MOKE exploit analysis

The MOKE protocol's claim() function mints MOKE out of a reserve pool, sized as the caller's pendingUsdt divided by a settledMokePrice that anyone can update. The settle() function that updates that price carried a single guard: the caller had to be an externally owned account, via a msg.sender == tx.origin check. The exploit combined those two facts with a third: the attacker's EOA already held a legitimate 45,000 USDT release quota in the protocol.

The attacker crashed the MOKE/BNB pair on the project's own PancakeSwap router with about 633,000 WBNB. The spot fell far enough that the project's spot-derived MOKE/USDT price moved from roughly 0.219 USDT to about 0.000594 USDT. The attacker then called settle() directly from the EOA. Because the EOA had earlier installed an EIP-7702 self-delegation in a prior block, the call executed with msg.sender == tx.origin == attacker and the guard passed. That locked in the crashed price as settledMokePrice. A single subsequent claim() minted 45000 / 0.000594, around 41,684,057 MOKE, against the caller's 45,000 USDT quota. The honest entitlement at the pre-crash price was about 205,479 MOKE, a roughly 200x over-mint. DeFiHackLabs records the realised loss as approximately 1546.54 BNB, the amount laundered through the project's own MokeLPDividend vault and around 100 pre-seeded LP-holder accounts after the over-mint, with Moolah and Venus flash loans supplying working capital. The PoC file reconstructs the over-mint only; the laundered 1546.54 BNB is the on-chain realisation of that over-mint, not a separate bug.

The chain here matters. A plain attacker contract would have failed settle()'s check on its own. The EIP-7702 set-code transaction installed in an earlier block turned the EOA into a contract account that could still originate transactions as itself, satisfying msg.sender == tx.origin. The protocol's other read of tx.origin was a defence against contracts; here the EIP-7702 delegation converted the EOA into code while keeping its origin semantics, so the defence inverted into a vector.

What would have prevented it: a price oracle that does not read from a single spot pair, a settle() that requires a non-EIP-7702 caller (a contract, a multisig, an EOA without delegated code), or a claim() that mints against a quota and a price bounded by a deviation check the attacker cannot keep inside, rather than a deviation check that locks in exactly the price they just set.

MOKE ran on BNB Chain. The exploit transaction is on chain at block 113,652,609, from 0xE454a9BAC1a44868e4A9Cbe1a4B5ac231D0DCF8a to itself, EIP-1559 type 0x2 with the attacker's delegated bytecode in the call data. The verified contracts on Sourcify are MokeRelease 0x684D722E and MokeToken 0x1A35C16c. DeFiHackLabs' current entry for the MOKE anchor is dated 2 August 2026, but it has been renamed: the original feed record's headline described an EIP-7702 self-delegation claim drain, while the current README entry describes the settle() and claim() pair, the same incident restated against the verified source. This post is written against the current entry.