Case · DiggingBeagle record

Priors credit verification accepted borrower-emitted Transfer events as financial proof

Priors credit verification accepted token Transfer logs emitted by an attacker-controlled contract as evidence of repayment value despite the expected asset relationship. An attacker could inflate a computed credit score without the verified intended asset transfer or balance change.

Scope

The attack requires a compromised credit-writer key or equivalent access to submit the offending proof and transaction references. The local verification acceptance is not evidence of on-chain money creation or a live borrower benefit.

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
Evidence
Grade B
Remediation
mitigation available
AI role
AGAINST AI
Basis and provenance

The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A mitigation or source change is described, but complete repair of every affected deployment is not independently confirmed. Boundary: A Transfer event is not authoritative proof that the intended token transferred the claimed amount.

Assessed Oct 29, 2026 using diggingbeagle.assessment/1.

At a glance

Mechanism and trust boundary

  1. 01

    Step

  2. 02

    Step

  3. 03

    Step

Timeline

  1. Oct 25, 2026
    disclosure

    Public disclosure

Claims & evidence

CLM-ENRICH-20261029-29The Priors credit-verification advisory reports that fake borrower-controlled Transfer logs and asset-decimal metadata could satisfy a source-verified credit check even without the corresponding trusted-token settlement.supported

Basis: reported finding

Link to claim
CLM-CP23-PRIORS-TRANSFER-EVENT-1Priors credit verification accepted token Transfer logs emitted by an attacker-controlled contract as evidence of repayment value despite the expected asset relationship. The attack requires a compromised credit-writer key or equivalent access to submit the offending proof and transaction references. An attacker could inflate a computed credit score without the verified intended asset transfer or balance change.supported

Basis: reported finding

Link to claim

Implications

An attacker could inflate a computed credit score without the verified intended asset transfer or balance change.

Controls and mitigations

  • Bind events to the trusted token contract and on-chain balance deltas rather than checking for matching event names and decimals alone.

Unknowns and contradictions

  • The local verification acceptance is not evidence of on-chain money creation or a live borrower benefit.

Sources and citation

Material revision history

  1. Oct 29, 2026 · Canonical change recorded · new in release · revision 202