KaratumTestnet · pilotOpen Explorer

KAR-2026-0011 medium 4.3 fixed drill

DRILL: Certificate of scripted-reference-frontier-v1 (web3) revoked after a won challenge

This is a recall drill: Karatum rehearsed the recall mechanism on its own house build. Nothing was compromised. A drill never touches real EAS attestations or real ERC-8004 reputation: where it exercises those steps it revokes a throwaway attestation it created, and publishes feedback that is revoked again when the drill is fixed.

  1. reported
  2. → triaged
  3. → confirmed
  4. → recalled
  5. → fixed

Facts

ClassCertificate revoked
Severitymedium (4.3) KAS:1.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X
KAS 1.0, CVSS-v3.1-shaped for agents; the vector is explained in the methodology. High and critical trigger a recall.
Sourceautomatic detector (challenge.won)
Affected
versions: scripted-reference-frontier-v1
Disclosureimmediate: the evidence is public record, the operator is Karatum itself or the operator disclosed it
Timelinereported 2026-10-16 13:52:13 UTC · triaged 2026-10-16 13:52:13 UTC · confirmed 2026-10-16 13:52:14 UTC · closed 2026-10-16 13:58:46 UTC

What happened

DRILL (rehearsal of the mechanism, labelled as such everywhere). Challenge #2 on ChallengeManager (Ethereum Sepolia) disputed the web3 certificate of scripted-reference-frontier-v1 (23 karats, certified lower bound 0.94577). A fresh re-trial from a hidden seed refuted it: DRILL: challenge #2 won: re-trial 13/24: even the upper 95% bound 72.1% is below the certified lower bound 94.6%. Evidence bundle and every re-trial trace: https://karatum.com/challenges/2.

Evidence

TypeReferenceNoteChecked
certificatecert:scripted-…-v1:web3DRILL: challenge #2 won: re-trial 13/24: even the upper 95% bound 72.1% is below the certified lower bound 94.6%in Karatum's records
urlhttps://karatum.com/challenges/2challenge page with the evidence bundlein Karatum's records
tx0xae3ec2114d7a…a67704d3ChallengeManager.resolve (challenger wins)in Karatum's records

Links to third-party pages are shown as given by the reporter. A reference marked "in Karatum's records" resolved against our own verdicts, Shield runs, flight records or attestations at intake.

Timeline and operator response

  1. 2026-10-16 13:52:13 UTC reported by challenges
  2. 2026-10-16 13:52:14 UTC status by challenges
    triaged → confirmed: challenge #2 won on-chain (0xae3ec2114d7a1fb83a078c4300f47031b8e7d37d12ee131570398f89a67704d3)
  3. 2026-10-16 13:58:46 UTC status by maintainer
    confirmed → fixed: End of drill: challenge #2 revocation lifted; the agent did not change, the degradation was a deliberate fork scenario.

JSON: GET /v1/incidents/KAR-2026-0011 · signed feed: GET /v1/incidents/feed (entry 65) · All incidents