X100: Three governance executions, 4.848 million USDT in selected recipient payments

On 24 October 2026, X100’s Ethereum Freezer contract executed a sequence of governance proposals that moved treasury assets and withdrew liquidity. The crucial question is how addresses that acquired voting weight could use it immediately. The checked receipts show two supporting votes out of three Senate seats, followed by execution within the same transaction. The displayed source explains why that sequence was possible.

This report follows three execution transactions, then a narrower onward route from the first USDT recipient through two conversions and one ETH distribution address. It separates the transaction sender, the contract doing the work and the address receiving the proceeds. Those roles are not proof of a person’s identity. E1, E2, E3.

1. Before the numbers: what each participant did

The Freezer is the asset-holding governance contract. In the reviewed source, “frozen” tokens are tokens counted as stake for Senate membership; freezing here does not mean a stablecoin issuer or law-enforcement agency blocked an address. A helper contract is an address used during execution to hold stake and cast a vote. A bundler submits transactions for other operations; its presence does not identify the ultimate beneficiary.

Blockaid and Chainalysis supplied the public incident framing and transaction leads. The tables below use independently opened explorer records for movement and event facts. Their public estimates of roughly $4.7 million and roughly 4.85 million USDT are source snapshots, not interchangeable accounting totals. Public statement 1; Public statement 2; Public statement 3; Public statement 4; Public statement 5.

2. Scope and the three findings

First, the governance boundary did not require the proposal to wait until its expiry: the first checked receipt creates, votes on and executes proposal 7 in one transaction. Second, the later executions use the same two newly observed helper addresses as senators, even though transaction senders and execution contracts differ. Third, the first recipient’s USDT payment is exactly matched by two subsequent USDT spends, while the ETH relay receives slightly more ETH than those two conversions produced. That difference prevents an all-funds provenance claim.

3. How voting weight became an immediate treasury instruction

What turned stake into execution permission? In the first receipt, each of two helper addresses receives 19,100.000001 X. Each sends 19,000.000001 X into the Freezer and a further 100 X as a candidacy fee. Frozen, Registered and Ranked events precede proposal creation. This ties the explanation to the actual receipt rather than assuming that any large holder could control the contract. E1.

Read Figure 1 from top to bottom. Arrows show the order of events within the first transaction, not an extra transfer of money. The observation to carry forward is that stake acquisition, voting and treasury execution happen together. The next question is which source checks permit that timing.

Figure 1. Event sequence in E1. This is a governance sequence, not an asset-value chart. Full helper addresses and the transaction are in the adjacent table and evidence appendix.

In Senate.sol, propose records the proposer’s supporting vote immediately. vote checks current Senate membership. execute tallies the current ranked list and accepts support when support × 2 is greater than senateSize. _state leaves a proposal open until it expires; expiry is a deadline, not a compulsory delay. execute then calls the permitted proposal data on the contract itself. DexTreasury.sol permits v3Swap and v3Decrease and forwards those operations to its module. Freezer.sol obtains voting stake from frozenOf. Displayed verified contract source.

This source path and the receipt agree on the narrow failure mode: voting weight could be acquired and used immediately for treasury operations. The reviewed first proposal passes zero as its minimum output parameter; its observed 400,000 X leg receives only 35.675313 USDT. The later swap output elsewhere in the receipt is a different leg, not the treasury’s sale proceeds. We have not independently replayed historical storage, compiled the bytecode or audited every module path, so this is not a comprehensive code audit.

4. Three executions do not establish three independent people

At 14:35:59 UTC, the second transaction executes proposals 8–13, including five liquidity-decrease instructions and one swap. The receipt creates a different execution contract and two helpers. It ultimately pays 96,381.883491 USDT and 9,894.892631 X to its final recipient. The sender is the bundler-labelled address, not that recipient. At 14:40:47 UTC, the third execution uses the same two helper senators seen in the second receipt, and pays a different recipient. This is a direct operational link, but does not resolve who controlled those addresses. E2; E3.

The first USDT amount is the final transfer to the sender after the observed flash-loan repayment, not the larger gross swap output. An Aave FlashLoan event records a 1,942,457.637245 USDT principal and 971.228819 USDT premium in E1. The gross 6,693,089.638357 USDT swap output must therefore not be called net profit or added to the final payment. Likewise, repeated transfers between execution contracts and recipients are the same funds moving through a route. Native ETH gas is outside this USDT subtotal.

These are selected recipient payments, not an independently reconciled loss across all treasury assets and all transactions. X-token residuals, changing pool prices and any other incident-linked activity remain outside that conclusion. The first explorer receipt is successful but also displays an internal reverted-call warning; “Success” does not mean every internal attempt succeeded.

5. Following the first recipient into ETH

Where did the first USDT payment go? Two later transactions show the first recipient spending 2,000,000 USDT and 2,749,726.096973 USDT through a UniswapX settlement route. Their sum exactly matches the 4,749,726.096973 USDT received in E1. Internal native-asset transfers pay 851.542914929444388864 ETH and 1,170.472889392738131465 ETH back to that recipient. The transaction senders are settlement participants, not automatically the beneficial owner. S1; S2.

The first recipient then sends 1,000 ETH and 1,022.856704743507502222 ETH to the same distribution address. Because that total exceeds the two conversion receipts, it cannot all be assigned exclusively to those conversions. Other ETH already present or received can mix with converted proceeds. This review proves the selected transfer sequence, not a unique per-wei attribution. R1; R2.

Read Figure 2 from the first recipient to the central distribution address, then outward to four branches. Solid arrows are checked native ETH transfers. The top panel reports the separate conversion total and the mixing boundary. The four equal branch transfers are the key observation; their later disposition is the next unanswered question.

Figure 2. Historical ETH transfers on 24 October 2026 UTC. Labels use evidence IDs and rounded ETH values for readability; exact quantities and full identifiers are preserved below. No current balances or common ownership are asserted.

Each of D1–D4 is a successful 400 ETH transfer from the central address, for a selected distribution total of 1,600 ETH. The second and third execution transactions overlap this distribution window; the chronology is not three isolated phases. No outbound activity from the four recipients was exhaustively reviewed. Their historical receipts do not prove that they still hold 400 ETH each, that an exchange accepted them, or that anyone cashed out.

6. What the evidence does not establish

A shared helper pair links the second and third governance receipts, but shared infrastructure alone does not prove one operator, and different senders do not prove different people. No personal identity is established here. Explorer service labels are navigation clues, not legal findings. There is no verified recovery, asset freeze or exchange account attribution in this bounded review.

The source displayed at the Freezer address is exact-match verified, and its creation receipt predates these transactions: 23 October 2026 at 14:25:59 UTC, block 26255911. That does not substitute for a complete historical-state or implementation-change analysis. The reviewed code and the selected emitted events support the immediate-governance path; unreviewed configuration changes and module branches remain limitations. Contract creation receipt.

7. Incident-specific response points

The governance evidence points to a concrete control question: can newly acquired, currently ranked stake authorize treasury DEX operations before other holders have time to respond? A meaningful remediation review would need to test delayed execution, a prior-state voting snapshot and limits on treasury price execution against this exact same-transaction sequence. This report does not claim that any of those changes have been deployed.

For tracing, preserve E1’s recipient payment, the two USDT settlement records and R1/R2 as one route rather than counting each hop as new loss. Preserve D1–D4 as separate historical outputs, with their exact hashes, before making a service-exposure claim. The outstanding recovery question is what happened beyond those four outputs; this review does not answer it.

8. Evidence appendix

8.1 Selected transaction inventory

All times below are explorer-displayed UTC on 24 October 2026. Full hashes are deliberately retained. E1’s internal reverted-call warning is a qualified success; the other selected transaction detail pages display Success.

8.2 Execution and voting address register

8.3 Source and evidence boundaries

Freezer verified-source viewer: reviewed functions are listed in the code discussion above. X token metadata and USDT token metadata each display 6 decimals. Public analyst statements establish attribution and reported context; selected explorer receipts establish transfers and events. Arithmetic subtotals are calculations over that stated scope. Ownership, full loss, current holdings and recovery remain unverified.