clet.xyz

The incident, which unfolded on October 22, 2023, represents a stark illustration of the vulnerabilities inherent in decentralized autonomous organizations (DAOs), particularly those with lower liquidity and less engaged communities. Arkadiko, a lending protocol operating on the Stacks blockchain, became the latest casualty in a series of governance exploits that highlight the critical need for robust security measures beyond mere adherence to protocol rules. The attack, meticulously reconstructed through on-chain investigation by Bitquery, revealed a calculated strategy involving multi-protocol exploitation and swift execution, leaving the protocol’s total value locked (TVL) decimated and its community grappling with significant losses.

The Arkadiko Protocol and its Governance Framework

Arkadiko is a prominent lending protocol built on the Stacks blockchain, which enables smart contracts and decentralized applications to be secured by Bitcoin. The protocol allows users to collateralize Stacks (STX) tokens, the native asset of the Stacks network, to mint USDA, a decentralized stablecoin soft-pegged to the US dollar. Users could also deposit other assets like sBTC and stSTX into vaults to earn yield or borrow against them. The governance of Arkadiko is managed by its native token, DIKO, granting holders the ability to propose and vote on significant changes to the protocol’s operations, parameters, and smart contracts.

According to Arkadiko’s governance rules, a proposal required a 0.25% threshold of eligible DIKO supply to be submitted. For a proposal to pass, it needed to achieve a 5% quorum of the total eligible DIKO supply voting in favor. At the time of the attack, this quorum translated to approximately 3.4 million DIKO tokens. While these rules were designed to ensure decentralization and community consensus, the incident exposed a critical flaw: a lack of active community participation and vigilance. Prior to this exploit, all 54 previous proposals had originated from the core development team, establishing a pattern where community voters were accustomed to approving routine upgrades without deep scrutiny, inadvertently creating a fertile ground for malicious actors.

A Coordinated Precursor: The StackSwap Exploitation

The Arkadiko attack was not an isolated event but rather the culmination of a broader, multi-protocol exploitation strategy. Just two days prior, on October 20, the same wallet operator executed a similar governance attack on StackSwap, another decentralized exchange within the Stacks ecosystem. This precursor event served not only as a proving ground for the attacker’s methodology but also as a primary funding source for the subsequent Arkadiko takeover.

On StackSwap, the attacker’s governance proposal passed with a meager 37,755 votes, representing a mere 0.19% of the total supply. This low engagement allowed the attacker to quickly gain control, subsequently emptying 49 StackSwap pools through 51 rapid calls in under a minute. The proceeds from this initial exploit, primarily in STX tokens, constituted approximately 77% of the capital later used to acquire the DIKO tokens necessary for the Arkadiko governance vote. The remaining funding for the Arkadiko attack originated from Ethereum, where the attacker’s main Ethereum wallet sent 5.23 ETH to ChangeNOW about half an hour before the Arkadiko vote, which was then converted into STX and transferred to the Stacks network. This sophisticated funding chain, which included the use of Tornado Cash for initial Ethereum deposits between October 3 and October 22, underscores a deliberate and well-planned operation spanning several weeks.

The Arkadiko Governance Hijack: A Detailed Chronology

The Arkadiko governance attack unfolded with alarming speed and precision, demonstrating how a seemingly five-day voting period could be rendered meaningless by a determined and opportunistic actor. Bitquery’s on-chain investigation provides a granular timeline of the critical events:

• October 17, 20:35 UTC: The attacker filed Proposal 12, titled "AIP 32 – Update Vaults Operations for Reward Distribution." This title was deliberately innocuous, mimicking the style of legitimate protocol upgrades. On the same day, the attacker’s wallet purchased 193,091 DIKO tokens, exceeding the 0.25% threshold required to submit a proposal.
• October 17 – October 22 (Nearly Five Days): The proposal remained open, yet no community members or other stakeholders cast any votes. This period of inactivity was a crucial enabling factor, indicating a significant lack of active governance participation and monitoring within the Arkadiko DAO.
• October 22, 17:01 UTC: With just 58 minutes remaining before the five-day voting period was set to conclude, the attacker initiated a rapid sequence of transactions. The main attacker wallet acquired an additional 4,375,106 DIKO tokens. This substantial purchase, combined with the previously held tokens, brought the attacker’s total voting power to 4,573,197 DIKO.
• October 22, 17:02 UTC: The attacker immediately used this newly consolidated voting power to cast all 4,573,197 DIKO tokens in favor of Proposal 12. No votes were cast against the proposal, ensuring its uncontested passage.
• October 22, 17:08 UTC: Proposal 12 officially closed, having met all formal governance requirements: it cleared the submission threshold, exceeded the 5% quorum (6.7% of eligible supply, comfortably above the 3.4 million DIKO requirement), and passed with a unanimous vote.
• October 22, 17:08 – 17:15 UTC (Approximately 7 Minutes): Immediately after the vote concluded, the attacker executed a series of transactions to drain the protocol’s vaults. The newly approved malicious contract was invoked repeatedly, leading to the rapid siphoning of millions of dollars worth of assets.

The final tally of 4,573,197 DIKO in favor and zero against comfortably exceeded the 5% quorum, clearing it by approximately 1.13 million DIKO. This uncontested passage highlights a critical vulnerability: the absence of a vigilant and engaged community to scrutinize proposals, particularly those from unfamiliar addresses.

The Anatomy of the Malicious Proposal

The attacker’s success hinged on a deceptive proposal and a cleverly crafted malicious smart contract. Proposal 12, titled "AIP 32 – Update Vaults Operations for Reward Distribution," misleadingly claimed to link to GitHub pull request #624. Bitquery’s investigation revealed that this GitHub link was to an entirely unrelated, still-open fix from June, submitted by an external account, bearing no relevance to the actual changes proposed.

What Proposal 12 actually did was replace Arkadiko’s legitimate vaults-operations contract with a new, attacker-controlled contract named arkadiko-vaults-operations-v2-1. This malicious contract contained two seemingly innocuous functions: set-vault-collateral and set-vault-debt. Crucially, neither of these functions incorporated any access control checks. They merely verified that the contract was enabled and that the transaction amount was above zero. This lack of authentication meant that once the proposal passed and the contract was activated, any caller could execute these functions, effectively granting the attacker full, unrestricted control over the protocol’s vaults. The attacker could then manipulate the internal state of the vaults, minting new tokens or withdrawing existing collateral at will.

The Vault Drain and Financial Aftermath

The moments following the successful governance vote saw a rapid and systematic emptying of Arkadiko’s vaults. The attacker swiftly executed transactions to exploit the newly installed contract:

• 17:09 UTC: The attacker initiated the first of two calls to the set-vault-collateral function, setting the amount to 1.5 billion USDA. This action effectively allowed the attacker to mint 1.5 billion USDA tokens.
• 17:10 UTC: Following the USDA mint, the attacker immediately performed 15 swaps, exchanging 1.2 billion USDA for 2,059,202 STX and 1,068 stSTX. The rapid sale of USDA tokens at such a high volume instantly broke its peg, causing its value to plummet to approximately $0.13 per token.
• 17:12 UTC: The attacker called set-vault-collateral again, minting another 299 million USDA, which was then swapped for 497,800 STX.
• 17:13 UTC: The set-vault-debt function was invoked to transfer 84,705 sBTC to the attacker’s wallet.
• 17:15 UTC: A final call to set-vault-debt transferred 27,249 STX and 53,858 stSTX, completing the vault drain.

Bitquery’s detailed breakdown of the assets extracted from Arkadiko’s vaults revealed the following:

• 2,604,502 STX
• 54,926 stSTX
• 0.847 sBTC

Valuing STX at $0.32 and stSTX at 1.18 STX (as per Bitquery’s analysis at the time), this amounted to approximately $1.09 million. However, considering the price at which stSTX was actually sold, the total from Arkadiko alone reached closer to $1.11 million. When combined with the roughly $70,500 taken from StackSwap, the attacker’s total haul across both protocols amounted to an estimated $1.16 million.

The consequences for Arkadiko were devastating. The mass printing and subsequent dumping of USDA shattered its peg and destroyed confidence in the stablecoin. With the primary collateral (stSTX and sBTC) backing USDA gone, the stablecoin had little left to support its value. Arkadiko’s team reacted swiftly to mitigate further damage, switching off the compromised contract at 18:08 UTC, pausing governance at 18:14 UTC, and burning 1.499 billion of the printed USDA at 19:21 UTC. However, by then, the bulk of the collateral had already been siphoned off. Arkadiko’s total value locked (TVL) plummeted by approximately 90%, from around $1.4 million before the attack to a mere $141,600, a stark contrast to its peak TVL of $24.6 million in March 2024.

Tracing the Attacker: On-Chain Forensics

The on-chain investigation by Bitquery meticulously tracked the attacker’s movements, revealing a sophisticated operational security posture designed to obfuscate their identity. The primary address responsible for filing Proposal 12, voting, and draining the vault was identified as SP1V1BN459229EJG94YYBJDN50ADVB6MXVVEZ0G34.

The funding for this wallet’s Ethereum side originated from Tornado Cash, a cryptocurrency mixer, with 12.2 ETH withdrawn between October 3 and October 22. This early preparation, nearly three weeks before the actual vote, indicates a premeditated attack. The stolen funds from Arkadiko and StackSwap were then systematically dispersed across various routes to further obscure the trail:

• Direct to Exchanges: Approximately $341,000 (1,065,000 STX) was sent to Okcoin and Gate.io.
• Swap Services: Around $147,000 (458,000 STX) was routed through ChangeNOW and FixedFloat.
• Decentralized Exchanges (DEXs): Roughly $560,000 (1,750,000 STX) was swapped for Bitcoin via various DEXs.

About $114,000, primarily in STX from swap-service payouts, remained untraced at the time of the investigation. While a separate wallet also siphoned 98,034 STX from StackSwap during the same period, Bitquery found no direct on-chain link between that wallet and the Arkadiko attacker, suggesting either an unrelated opportunist or a highly compartmentalized operation.

Official Response and Recovery Efforts

In the immediate aftermath, Arkadiko acknowledged the incident as a "governance attack" via a post on X (formerly Twitter) on the evening of October 22. The team swiftly implemented emergency measures: freezing the affected vaults to prevent further unauthorized withdrawals, urging cryptocurrency exchanges to freeze any stolen funds identified, and initiating the process of filing a police report. These actions are standard protocol for DeFi projects facing such exploits, aimed at limiting losses and pursuing legal recourse.

However, the path to recovery for Arkadiko presents significant challenges. The protocol’s Security Module, designed to cover shortfalls, could potentially sell up to 30% of staked DIKO to generate funds. Yet, activating this module itself requires a governance vote. With governance currently paused due to the exploit, the very system that needs to approve recovery actions is inaccessible. This Catch-22 situation underscores a critical flaw in emergency response mechanisms when the governance itself has been compromised. Any future recovery plan will necessitate a careful re-evaluation of governance procedures, potentially involving off-chain consensus or emergency multi-signature actions by the core team before formal governance can be safely reinstated. The long-term impact on user trust and the protocol’s ability to attract new capital will also be a formidable hurdle to overcome.

Broader Implications for DeFi Security and DAO Governance

The Arkadiko governance attack serves as a sobering case study, highlighting several critical vulnerabilities prevalent across the decentralized finance landscape, particularly for smaller DAOs:

1. Low Governance Engagement: The most glaring vulnerability was the lack of active participation. For nearly five days, the attacker’s proposal went unchallenged, illustrating that a voting period, no matter how long, is meaningless without an engaged community. Many smaller DAOs struggle with voter apathy, making them prime targets for governance capture.
2. Insufficient Quorum and Voting Power Concentration: While Arkadiko’s quorum rules were met, the low cost to acquire sufficient voting power ($51,000 to control $1.4 million in TVL) reveals a fundamental economic imbalance. When the cost of governance tokens required to control a protocol is significantly less than the assets held within its vaults, the incentive for malicious actors becomes overwhelming. This "governance for hire" scenario is a direct consequence of low token prices, low liquidity, and concentrated token distribution.
3. Lack of Independent Proposal Scrutiny: The attacker leveraged the community’s habit of passively approving team-originated proposals. The absence of independent security audits or community-led code reviews for new, unfamiliar proposals allowed a malicious contract to be inserted unchallenged. Protocols need mechanisms for external or community-driven vetting of all proposals, regardless of their origin.
4. Inadequate Smart Contract Access Controls: The core technical vulnerability in the malicious contract was the absence of proper authentication checks for critical functions. This fundamental security oversight allowed anyone who could call the contract to drain the vaults, demonstrating the absolute necessity of rigorous smart contract auditing and formal verification.
5. Inter-Protocol Attack Vectors: The attacker’s use of funds from a previous StackSwap exploit to finance the Arkadiko takeover illustrates the interconnectedness of the DeFi ecosystem. A vulnerability in one protocol can be leveraged to attack another, creating a cascading effect of exploits. This necessitates a broader, ecosystem-wide approach to security.
6. Challenges in Emergency Response: The dilemma of requiring a governance vote to activate a security module when governance itself is compromised highlights the need for robust, pre-approved emergency shutdown or upgrade mechanisms that can be triggered by a trusted multi-signature committee or a circuit breaker, independent of the main governance process.

Arkadiko’s experience underscores that for every small DAO that holds more value in its vaults than its governance token is worth, the risk of a governance capture attack is not merely theoretical but a practical and present danger. It serves as a stark reminder for all decentralized projects to prioritize not just the technical security of their smart contracts, but also the health, engagement, and vigilance of their governing communities. Without these holistic safeguards, the promise of decentralization can easily be subverted by a determined attacker with sufficient capital and a protocol that no one is actively watching. The incident will undoubtedly prompt a re-evaluation of governance tokenomics, community engagement strategies, and emergency protocols across the entire DeFi space.