Audit log

Every state-changing event for Aperture LM: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 19:42:47Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,349,734

   sig

   36fzsa1q1MCn…tZZdTWvZcopyexplorer ↗

   hash

   FTzjepKoBAvT…5mfRNqsfcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6416 B) ▸

   {"actor":"system:backfill","investigation_id":"012e009b-3cec-4ec2-9443-5a1873c079ce","kind":"publish","page_slug":"aperture-lm","published_at":"2026-05-26T19:42:47.797Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Aperture LM","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blocksec.com/blog/17m-closed-source-smart-contract-exploit-arbitrary-call-swapnet-aperture","type":"other","url":""},{"credibility":3,"name":"https://coinpedia.org/news/defi-hack-alert-aperture-finance-smart-contract-exploit-suffers-3-67m-loss/","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/aperture-finance-hack-analysis-22dca439ff33","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/aperture-finance-reports-exploit-and-urges-users-to-revoke-access/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.amlbot.com/13-5m-lost-in-aperture-finance-swapnet-exploit-full-on-chain-breakdown/","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/news/643634","type":"other","url":""},{"credibility":3,"name":"https://coinpedia.org/news/defi-hack-alert-aperture-finance-smart-contract-exploit-suffers-3-67m-loss/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.aperture.finance/docs/transparency/security-audit","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/aperture-finance-hack-analysis-22dca439ff33","type":"other","url":""},{"credibility":3,"name":"https://blocksec.com/blog/17m-closed-source-smart-contract-exploit-arbitrary-call-swapnet-aperture","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/ApertureFinance/status/2015938720453820752","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/aperture-finance-reports-exploit-and-urges-users-to-revoke-access/","type":"other","url":""},{"credibility":3,"name":"https://cryptoadventure.com/aperture-finance-reports-v3-v4-contract-exploit-halts-front-end-functions/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinmarketcap.com/currencies/aperture-finance/","type":"other","url":""},{"credibility":3,"name":"https://alphagrowth.io/aperture-lm","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@aperturefinance/aperture-finance-aptr-fca15735d698","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/aperture-finance","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/academy/article/what-is-aperture-finance","type":"other","url":""},{"credibility":3,"name":"https://alphagrowth.io/aperture-lm","type":"other","url":""},{"credibility":3,"name":"https://chainbroker.io/projects/aperture-finance/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://zachxbt.mirror.xyz/","type":"other","url":""},{"credibility":3,"name":"https://blocksec.com/blog/17m-closed-source-smart-contract-exploit-arbitrary-call-swapnet-aperture","type":"other","url":""},{"credibility":3,"name":"https://coinpedia.org/news/defi-hack-alert-aperture-finance-smart-contract-exploit-suffers-3-67m-loss/","type":"other","url":""}]}],"sources_used":[],"summary":"Aperture LM (also marketed as Aperture Finance) is a multi-chain DeFi liquidity management protocol that launched in 2022 and raised $12 million at a reported $250 million valuation. On January 25, 2026, the protocol suffered a critical smart contract exploit due to insufficient input validation in its V3 and V4 helper modules, resulting in $3.67 million stolen from Aperture directly and contributing to a combined ~$17 million loss across a coordinated attack that also hit SwapNet. Stolen funds were laundered through Tornado Cash, no public compensation plan for affected users has been confirmed, and the protocol's closed-source contract architecture was identified as a compounding risk factor that hindered independent security review.","timeline":[{"date":"2022-01-01","event":"Aperture Finance founded; initial audit of Terra DNS module by Oak Security completed March 2022.","source":""},{"date":"2022-08-01","event":"Oak Security/Solidified audit of Avalanche PDN Strategies completed September 2022.","source":""},{"date":"2023-05-08","event":"First Narya.ai audit of UniV3 automation contracts completed.","source":""},{"date":"2023-07-03","event":"Second Narya.ai audit of UniV3 automation contracts completed.","source":""},{"date":"2023-09-29","event":"Veridise audit of UniV3 fork deployment completed — last documented audit on record.","source":""},{"date":"2024-05-31","event":"APTR token officially launched on Ethereum, Arbitrum, and Mantle Network.","source":""},{"date":"2024-06-10","event":"APTR token reaches all-time high of approximately $0.12497.","source":""},{"date":"2025-12-31","event":"APTR token ends 2025 down approximately 99.25% year-over-year, trading near $0.00005.","source":""},{"date":"2026-01-25","event":"Arbitrary-call vulnerability in Aperture Finance V3/V4 helper module exploited across Ethereum, Arbitrum, Base, and BNB Chain; $3.67 million stolen. Same attacker simultaneously exploits SwapNet for ~$13.4 million; combined losses reach ~$17 million. Exploit first flagged by PeckShield.","source":""},{"date":"2026-01-25","event":"Aperture Finance halts frontend functions, issues emergency advisory urging users to revoke approvals for contract 0xD83d960deBEC397fB149b51F8F37DD3B5CFA8913.","source":""},{"date":"2026-01-27","event":"Attacker deposits approximately 1,242.7 ETH (~$2.4 million) into Tornado Cash in structured batches. AMLBot publishes initial on-chain findings.","source":""},{"date":"2026-01-28","event":"BlockSec publishes detailed technical analysis of both the Aperture Finance and SwapNet exploits, attributing root cause to insufficient input validation in closed-source contracts.","source":""},{"date":"2026-02-03","event":"AMLBot publishes full on-chain forensic breakdown; secondary attacker linked to Li.Fi/Jumper Exchange exploiter network.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7a8cdf64-b133-4f80-a136-21df1b710d48copy
2. #2rescoreby systemsystem

   2026-10-10 18:44:06Z
   Score: 28 → 58 (+30)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 58. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +8.
   anchoranchored

   chain

   ●mainnet-betaslot 455,363,716

   sig

   4z9rdCh1dgCy…aJQhYRvtcopyexplorer ↗

   hash

   J6VxFaMmKMwj…EctCKUErcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (642 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:44:06.406Z","decision":"rescore","investigation_id":"012e009b-3cec-4ec2-9443-5a1873c079ce","new_score":58,"page_slug":"aperture-lm","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 58. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +8.","score_delta":30,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d25ac3a9-1988-4aef-8828-2e8e6726e425copy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-10-16 03:28:48Z
   Score: 58 → 57 (-1)
   SolidityScan's post-mortem confirms the Jan 25, 2026 Aperture Finance exploit across Ethereum, Arbitrum and Base caused by an arbitrary-call vulnerability from insufficient input validation, with losses exceeding $3.67M, matching the submission.
   Source:https://blog.solidityscan.com/aperture-finance-hack-analysis-22dca439ff33

   Wayback:archived snapshot2026-09-21 05:08:32Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,487,448

   sig

   5diNBQmtDiqd…WJj25EGYcopyexplorer ↗

   hash

   3fsyGXL4dr3w…NZDW4tidcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (714 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-16T03:28:48.316Z","decision":"accept","investigation_id":"012e009b-3cec-4ec2-9443-5a1873c079ce","new_score":57,"page_slug":"aperture-lm","prev_score":58,"reason":"SolidityScan's post-mortem confirms the Jan 25, 2026 Aperture Finance exploit across Ethereum, Arbitrum and Base caused by an arbitrary-call vulnerability from insufficient input validation, with losses exceeding $3.67M, matching the submission.","score_delta":-1,"sequence_num":3,"submission_content_hash":"909f1e5b8d9e280f58de814a0a82718d72cd6af35d6a207bf82be83db23d15a1","submission_id":"36e42414-b3b8-4976-8a36-05eed0caeba6","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 82a2aa49-8dba-4806-97c4-fe51ffb6759acopy
4. #4reviewby reviewerreviewer

   2026-10-30 12:34:43Z
   Score: 57 → 57 (no score change)
   The core exploit facts hold: date, losses, chains, selector, contract addresses, audit list, bridging and the closed-source finding. Weaker points are the PeckShield first-flag attribution, the 'primary attacker' label for an address AMLBot calls a copycat wallet, and the unverified Tornado Cash figure. The ZachXBT section asserts a flag it cannot source, and the token and team claims were not verified. Current status could not be determined beyond the post-exploit frontend halt.
   anchoranchored

   chain

   ●mainnet-betaslot 463,287,069

   sig

   63zy2brYxZKM…YUyEN6Nzcopyexplorer ↗

   hash

   BKAH9M5pAe9q…yFMaSCa8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1333 B) ▸

   {"actor":"reviewer","artifact_identity":"f6b898824275a9670234d62e4a72b022","decided_at":"2026-10-30T12:34:43.345Z","decision":"review","disputed_pct":0.2727,"findings_hash":"7JWFWt2bLaq2vhcAUEftQaypHeJ8WqcmgtiYctBJpR7M","investigation_id":"012e009b-3cec-4ec2-9443-5a1873c079ce","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":57,"omissions":{"material":0,"total":1},"page_content_hash":"6702a3c1577601385053cc5c208449a28d81d63daf6bf25dbdf1eb34886b4a64","page_slug":"aperture-lm","prev_score":57,"reason":"The core exploit facts hold: date, losses, chains, selector, contract addresses, audit list, bridging and the closed-source finding. Weaker points are the PeckShield first-flag attribution, the 'primary attacker' label for an address AMLBot calls a copycat wallet, and the unverified Tornado Cash figure. The ZachXBT section asserts a flag it cannot source, and the token and team claims were not verified. Current status could not be determined beyond the post-exploit frontend halt.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6e861729-b172-483e-a030-24427d2d0b62copy
5. #5review reviseby judgejudge

   2026-10-30 12:34:43Z
   Score: 57 → 57 (no score change)
   The core exploit facts hold: the date, the losses, the affected chains, the vulnerable function, the contract addresses and the audit list were all confirmed (claim_findings[0], [1], [6]). Three claims could not be verified (claim_findings[8], [9], [10]), putting the unverified share at exactly 30%, and three more are only partly supported: the PeckShield first-flag attribution, the 'primary attacker' label for an address AMLBot calls a copycat wallet, and the Tornado Cash figure (claim_findings[2], [3], [4]). The page is placed at the upper end of the minor band instead of the significant band because none of the unverified items is a core allegation, no claim was disputed, the one omission is minor, and the reviewer's confidence is low (0.55). The high-priority gap on current status (whether any post-mortem, compensation or relaunch has happened) and the ZachXBT section, which asserts a flag the page admits it cannot source, should be corrected.
   anchoranchored

   chain

   ●mainnet-betaslot 463,287,074

   sig

   3x77YGPddwFW…WWsj792Tcopyexplorer ↗

   hash

   Gpwvqe55XwXt…ERC8fe5Ccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1606 B) ▸

   {"actor":"judge","artifact_identity":"f6b898824275a9670234d62e4a72b022","band_override":null,"decided_at":"2026-10-30T12:34:43.345Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2727,"investigation_id":"012e009b-3cec-4ec2-9443-5a1873c079ce","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":57,"page_slug":"aperture-lm","prev_score":57,"reason":"The core exploit facts hold: the date, the losses, the affected chains, the vulnerable function, the contract addresses and the audit list were all confirmed (claim_findings[0], [1], [6]). Three claims could not be verified (claim_findings[8], [9], [10]), putting the unverified share at exactly 30%, and three more are only partly supported: the PeckShield first-flag attribution, the 'primary attacker' label for an address AMLBot calls a copycat wallet, and the Tornado Cash figure (claim_findings[2], [3], [4]). The page is placed at the upper end of the minor band instead of the significant band because none of the unverified items is a core allegation, no claim was disputed, the one omission is minor, and the reviewer's confidence is low (0.55). The high-priority gap on current status (whether any post-mortem, compensation or relaunch has happened) and the ZachXBT section, which asserts a flag the page admits it cannot source, should be corrected.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ada9124c-5888-4cac-94bf-c2dec594d863copy