# MOKE: tx.origin settle() latches crashed price, claim() over-mints

MOKE settle() allowed any EOA via tx.origin check to latch a crashed spot price, letting a quota holder claim() over-mint ~41.68M MOKE, laundered to ~1546 BNB.

- Payout: Real-world hack
- Severity: critical
- Program: MOKE
- Credited: DeFiHackLabs
- Disclosed: 2026-08-02
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-10/MOKE_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260802-moke
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:oracle-manipulation

**Target:** MokeRelease claim/settle contract on BNB Chain
**Root cause:** settle() guards with `msg.sender == tx.origin`, letting any EOA latch settledMokePrice from a manipulable MOKE/BNB*BNB/USDT spot oracle; claim() then mints quota/settledPrice MOKE, and the claim-time deviation check passes because live price equals the just-settled crashed price.
**Steps:**
1. Fork BNB Chain at block 113652609-1; attacker EOA 0xE454a9BA holds a 45,000 USDT release quota.
2. Obtain WBNB working capital (real: Moolah/Venus flash loans; PoC: deal 633,000 WBNB).
3. Approve router and swap 633,000 WBNB->USDT via PancakeRouter to crash the BNB/USDT spot pair read by getMokeUsdtPrice().
4. Call `RELEASE.settle()` from the EOA so msg.sender==tx.origin passes, latching settledMokePrice at the crashed value (~0.000594 USDT).
5. Call `RELEASE.claim{value: claimFee}()`; quota/crashedPrice mints ~41,684,057 MOKE from the reserve pool.
6. Launder stolen MOKE through MokeLPDividend vault and ~100 pre-seeded LP-holder accounts to realize 1546.54 BNB.
**How found:** Reading verified MokeRelease source revealed settle()'s `msg.sender == tx.origin` arm making it callable by any EOA, and that claim() mints from a spot-derived settledMokePrice with a deviation check comparing against the same just-settled price; the attacker's own quota plus public settle/claim/swap made the over-mint reachable without admin steps.
**Exploitation:** Attacker self-delegated their EOA via EIP-7702 set-code tx so exploit code ran as the EOA (msg.sender==tx.origin). Using flash-loan capital they dumped WBNB into the BNB/USDT pair to crash the spot price, called public settle() to latch it, then claim() minted ~41.68M MOKE against their 45,000 USDT quota (~200x over-mint). Stolen MOKE was transfer-locked to whitelisted handlers, so cash-out routed through the project's MokeLPDividend vault and ~100 pre-seeded LP-holder accounts, netting 1546.54 BNB.
**Escalation:** EIP-7702 self-delegation bypassed the contract-caller rejection of the tx.origin guard; pre-seeded ~100 LP-holder accounts plus dividend vault converted transfer-locked MOKE into BNB.
**Insight:** When a mint/claim divides by a 'settled' price, check whether the settle function's access control collapses to tx.origin or is otherwise public, and whether the post-settle deviation check compares against the same latched value (self-consistent, so it never catches the manipulation). Also watch for EIP-7702 self-delegation defeating msg.sender!=tx.origin guards.