Audit log

Every state-changing event for Agave: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 15:33:46Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,748,317

   sig

   49rY9EPDDqLL…AtALfN5qcopyexplorer ↗

   hash

   BxBhVo5ejuqZ…fGi7b4bVcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4139 B) ▸

   {"actor":"system:backfill","investigation_id":"81f77d2a-2c49-4e61-9298-d94c9922ddbc","kind":"publish","page_slug":"agave","published_at":"2026-05-28T15:33:46.500Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Agave","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/agave-hundred-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/137932/defi-protocols-agave-and-hundred-finance-exploited-on-gnosis-chain-for-11-million","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2022/03/15/defi-lending-protocol-agave-plunges-over-20-amid-exploit-investigation","type":"other","url":""},{"credibility":3,"name":"https://fortune.com/crypto/2022/03/16/crypto-investor-scam-agave-defi/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/agave-hundred-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.vidma.io/blog/the-agave-and-hundred-finance-hack-a-11-7m-reentrancy-exploit","type":"other","url":""},{"credibility":3,"name":"https://medium.com/immunefi/a-poc-of-the-hundred-finance-heist-4121f23a098","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/unlucky-agave-and-hundred-finance-defi-protocols-exploited-for-11m","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/business/2022/03/15/defi-lending-protocol-agave-plunges-over-20-amid-exploit-investigation","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/agave","type":"other","url":""},{"credibility":3,"name":"https://x.com/agave_lending","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://fortune.com/crypto/2022/03/16/crypto-investor-scam-agave-defi/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://wiki.1hive.org/projects/agave","type":"other","url":""},{"credibility":3,"name":"https://medium.com/honeyswap/1hive-introduction-to-agave-agve-100e36fe3560","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/agave-token","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/agave-hundred-rekt","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/defi-protocols-agave-hundred-finance-hacked-attacker-steals-11m-worth-of-crypto/","type":"other","url":""}]}],"sources_used":[],"summary":"Agave was a decentralized lending protocol on Gnosis Chain forked from Aave v2, developed by members of the 1Hive community. On March 15, 2022, the protocol suffered a reentrancy exploit that drained approximately $5.5 million in user funds, part of a coordinated $11.7 million attack that simultaneously hit Hundred Finance. The protocol paused operations following the hack and formally closed down in March 2024 with no documented user compensation.","timeline":[{"date":"2021-01-01","event":"Agave protocol launched on xDAI (Gnosis Chain) by the 1Hive community as a fork of Aave v2","source":""},{"date":"2022-03-15","event":"Reentrancy exploit drains approximately $5.5 million from Agave and $6.2 million from Hundred Finance simultaneously; total losses $11.7 million. Attacker address: 0x0a16a85be44627c10cee75db06b169c7bc76de2c","source":""},{"date":"2022-03-15","event":"Agave pauses all contracts and announces investigation via Twitter","source":""},{"date":"2022-03-15","event":"Stolen funds transferred to Tornado Cash within hours of exploit; approximately 4,479 ETH laundered in total across both protocols","source":""},{"date":"2022-03-15","event":"AGVE token price drops more than 20% following public disclosure of exploit","source":""},{"date":"2024-03-25","event":"Agave DAO formally announces closure; redemption portal opened at agavefinance.eth.limo/redeem/ for AGVE token holders","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 80a55b0c-8e61-4aac-80f5-a72619318ed4copy
2. #2reviewby reviewerreviewer

   2026-06-15 18:24:08Z
   Score: 18 → 18 (no score change)
   The factual core of this investigation is accurate and well-supported: the March 15, 2022 reentrancy exploit, the $5.5M Agave / $6.2M Hundred Finance / $11.7M total figures, the Tornado Cash laundering of ~4,479 ETH, the AGVE price drop, and the March 2024 closure are all confirmed by multiple credible sources. The two partially-supported findings are (1) the protocol launch date is listed as 2021-01-01 in the timeline when documented sources confirm a September 1, 2021 launch, and (2) the 'no compensation' assertion is accurate for hack victims but conflates the absence of hack restitution with the AGVE governance-token redemption portal that was opened. No disputed or fabricated claims were found.
   anchoranchored

   chain

   ●mainnet-betaslot 426,687,961

   sig

   31ja7G4FMZ8y…uXNomgrGcopyexplorer ↗

   hash

   5n3u9ioPp2my…jYkdo15xcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1049 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-15T18:24:08.163Z","decision":"review","investigation_id":"81f77d2a-2c49-4e61-9298-d94c9922ddbc","new_score":18,"page_slug":"agave","prev_score":18,"reason":"The factual core of this investigation is accurate and well-supported: the March 15, 2022 reentrancy exploit, the $5.5M Agave / $6.2M Hundred Finance / $11.7M total figures, the Tornado Cash laundering of ~4,479 ETH, the AGVE price drop, and the March 2024 closure are all confirmed by multiple credible sources. The two partially-supported findings are (1) the protocol launch date is listed as 2021-01-01 in the timeline when documented sources confirm a September 1, 2021 launch, and (2) the 'no compensation' assertion is accurate for hack victims but conflates the absence of hack restitution with the AGVE governance-token redemption portal that was opened. No disputed or fabricated claims were found.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7b15d573-8405-4227-9b2d-d6bed52a4d88copy
3. #3review approveby judgejudge

   2026-06-15 18:24:08Z
   Score: 18 → 52 (+34)
   The reviewer confirmed 11 of 13 claims outright and partially supported the remaining 2 — both minor (an imprecise launch date in the timeline, and a nuance around hack-victim vs. governance-token redemption). Disputed claims stand at 0%. The two primary incidents (claim_findings[2] and claim_findings[5]) are both attribution type (b) 'suffered': Agave was exploited by an external attacker through a chain-level token behaviour it did not introduce, and its subsequent closure was an orderly wind-down with no evidence of fraudulent intent. Under the platform's fraud-likelihood scoring rubric, CRITICAL (0–19) is reserved for entities whose own conduct constitutes confirmed fraud, exit scams, or Ponzi schemes. Placing a hack victim at score 18 violates the anti-conflation rule. The reviewer's recommended score of 52 (CAUTIONARY) correctly reflects that the protocol is defunct, users received no hack restitution, and there is a minor unresolved audit-scope gap — without over-penalising for harm the entity suffered rather than caused. A positive delta of +34 is applied to correct this mis-classification.
   anchoranchored

   chain

   ●mainnet-betaslot 426,687,963

   sig

   5K797shu1zRk…Nh5DBh1Rcopyexplorer ↗

   hash

   6ifAyZEugtFT…K6wApRJGcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1462 B) ▸

   {"actor":"judge","decided_at":"2026-06-15T18:24:08.163Z","decision":"review_approve","investigation_id":"81f77d2a-2c49-4e61-9298-d94c9922ddbc","new_score":52,"page_slug":"agave","prev_score":18,"reason":"The reviewer confirmed 11 of 13 claims outright and partially supported the remaining 2 — both minor (an imprecise launch date in the timeline, and a nuance around hack-victim vs. governance-token redemption). Disputed claims stand at 0%. The two primary incidents (claim_findings[2] and claim_findings[5]) are both attribution type (b) 'suffered': Agave was exploited by an external attacker through a chain-level token behaviour it did not introduce, and its subsequent closure was an orderly wind-down with no evidence of fraudulent intent. Under the platform's fraud-likelihood scoring rubric, CRITICAL (0–19) is reserved for entities whose own conduct constitutes confirmed fraud, exit scams, or Ponzi schemes. Placing a hack victim at score 18 violates the anti-conflation rule. The reviewer's recommended score of 52 (CAUTIONARY) correctly reflects that the protocol is defunct, users received no hack restitution, and there is a minor unresolved audit-scope gap — without over-penalising for harm the entity suffered rather than caused. A positive delta of +34 is applied to correct this mis-classification.","score_delta":34,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e863f2be-a74d-481c-9828-f21ee77df2b1copy
4. #4rescoreby systemsystem

   2026-10-10 18:50:32Z
   Score: 52 → 50 (-2)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 50. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +6; no longer operating, so capped at 50; fact-check adjustments (+34) now shown as page reliability, not in the score.
   anchoranchored

   chain

   ●mainnet-betaslot 455,370,685

   sig

   46Fug8xpqNjC…r2eVbErhcopyexplorer ↗

   hash

   2tbyNDVGP8xZ…riwve8V3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (753 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:50:32.113Z","decision":"rescore","investigation_id":"81f77d2a-2c49-4e61-9298-d94c9922ddbc","new_score":50,"page_slug":"agave","prev_score":52,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 50. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +6; no longer operating, so capped at 50; fact-check adjustments (+34) now shown as page reliability, not in the score.","score_delta":-2,"score_model":"v2","sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 52f7a6fa-cc44-4e01-ad02-2042192f7c8dcopy
5. #5reviewby reviewerreviewer

   2026-10-16 04:56:54Z
   Score: 50 → 50 (no score change)
   The core 2022 exploit narrative (date, dollar figures, attacker address, root cause via non-standard ERC-677 bridged tokens, Tornado Cash laundering, AGVE price drop, and the Shegenerates victim account) is well-supported by the cited sources and corroborated by independent reporting. However, the page's account of the protocol's aftermath is materially wrong in two linked respects: it claims no documented compensation plan existed when GnosisDAO in fact voted on a reimbursement proposal (GIP-34) in April 2022, and it claims the protocol was 'effectively dormant' after the hack when it in fact redeployed within weeks and ran with several million dollars of TVL for roughly two more years. The TVL figure cited for the 2024 closure ($81,000) also does not match DeFiLlama's actual TVL on the stated closure date (~$2.66 million); $81,000 appears to be a current/recent figure mistakenly presented as the 2024 figure. The 2024 closure date itself is plausible — DeFiLlama shows a sharp TVL cliff beginning exactly March 25, 2024 — but no primary source for the announcement or redemption portal could be independently located.
   anchoranchored

   chain

   ●mainnet-betaslot 457,511,969

   sig

   5fxYY2QERp36…JkU9yUq4copyexplorer ↗

   hash

   235TcKSfizjj…o2ATnfuHcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1723 B) ▸

   {"actor":"reviewer","artifact_identity":"3c87de8c70f6810314079af9b94d5e19","decided_at":"2026-10-16T04:56:54.669Z","decision":"review","disputed_pct":0.2857,"findings_hash":"EtVQtxpvoG63CxpjtyRNdeKXGhrZVkPRzcKZsraJn5Nb","investigation_id":"81f77d2a-2c49-4e61-9298-d94c9922ddbc","mode":"findings_only","new_score":50,"page_content_hash":"5b6bdae3a28be5edc03b9b2917a4916d5548d6ec3e0d851d493dc4ca22064554","page_slug":"agave","prev_score":50,"reason":"The core 2022 exploit narrative (date, dollar figures, attacker address, root cause via non-standard ERC-677 bridged tokens, Tornado Cash laundering, AGVE price drop, and the Shegenerates victim account) is well-supported by the cited sources and corroborated by independent reporting. However, the page's account of the protocol's aftermath is materially wrong in two linked respects: it claims no documented compensation plan existed when GnosisDAO in fact voted on a reimbursement proposal (GIP-34) in April 2022, and it claims the protocol was 'effectively dormant' after the hack when it in fact redeployed within weeks and ran with several million dollars of TVL for roughly two more years. The TVL figure cited for the 2024 closure ($81,000) also does not match DeFiLlama's actual TVL on the stated closure date (~$2.66 million); $81,000 appears to be a current/recent figure mistakenly presented as the 2024 figure. The 2024 closure date itself is plausible — DeFiLlama shows a sharp TVL cliff beginning exactly March 25, 2024 — but no primary source for the announcement or redemption portal could be independently located.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 755db206-c732-4d2a-b88f-b868809acb57copy