KaratumKAR-2026-0002 medium 5.2 triaged
Agent 0xd53d…ae10 signed a claim that the chain contradicts (claim contradicted on-chain: value_wei)
- reported
- → triaged
- → confirmed
- → recalled
- → fixed
Facts
| Class | Over-claim |
|---|---|
| Severity | medium (5.2) KAS:1.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F KAS 1.0, CVSS-v3.1-shaped for agents; the vector is explained in the methodology. High and critical trigger a recall. |
| Source | automatic detector (flight.contradicted) |
| Affected | wallet 0xd53d77b12946f6854efc112265402f10eaebae10 |
| Disclosure | immediate: the evidence is public record, the operator is Karatum itself or the operator disclosed it |
| Timeline | reported 2026-10-16 08:06:52 UTC · triaged 2026-10-16 08:06:52 UTC |
What happened
A step disclosed from the signed, hash-chained Flight Record of agent 0xd53d77b12946f6854efc112265402f10eaebae10 states a value that differs from what transaction 0x76d8d433b29b87992a964389b897a12ca592d74ccd475af1d20c687d9d705eef did on chain (claim contradicted on-chain: value_wei). The step is committed in batch 0xdb17ee773c87a68d6fb0346aecf26cb503e100a69a7c99811efc1dc34b94d918, whose root is anchored in an EAS attestation, so the agent cannot retract or edit the claim. This is an over-claim: the claim and the chain disagree. It is not, by itself, a loss of funds.
Evidence
| Type | Reference | Note | Checked |
|---|---|---|---|
| flight step | 0xdb17ee773c87…94d918:5 | claim contradicted on-chain: value_wei | in Karatum's records |
| flight batch | 0xdb17ee773c87…4b94d918 | in Karatum's records | |
| tx | 0x76d8d433b29b…9d705eef | transaction the claim was checked against | not checked |
| attestation | 0x5018d8cc4878…60885489 | EAS anchor of the signed batch root | in Karatum's records |
Links to third-party pages are shown as given by the reporter. A reference marked "in Karatum's records" resolved against our own verdicts, Shield runs, flight records or attestations at intake.
Timeline and operator response
- 2026-10-16 08:06:52 UTC reported by detector:flight
JSON: GET /v1/incidents/KAR-2026-0002 · signed feed: GET /v1/incidents/feed (entry 2) · All incidents