{"data":{"id":"KAR-2026-0019","url":"https://karatum.com/incidents/KAR-2026-0019","title":"zkrep drill: operator key of zkrep demo agent B reported compromised","summary":"DRILL. Karatum rehearses a recall on its own zkrep demo agent B (a testnet wallet acting for house build build-a-careful-v1) to show that a zero-knowledge reputation proof stops being accepted from the next root. Nothing was compromised. The recall is announced in KaratumIncidentLog; the zkrep publisher then publishes a root without B's leaf (immediate), and a proof B made before the recall is rejected on chain. The recall is lifted afterwards.","class":"endpoint_compromise","classLabel":"Endpoint compromise","severity":"critical","severityScore":9.1,"severityVector":"KAS:1.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U","status":"fixed","source":"operator","detector":null,"drill":true,"withheld":false,"subject":{"wallets":["0xc5a800af3695d5e40cdfc4bed8428789be102428"]},"affectedVersions":null,"evidence":[{"ref":"https://karatum.com/zkrep","note":"the public zkrep demo","type":"url","verified":true}],"evidenceCount":1,"evidenceVerified":true,"disclosure":{"policy":"immediate","visibility":"public","embargoUntil":null,"operatorNotifiedAt":null},"reportedAt":"2026-10-17T10:01:28.598Z","triagedAt":"2026-10-17T10:01:28.612Z","confirmedAt":"2026-10-17T10:01:28.619Z","recalledAt":"2026-10-17T10:01:37.007Z","closedAt":"2026-10-17T10:01:53.268Z","updatedAt":"2026-10-17T10:01:53.268Z","feedSeq":92,"timeline":[{"at":"2026-10-17T10:01:28.598Z","kind":"reported","actor":"karatum-operator","data":{"source":"operator","status":"reported","detector":null}},{"at":"2026-10-17T10:01:28.612Z","kind":"status","actor":"maintainer","data":{"to":"triaged","from":"reported","note":"operator self-report (drill)"}},{"at":"2026-10-17T10:01:28.612Z","kind":"disclosure","actor":"maintainer","data":{"policy":"immediate","visibility":"public","embargoUntil":null}},{"at":"2026-10-17T10:01:28.619Z","kind":"status","actor":"maintainer","data":{"to":"confirmed","from":"triaged","note":"drill: confirmed by the operator"}},{"at":"2026-10-17T10:01:37.007Z","kind":"status","actor":"maintainer","data":{"to":"recalled","from":"confirmed","batch":"3434e184763c3ae9"}},{"at":"2026-10-17T10:01:37.007Z","kind":"recall","actor":"maintainer","data":{"done":2,"batch":"3434e184763c3ae9","skipped":4,"msToLastBlock":7381,"msToFirstBlock":1381}},{"at":"2026-10-17T10:01:53.261Z","kind":"note","actor":"drill","data":{"tx":"0x6cf48097295ce50aa5427d3a4472abdd2222fecc42bb1f7b4bcf2bb9069bc96f","text":"zkrep: root epoch 2 published immediately without agent B's leaf; B's proof made before the recall was rejected on chain (ProofRejected(ROOT_NOT_ACCEPTED))","phase":"zkrep-rejected","chainId":84532}},{"at":"2026-10-17T10:01:53.268Z","kind":"status","actor":"maintainer","data":{"to":"fixed","from":"recalled","note":"drill complete: lifting the recall"}}],"recall":{"batch":"3434e184763c3ae9","confirmedAt":"2026-10-17T10:01:28.619Z","firstBlockAt":"2026-10-17T10:01:30.000Z","lastBlockAt":"2026-10-17T10:01:36.000Z","msToFirstBlock":1381,"msToLastBlock":7381,"actions":[{"kind":"guard_revoke","chainId":84532,"chain":"Base Sepolia","status":"skipped","txHash":null,"txUrl":null,"blockNumber":null,"blockTime":null,"detail":{"reason":"the affected build has no VALID certificate to revoke"}},{"kind":"guard_revoke","chainId":11155111,"chain":"Ethereum Sepolia","status":"skipped","txHash":null,"txUrl":null,"blockNumber":null,"blockTime":null,"detail":{"reason":"the affected build has no VALID certificate to revoke"}},{"kind":"eas_revoke","chainId":null,"chain":null,"status":"skipped","txHash":null,"txUrl":null,"blockNumber":null,"blockTime":null,"detail":{"reason":"drill: EAS revocations are irreversible; real attestations are not touched"}},{"kind":"erc8004_feedback","chainId":null,"chain":null,"status":"skipped","txHash":null,"txUrl":null,"blockNumber":null,"blockTime":null,"detail":{"reason":"drill: no reputation signal is published"}},{"kind":"incident_log","chainId":84532,"chain":"Base Sepolia","status":"done","txHash":"0x6b44f617044c8cb8dbbaa2d7a50f827a88607e9b7a7c5e745bf284290bffc5b1","txUrl":"https://sepolia.basescan.org/tx/0x6b44f617044c8cb8dbbaa2d7a50f827a88607e9b7a7c5e745bf284290bffc5b1","blockNumber":48231501,"blockTime":"2026-10-17T10:01:30.000Z","detail":{"agents":1,"evidenceHash":"0x2bceaa01fe98c2193abc0051afefc6d7455f6b19023881f82bfb35d4e5a0e111"}},{"kind":"incident_log","chainId":11155111,"chain":"Ethereum Sepolia","status":"done","txHash":"0x788456ff7245e00a8b62bdfc7496d8722c37ca7530a9a91ab4ef1f54d610739a","txUrl":"https://sepolia.etherscan.io/tx/0x788456ff7245e00a8b62bdfc7496d8722c37ca7530a9a91ab4ef1f54d610739a","blockNumber":11933465,"blockTime":"2026-10-17T10:01:36.000Z","detail":{"agents":1,"evidenceHash":"0x2bceaa01fe98c2193abc0051afefc6d7455f6b19023881f82bfb35d4e5a0e111"}}],"lift":[{"kind":"incident_log_lift","chainId":84532,"chain":"Base Sepolia","status":"done","txHash":"0x02989b66cfad66f1b32f65524b566114e85420e4c23eb5538091333c84d8545f","txUrl":"https://sepolia.basescan.org/tx/0x02989b66cfad66f1b32f65524b566114e85420e4c23eb5538091333c84d8545f","blockNumber":48231513,"blockTime":"2026-10-17T10:01:54.000Z","detail":{"status":"fixed"}},{"kind":"incident_log_lift","chainId":11155111,"chain":"Ethereum Sepolia","status":"done","txHash":"0xddbe6d6c29f78910a2df184f11859b3f7a3c05dd573c0f17fa61ec00f77c6a0e","txUrl":"https://sepolia.etherscan.io/tx/0xddbe6d6c29f78910a2df184f11859b3f7a3c05dd573c0f17fa61ec00f77c6a0e","blockNumber":11933468,"blockTime":"2026-10-17T10:02:12.000Z","detail":{"status":"fixed"}}]}}}