Arkadiko Governance Attack Drains Vaults, Depegs USDA Stablecoin on Stacks

A malicious smart contract passed Arkadiko's on-chain governance vote on October 22, 2026 and was executed to drain ~2 million stSTX and ~1.65 sBTC from protocol vaults, collapsing TVL by ~90% and pushing the USDA stablecoin off its $1 peg. An official post-mortem had not been published as of October 23.

Root Cause

Arkadiko is a CDP (collateralized debt position) protocol on the Stacks blockchain, a Bitcoin Layer-2 that settles finality on Bitcoin via the Nakamoto consensus upgrade. It uses Clarity smart contracts (deterministic, decidable — not EVM/Solidity) to issue its USDA dollar stablecoin against stSTX and sBTC collateral. The protocol has an on-chain governance system through which token holders can vote to execute arbitrary contract calls.

On October 22, 2026, an attacker submitted a governance proposal embedding a malicious Clarity contract designed to withdraw vault collateral. The proposal passed the voting process and the contract was executed. The specific attack vector — whether through vote-buying, flash-loan-boosted votes, a low quorum threshold, a missing timelock, or a privileged proxy call — has not been confirmed in a published post-mortem as of this writing.

;; Illustrative Clarity pseudo-code — exact attacker contract not yet published
;; A passed governance proposal with vault-draining execute logic:
(define-public (execute)
  (begin
    ;; If governance grants this contract protocol-level call privileges:
    (try! (contract-call? 'SP...arkadiko-vault-manager withdraw-collateral u2000000))
    (try! (contract-call? 'SP...arkadiko-sbtc-vault withdraw-sbtc u165000000))
    (ok true)
  )
)

Note: The above is illustrative. Arkadiko has not published the attacker's contract.

Attack Steps

Step	Action
1	Attacker creates a malicious Clarity contract with vault-draining `execute` function
2	Submits contract as a governance proposal to Arkadiko DAO
3	Proposal passes on-chain vote (specific mechanism unconfirmed)
4	Executed contract drains ~2,000,000 stSTX and ~1.65 sBTC from protocol vaults
5	Loss of collateral backing causes USDA to lose its $1 peg
6	Protocol TVL falls ~90% within 24 hours of the attack

Impact

Assets drained: ~2,000,000 stSTX + ~1.65 sBTC (USD value unconfirmed pending post-mortem)
Chain: Stacks (Bitcoin L2, Clarity — not EVM)
Stablecoin: USDA lost its dollar peg
TVL: ~90% reduction within 24 hours
Disclosure: Team announced on X at approximately 20:29 UTC, October 22, 2026
Status: Preliminary — no official post-mortem published as of October 23, 2026

Lessons for Auditors

Although Stacks uses Clarity rather than Solidity, these governance attack vectors apply verbatim to EVM protocols (Compound Governor Bravo, Aave governance, OpenZeppelin Governor) and any protocol with executable on-chain proposals.

Governance timelocks are mandatory, not optional. Executed proposals must pass through a delay (minimum 48–72 hours recommended) after voting closes, giving the community and a guardian multisig time to veto malicious actions.
Scope-limit executable proposals. Governance contracts should not hold unrestricted call privileges over protocol internals. Use a dedicated Executor contract with a strict allowlist of callable selectors/contracts.
Quorum and anti-flash-loan vote protections. Minimum participation thresholds should be set high enough that they cannot be met by a single large holder or a flash-loan-boosted vote. Use snapshot-based or time-weighted voting power.
Emergency guardian. A multisig guardian should be able to veto or cancel proposals within the timelock window, acting faster than the full governance flow.
Separation of upgrade vs. fund access. Proposals that move user funds should require a separate, higher quorum and longer timelock than routine parameter changes.