mora
Demo · no wallet needed

It’s 2:07 AM. Someone has your key.

A phishing site stole your wallet key while you slept. The thief has full owner access to your Mora vault. Play the thief first, then play your guardian.

Time
02:07
Most anyone can take now
$0
In the vault
$10,000
Attacker got
$0
Safe in your cold wallet
$0
Rules: $200 instant per day · nothing instant 22:00 to 07:00 · everything else waits 12h · 1 guardian · recovery is your cold wallet
NextStart in the Thief panel: try to take the money.
02:07can take $0attacker $0Thief ↓
T
Thief
holds your stolen key

Vault queue

0 waiting

Nothing waiting.

A
Ada, your sister
your guardian

No alerts. The phone is quiet.

A guardian can cancel, freeze or rescue. Rescue sends money only to your recovery address, and it voids everything in the queue.

What happened

  1. 02:07Vault: 02:07 AM. Your vault holds $10,000. Instant allowance at night: $0.

This simulation follows the same rules as the MoraVault contract. 30 parity tests check it against the real contract step by step. See the attack on-chain ↓

On-chain proof

This attack ran on Base Sepolia, with the same contract.

  1. 01Vault created: $200/day instant, 1h delay, 1 guardian, recovery wallet settx ↗
  2. 02$10,000 test USDC depositedtx ↗
  3. 03$50 sent instantly, inside the allowancetx ↗
  4. 04Stolen key asks to send $5,000. The vault queues ittx ↗
  5. 05Stolen key asks to change the recovery address. Also queuedtx ↗
  6. 06Guardian presses Rescue. $9,950 goes to the recovery wallet and both requests are void. The thief gets $0tx ↗
See that vault liveFactory on Basescan ↗