Priors borrowed-contract Transfer event authenticity advisory

Evidence record

Maintainer proof of inflated credit-verification results from untrusted Transfer events despite a prior asset/decimals patch.

Read the original source ↗

Claim-level citations (2)

• supportsPriors credit verification accepted borrower-emitted Transfer events as financial proof: The Priors credit-verification advisory reports that fake borrower-controlled Transfer logs and asset-decimal metadata could satisfy a source-verified credit check even without the corresponding trusted-token settlement.

  GHSA-227q-mpxj-29j7: fake Transfer emitter, decimal binding and credit verifier reproduction

• supportsPriors credit verification accepted borrower-emitted Transfer events as financial proof: Priors credit verification accepted token Transfer logs emitted by an attacker-controlled contract as evidence of repayment value despite the expected asset relationship. The attack requires a compromised credit-writer key or equivalent access to submit the offending proof and transaction references. An attacker could inflate a computed credit score without the verified intended asset transfer or balance change.

  GHSA-227q-mpxj-29j7: fake Transfer emitter, decimal binding and credit verifier reproduction