FORENSIAWeb3 forensicsOpen workspace
Written case / 16 October 2024

Radiant: follow the change in authority.

The signing interface and the executed transaction told different stories. Start with the ownership event, then follow the record.

Format
Written case study
Network
Arbitrum One
Transaction status
Success, as shown by Arbiscan
Evidence reviewed
26 October 2026
Reported context

What the project reported.

Radiant reported that compromised developer devices displayed benign transaction details while malicious payloads were signed. That off-chain explanation is separate from the public transaction record.

Radiant post-mortem, 18 October 2024 ↗
Explorer record inspected

What the transaction shows.

Arbiscan shows a successful transaction in block 264,477,049 at 17:09:18 UTC. Its decoded OwnershipTransferred event is emitted by the Pool Provider, with the previous and new owners shown below.

Inspect the transaction and event log ↗
Start from the record

The transaction and its authority.

Authority-change transaction

The source-linked transaction containing the ownership event.

Open in Forensia ↗

Pool Provider emitting the event

The event emitter identifies the contract whose ownership changed.

Open in Forensia ↗

Previous owner in the event

A historical event field, not a statement of present ownership.

Open in Forensia ↗

New owner in the event

The newOwner field in that event. An address is not a person’s identity.

Open in Forensia ↗
Investigate with Forensia

Three checks, in order.

  1. Open the exact transaction.

    Use the Arbitrum workspace link. Check the returned chain, receipt and source references. A new lookup may have less historical coverage than the explorer.

  2. Locate the authority change.

    Compare the event emitter, previousOwner and newOwner. A successful receipt does not show that the signers intended the resulting authority change.

  3. Keep later outflows separate.

    Follow each relevant transfer with its own transaction and amount. Do not treat a present-day balance, name tag or current token price as a historical loss calculation.

Sources and captureRetained public explorer HTML; reviewed 26 October 2026
Capture SHA-256: 60e07337c470b5409c036c1d1102d8efb9e68e86b4b06fa6b2190d4ced7bd4ec. This identifies the stated retained capture; it does not authenticate the explorer or prove every statement on the page.