekend, another abandoned governance was attacked, and $4.75M was stolen. This attack stands out because of how the targeted governance worked. x100 DAO operated like a multisig: the 3 wallets with the most locked tokens could not only submit but also immediately approve any proposal, as long as 2 of them agreed. To make matters worse, wallets' voting power for governance purposes was counted in the same second/block. There was no snapshot taken at a prior block - a common practice to prevent flash loan attacks, where attackers borrow voting power to drain DAO funds. With no flash loan protection and power concentrated in the 3 largest addresses, x100 DAO was drained. In a single transaction, the attacker: - Took out a $1.9M flash loan - Bought 38,200 $X, x100 DAO's governance token, and split it across 2 addresses - Locked 19,000 $X in each address, taking control of the DAO's 2 most powerful wallets - Using a fake $X pool the attacker had created earlier, sent 400,000 $X from the treasury into that pool and swapped it for just $35 - Took the 400,000 $X out of the pool and sold it on a "real" pool for $6.7M - Finally, sold $1.9M worth of $X to repay the flash loan, walking away with $4.75M from the operation. On top of that, right after the attack, other attackers spotted the vulnerability and decided to exploit it too, stealing another $100K after the first one. The issue at x100 DAO was an old and common vulnerability in past governance systems, and it has now joined the hall of exploited abandoned governances.