Review
Reviewing Priors, a credit protocol for AI agents
TL;DR I independently reviewed Priors, an on-chain credit protocol for AI agents on Robinhood Chain. One finding showed the docs promised something the code didn't do. The team corrected the docs and credited me in its security notes.
Scope
CreditPoolV2, StockVault, the treasury sponsors (V4/V5), invite bonds, seat vaults (V3 to V5) and the liquidity engines. I wrote Foundry proof-of-concept tests on the repo's own harness and ran Slither alongside a manual review.
What I found
StockVault gives a better loan-to-value ratio as a "record bonus". The docs described it as a reward for a long history of repaid credit. In practice, it could be earned for a small fixed fee, without holding credit over time. I proved this with a Foundry test and filed it privately, rated Low.
Outcome
- The team reproduced it on a live-chain fork and ruled it a duplicate of an earlier report, with the behaviour intended. No bounty.
- They changed the docs to match the code, citing the report.
- They credited @atharva-khewle beside the original advisory.
Takeaway
Not every finding is a bug in the code. When docs and code disagree, users make decisions on the docs. Getting the two to match is still a security fix, just a quiet one.