← Cork Protocolreviewed 2026-09-07 · 27 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Cork Protocol against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
6 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #10[unverifiable][awaiting moderator]in section: Fund Recovery and Attacker Behavior
“Following the exploit, Cork Protocol stated it engaged US law enforcement and forensic security experts, and attempted multiple rounds of public and private contact with the attacker in an attempt to negotiate fund recovery.”
reviewerCork Protocol engaged US law enforcement and forensic experts and attempted to negotiate with the attacker, without recovering fundsPlausible and consistent with standard post-exploit conduct, but the primary source could not be independently fetched, and no secondary outlet in the search results corroborated the law-enforcement/negotiation detail specifically. - #11[unverifiable][awaiting moderator]in section: Fund Recovery and Attacker Behavior
“Approximately $20 million in assets across five other markets remained locked in Cork Liquidity Vaults that were not affected by the exploit, though all protocol functions were paused pending contract upgrades.”
reviewerApproximately $20 million in assets across five other markets remained locked, unaffected by the exploitCould not locate independent confirmation of this specific figure in any source consulted. - #20[unverifiable][awaiting moderator]in the timeline
“2026-01-19”
reviewerCork Phoenix launched on Ethereum mainnet specifically on January 19, 2026No major outlet (CoinDesk, Cointelegraph, The Block) appears to have covered the Phoenix relaunch with a specific date. Search summaries produced conflicting candidate dates (January 8 for the mainnet launch, January 21 for a related seed-round article) that could not be confirmed against a reliable primary source, so the specific day of January 19 in the page is neither confirmed nor contradicted with confidence. - #21[unverifiable][awaiting moderator]in section: Post-Exploit Recovery and Cork Phoenix Relaunch
“Cork V1, the legacy version affected by the exploit, had a reported TVL of approximately $4,900 as of available data, consistent with funds remaining inaccessible during the recovery process.”
reviewerCork V1 had a reported TVL of approximately $4,900 as of available dataCould not directly verify the cited on-chain TVL source; the figure is plausible (near-zero TVL for a paused, exploited protocol) but unconfirmed. - #22[unverifiable][awaiting moderator]in section: Post-Exploit Recovery and Cork Phoenix Relaunch
“The Phoenix version included three new smart contract audits (Quantstamp, Cantina, Sherlock), formal verification by Runtime Verification, and front-end penetration testing with Sayfer — with the team stating these audits were conducted with CorkHook contracts explicitly in scope.”
reviewerCork Phoenix included three new audits (Quantstamp, Cantina, Sherlock), formal verification by Runtime Verification, and penetration testing by Sayfer, with CorkHook explicitly in scopeOne of the two cited sources for this claim was fetched directly and did not corroborate the specific list of audit/pentest firms; the other (the likely primary source) could not be accessed. Not contradicted by any other source found, so rated unverifiable rather than disputed. - #23[unverifiable][awaiting moderator]in section: Post-Exploit Recovery and Cork Phoenix Relaunch
“User compensation plans were described as in progress, with Cork stating affected users should reach out via direct message on X, though no public compensation fund announcement had been confirmed in available sources.”
reviewerUser compensation plans were in progress, with Cork directing affected users to contact via X DM; no compensation fund confirmedCould not access the primary source; no contradicting information found elsewhere. The claim is already appropriately hedged by the page itself.
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #13[partially supported][awaiting moderator]in section: Fund Recovery and Attacker Behavior
“Separately, the attacker sent 10 ETH to a Tornado Cash developer legal defense fund and left on-chain messages criticizing audit firms, alleging that 'Sherlock missed it' and accusing named security researchers from firms including Dedaub, Halborn, Three Sigma, and Blocksec of 'promoting brands by analyzing bugs they couldn't detect themselves.'”
reviewerSeparately, the attacker donated 10 ETH to a Tornado Cash developer legal fund and left on-chain messages criticizing audit firms ('Sherlock missed it', naming Dedaub, Halborn, Three Sigma, Blocksec)The quoted content (message text, named firms) is accurate, but placing it in the same paragraph/sentence as the June 25 Tornado Cash transfer implies the messages were contemporaneous; independently fetched sources place the audit-criticism messages roughly a week earlier, around June 19-20, 2025. - #14[partially supported][awaiting moderator]in the timeline
“Attacker resurfaces; transfers 4,520 ETH (~$11M) to Tornado Cash in two tranches and sends 10 ETH to a Tornado Cash developer legal defense fund. On-chain messages left criticizing multiple audit firms.”
reviewerTimeline entry for 2025-06-25 bundles the Tornado Cash transfer with the on-chain audit-criticism messages as same-day eventsSame underlying error as the Fund Recovery and Attacker Behavior section finding; the timeline entry dated 2025-06-25 folds in the audit-criticism messages that independently-sourced reporting places around June 19-20, 2025. - #16[partially supported][awaiting moderator]in section: Protocol Mechanism and Background
“Schmitt previously co-founded Vultus, a satellite data and AI company, and attended Lund University.”
reviewerSchmitt co-founded Vultus, described as 'a satellite data and AI company', and attended Lund UniversityCore facts (satellite data, AI, co-founder, Lund University) are accurate, but 'a satellite data and AI company' omits that Vultus was specifically an agtech/fertilizer-recommendation company, understating what it actually did. - #17[partially supported][awaiting moderator]in section: Funding and Investors
“Cork Protocol raised a $5.5 million seed round in September 2024 led by a16z Crypto Startup Accelerator (CSX), with participation from OrangeDAO, Road Capital, BitGo, Steakhouse Financial, and others.”
reviewer$5.5M seed round in September 2024 led by a16z CSX, with participation from OrangeDAO, Road Capital, BitGo, Steakhouse Financial, and othersAmount, month, and investor roster are accurate, but Road Capital is widely reported as a co-lead investor alongside a16z CSX, not simply a participant grouped with OrangeDAO, BitGo, and Steakhouse Financial. - #18[partially supported][awaiting moderator]in the timeline
“Cork Protocol joins a16z Crypto CSX Fall 2024 cohort and announces $5.5M seed round led by a16z CSX with OrangeDAO, Road Capital, BitGo, and Steakhouse Financial.”
reviewerTimeline entry for 2024-09-09 describes the seed round as 'led by a16z CSX' with Road Capital grouped among other participantsSame underlying error as the Funding and Investors section finding.
confirmed
16 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Protocol Mechanism and Background
“Cork Protocol was founded in 2023 by Phil Fogel and Rob Schmitt.”
reviewerCork Protocol was founded in 2023 by Phil Fogel and Rob SchmittMultiple independent sources (Crunchbase, Rekt News, general search results) consistently corroborate founding in 2023 by these two named individuals. - #2[confirmed][no action needed]in the summary
“On May 28, 2025, the protocol suffered a critical smart contract exploit resulting in approximately $12 million in losses, attributed to missing access controls in its Uniswap V4 hook integration.”
reviewerOn May 28, 2025 the protocol suffered a ~$12M exploit attributed to missing access controls in its Uniswap V4 hook integrationWidely reported by multiple independent outlets; the summary's single-cause framing is a simplification of a multi-vulnerability exploit chain, but this is elaborated correctly in the Technical Vulnerability Analysis section. - #3[confirmed][no action needed]in section: May 2025 Smart Contract Exploit
“On May 28, 2025 at approximately 11:23–11:39 UTC, an attacker exploited multiple vulnerabilities in Cork Protocol's smart contracts, draining 3,761 wstETH (approximately $12 million) from the wstETH:weETH Liquidity Vault.”
reviewerExploit occurred at approximately 11:23-11:39 UTC, draining 3,761 wstETH (~$12M) from the wstETH:weETH Liquidity VaultTime window and amounts are consistent across Rekt News, Halborn, and other independent write-ups. - #4[confirmed][no action needed]in section: May 2025 Smart Contract Exploit
“The attacker's wallet address is 0xEA6f30e360192bae715599E15e2F765B49E4da98, with the malicious contract deployed at 0x9Af3dCE0813FD7428c47F57A39da2F6Dd7C9bb09. The funding source for the attack wallet was traced to a service provider identified as Swapuz.”
reviewerAttacker wallet, malicious contract address, and Swapuz as funding source are as statedBoth addresses verified byte-for-byte against an independently fetched source; Swapuz attribution corroborated by a second unrelated search result citing MistTrack. - #5[confirmed][no action needed]in section: Technical Vulnerability Analysis
“The primary flaw was a missing access control modifier on the `beforeSwap` function within the CorkHook contract: the function lacked an `onlyPoolManager` guard, allowing any external caller to invoke it with arbitrary parameters and manipulate token settlement flows.”
reviewerMissing access control modifier on beforeSwap / lack of onlyPoolManager guard in CorkHookDirectly confirmed by fetching the cited Dedaub analysis, which describes the exact function and modifier names. - #6[confirmed][no action needed]in section: Technical Vulnerability Analysis
“A tertiary issue involved a risk premium miscalculation near token expiry that permitted conversion of a trivially small amount of collateral (0.0000029 wstETH) into substantial derivative positions worth 3,760.88 weETH-CT.”
reviewer0.0000029 wstETH converted into 3,760.88 weETH-CT via risk premium miscalculationExact figures matched on direct fetch of the cited source. - #7[confirmed][no action needed]in section: Audit Coverage Gaps
“Prior to the exploit, Cork Protocol had completed four independent security audits: Quantstamp (October), Sherlock (September), Runtime Verification (October), and a Cantina/Spearbit engagement. The protocol had also maintained a $100,000 bug bounty program on Cantina.”
reviewerFour pre-exploit audits (Quantstamp October, Sherlock September, Runtime Verification October, Cantina/Spearbit) plus a $100,000 Cantina bug bountyAudit firm names, months, and bug bounty figure independently corroborated via Rekt News and general search results. - #8[confirmed][no action needed]in section: Audit Coverage Gaps
“Despite this coverage, Cork's own post-mortem acknowledged that the access control vulnerability in the CorkHook contract 'none of our audits flagged.'”
reviewerCork's post-mortem states the CorkHook access-control vulnerability was something 'none of our audits flagged'Direct quote verified via an independent secondary source that itself quotes the primary post-mortem (cork.tech blocks automated fetches with a 403). - #9[confirmed][no action needed]in section: Audit Coverage Gaps
“Runtime Verification stated: 'This was a time-constrained verification effort...Verification of hook functions was out of scope, again due to time constraints.'”
reviewerRuntime Verification stated its review was time-constrained and hook functions were out of scopeMatches quoted language found on direct fetch of Rekt News' exploit writeup. - #12[confirmed][no action needed]in section: Fund Recovery and Attacker Behavior
“On June 25, 2025, blockchain security firm PeckShield flagged renewed activity from the attacker's wallet, the first since the May 28 exploit. The attacker transferred a total of 4,520 ETH (approximately $11 million) to Tornado Cash in two tranches: approximately 1,410 ETH followed by approximately 3,110 ETH.”
reviewerOn June 25, 2025, PeckShield flagged renewed attacker activity (first since May 28); 4,520 ETH moved to Tornado Cash in two tranches of ~1,410 and ~3,110 ETHAll figures and the date match on direct fetch of the cited source. - #15[confirmed][no action needed]in section: Protocol Mechanism and Background
“Fogel previously co-founded FlowCarbon (a tokenized carbon credits platform) and attended Cornell University.”
reviewerFogel co-founded FlowCarbon and attended Cornell UniversityConsistent with Crunchbase and other biographical sources found in search. - #19[confirmed][no action needed]in section: Funding and Investors
“A second $5.5 million seed round was announced in January 2026 coinciding with the Cork Phoenix relaunch.”
reviewerA second $5.5 million seed round was announced in January 2026The amount and month of the second raise are corroborated by two independent sources; see separate finding regarding the specific day (January 19) claimed in the timeline. - #24[confirmed][no action needed]in section: Protocol Mechanism and Background
“Depositing collateral issues two derivative tokens: a Cork Principal Token (cPT), representing the role of an insurance underwriter, and a Cork Swap Token (cST), representing the insurance buyer.”
reviewerDS collateral issues cPT (insurance-underwriter role) and cST (insurance-buyer role)The underwriter/buyer analogy is a reasonable simplification consistent with Cork's own documentation of cPT and cST mechanics found via search.citeddocs.cork.tech/ - #25[confirmed][no action needed]in section: Protocol Mechanism and Background
“Target assets at launch included wstETH, weETH, USDe, and PT-tokens associated with Lido and Ethena integrations.”
reviewerTarget assets at launch included wstETH, weETH, USDe, and PT-tokens tied to Lido and Ethena integrationsConsistent with independently found descriptions of the beta launch partner ecosystem.citeddocs.cork.tech/ - #26[confirmed][no action needed]in section: Protocol Mechanism and Background
“The public beta launched on Ethereum mainnet in March 2025 after a testnet competition in late 2024.”
reviewerPublic beta launched on Ethereum mainnet in March 2025 after a late-2024 testnet competitionSequence and timing are consistent with independently fetched CryptoSlate coverage and Cork's own 'tokenized risk primitive is now live' blog title found in search. - #27[confirmed][no action needed]in section: Funding and Investors
“No governance token or public token sale had been publicly announced or launched as of the most recent reporting; no rug pull indicators were identified in available sources.”
reviewerNo governance token or public token sale had been announced or launched; no rug pull indicators identifiedNegative claim (absence of a token/rug-pull signal); consistent with everything found during this review and already appropriately hedged in the page's own phrasing.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.