Audit log

Every state-changing event for Bent Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 17:44:15Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,768,070

   sig

   4ZfrNykxjkSa…qZLJTGNccopyexplorer ↗

   hash

   98AzT24xzUqR…jNSez445copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4706 B) ▸

   {"actor":"system:backfill","investigation_id":"a55e587b-e7b5-423a-ac18-aba6c2e8355c","kind":"publish","page_slug":"bent-finance","published_at":"2026-05-28T17:44:15.924Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Bent Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://halborn.com/explained-the-bent-finance-hack-december-2021/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/bent-finance","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/bent-finance-exploit-originated-from-deployer-address-confirms-protocol/","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/bentfinancemaliciousbalanceinjection.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://halborn.com/explained-the-bent-finance-hack-december-2021/","type":"other","url":""},{"credibility":3,"name":"https://www.vidma.io/blog/the-bent-finance-betrayal-unraveling-the-1-75m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/bentfinancemaliciousbalanceinjection.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coincodecap.com/bent-finances-makes-a-stronger-comeback","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/bentfinancemaliciousbalanceinjection.php","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/bent-finance-exploit-originated-from-deployer-address-confirms-protocol/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coingecko.com/en/coins/bent-finance","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/bent-finance","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/bent-finance/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/bentfinancemaliciousbalanceinjection.php","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/bent-finance","type":"other","url":""},{"credibility":3,"name":"https://bentfi.medium.com/getting-bent-w-vesting-roadmaps-and-the-hundredth-ape-409b6c228bd","type":"other","url":""}]}],"sources_used":[],"summary":"Bent Finance is an Ethereum-based DeFi yield aggregator built on top of Curve Finance and Convex Finance, offering staking and liquidity pool boosting for the BENT token. In December 2021, the protocol suffered an insider exploit in which a rogue developer with access to the contract deployer private key inserted a backdoor into the cvxCRV and MIM pool contracts, resulting in the theft of approximately 440 ETH (~$1.75M). Stolen funds were ultimately returned by the attacker and reimbursed to users by late December 2021, but the incident caused a 73% BENT token price collapse and left the protocol with negligible TVL.","timeline":[{"date":"2021-11-30","event":"Rogue developer silently updates Bent Finance cvxCRV pool contract to hardcode a malicious token balance for attacker address 0xd23cfffa066f81c7640e3f0dc8bb2958f7686d1f. A subsequent clean update is deployed to conceal the modification.","source":""},{"date":"2021-12-09","event":"Attacker's primary wallet receives two deposits from Tornado Cash, pre-funding the operation.","source":""},{"date":"2021-12-12","event":"Attacker begins executing withdrawals. First batch: 263,000 cvxCRV-f extracted from Bent Finance pools, converted to ETH, and sent to Tornado Cash.","source":""},{"date":"2021-12-19","event":"BENT token reaches all-time high of $15.90 per token.","source":""},{"date":"2021-12-20","event":"Exploit discovered at approximately 8:55 PM EST. Bent Finance disables reward claims and alerts users. Second batch of approximately 240 ETH laundered via Tornado Cash. Total: ~440 ETH (~$1.75M) laundered.","source":""},{"date":"2021-12-21","event":"PeckShield publicly confirms exploit originated from Bent Finance's own deployer address. Protocol issues official confirmation and advises all pool investors to withdraw funds. BENT token drops 73-74%. Team employs two independent white hat developers.","source":""},{"date":"2021-12-24","event":"Hacker agrees to return stolen funds to team multisig at 0xaBb8B277F49de499b902A1E09A2aCA727595b544. Full reimbursement of 512,696 cvxcrv-f tokens completed. Community contributed ~200,000 additional cvxCRV to cover deficit.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ef7774d2-eee8-4aac-8768-2c34482ad766copy
2. #2reviewby reviewerreviewer

   2026-11-02 04:15:59Z
   Score: 28 → 28 (no score change)
   The core narrative holds: insider backdoor in cvxCRV and MIM pools, about 440 ETH (~$1.75M) lost, funds returned and users reimbursed by late December 2021, and a BENT crash of about 73%. Problems are narrow. A Halborn attribution is not supported by the Halborn page, a second attacker address and an audit claim could not be found, and the 2026 price is stale. Timeline entries are unsourced, and DeFiLlama figures could not be checked (blocked). No shutdown or sanction contradicts the page.
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,480

   sig

   57UofRnFgKw3…WEVGVQUZcopyexplorer ↗

   hash

   3uc3so6yFGbn…zMbxF4docopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1346 B) ▸

   {"actor":"reviewer","artifact_identity":"fe622209fbd102ecc67c40fd8856b5d0","blocked_count":1,"decided_at":"2026-11-02T04:15:59.502Z","decision":"review","disputed_pct":0.2857,"findings_hash":"ENn1c4aKmFyqDdbB9AXn3MQdYse5NKm4iYywmR5YRuME","investigation_id":"a55e587b-e7b5-423a-ac18-aba6c2e8355c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":28,"page_content_hash":"394132494501aa8a3ce1895b085f1e1f274cf038b13e6a85a7c928aa286441df","page_slug":"bent-finance","prev_score":28,"reason":"The core narrative holds: insider backdoor in cvxCRV and MIM pools, about 440 ETH (~$1.75M) lost, funds returned and users reimbursed by late December 2021, and a BENT crash of about 73%. Problems are narrow. A Halborn attribution is not supported by the Halborn page, a second attacker address and an audit claim could not be found, and the 2026 price is stale. Timeline entries are unsourced, and DeFiLlama figures could not be checked (blocked). No shutdown or sanction contradicts the page.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":14,"sequence_num":2,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b3bcee7b-860b-4373-8d56-aedfb83515e7copy
3. #3review reviseby judgejudge

   2026-11-02 04:15:59Z
   Score: 28 → 18 (-10)
   The core account of the December 2021 insider exploit (about 440 ETH, roughly $1.75M, a backdoor placed through the deployer key, and funds returned and users reimbursed) was confirmed by independent sources (claim_findings[0], [4], [5], [7]). Four of the 14 scoreable claims (about 29%) were disputed or could not be verified: a Halborn attribution the Halborn page does not support (claim_findings[1]), a secondary attacker address (claim_findings[3]), an unsourced audit claim (claim_findings[6]) and a timeline figure (claim_findings[13]). The 2026 price is also out of date, and every timeline entry lacks a source. One claim about DeFiLlama figures could not be checked because the site blocked access, so it was left out of the calculation. No shutdown, sanction or omission contradicts the page, and the reviewer's confidence was moderate, so the penalty stays at the lower end of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,485

   sig

   HG5S16FPAg3B…SLQWzoFGcopyexplorer ↗

   hash

   5nUV453NjQ6z…KegS2FYtcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1688 B) ▸

   {"actor":"judge","artifact_identity":"fe622209fbd102ecc67c40fd8856b5d0","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T04:15:59.502Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2857,"investigation_id":"a55e587b-e7b5-423a-ac18-aba6c2e8355c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":18,"page_slug":"bent-finance","prev_score":28,"reason":"The core account of the December 2021 insider exploit (about 440 ETH, roughly $1.75M, a backdoor placed through the deployer key, and funds returned and users reimbursed) was confirmed by independent sources (claim_findings[0], [4], [5], [7]). Four of the 14 scoreable claims (about 29%) were disputed or could not be verified: a Halborn attribution the Halborn page does not support (claim_findings[1]), a secondary attacker address (claim_findings[3]), an unsourced audit claim (claim_findings[6]) and a timeline figure (claim_findings[13]). The 2026 price is also out of date, and every timeline entry lacks a source. One claim about DeFiLlama figures could not be checked because the site blocked access, so it was left out of the calculation. No shutdown, sanction or omission contradicts the page, and the reviewer's confidence was moderate, so the penalty stays at the lower end of the band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-10,"score_limit":{"applied":-10,"limited":false,"proposed":-10,"rule":"second_opinion_agreed","second":-12},"scored_claims":14,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 776f77a0-c4a3-494d-a99f-f90e9760b22ccopy