Audit log

Every state-changing event for Cork V1: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 03:37:12Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,905,955

   sig

   3HfJ164qAZFq…zZypMQnAcopyexplorer ↗

   hash

   Fw6x7UzeTYes…ZuAzBfyYcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5762 B) ▸

   {"actor":"system:backfill","investigation_id":"d46de3f5-5b77-4b7f-bab5-692907d54b7d","kind":"publish","page_slug":"cork-v1","published_at":"2026-05-20T03:37:12.572Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Cork V1","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.cork.tech/blog/beta"},{"credibility":3,"name":"","type":"other","url":"https://chainwire.org/2026/01/21/cork-raises-5-5m-backed-by-road-capital-a16z-csx-and-strategic-investors-to-build-tokenized-risk-infrastructure/"},{"credibility":3,"name":"","type":"other","url":"https://www.coinspeaker.com/cork-protocol-raises-5-5m-decentralized-risk-layer/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://docs.cork.tech/core-concepts/collateral-asset"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-cork-protocol-hack-may-2025"},{"credibility":3,"name":"","type":"other","url":"https://slowmist.medium.com/exploit-analysis-cork-protocol-attacked-over-10-million-lost-75de9f229307"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/cork-protocol-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-cork-protocol-hack-may-2025"},{"credibility":3,"name":"","type":"other","url":"https://protos.com/sherlock-missed-it-cork-hacker-slams-audit-firms-in-on-chain-messages/"},{"credibility":3,"name":"","type":"other","url":"https://www.quillaudits.com/blog/hack-analysis/cork-protocol-hack-explained"},{"credibility":3,"name":"","type":"other","url":"https://slowmist.medium.com/exploit-analysis-cork-protocol-attacked-over-10-million-lost-75de9f229307"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/cork-protocol-incident-analysis"},{"credibility":3,"name":"","type":"other","url":"https://dedaub.com/blog/the-11m-cork-protocol-hack-a-critical-lesson-in-uniswap-v4-hook-security/"},{"credibility":3,"name":"","type":"other","url":"https://cantina.xyz/bounties/7e55cc61-e96c-4bda-a324-25b44d45e171"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/organization/cork-protocol"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/person/phil-fogel-b52c"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/person/anna-stone"},{"credibility":3,"name":"","type":"other","url":"https://chainwire.org/2026/01/21/cork-raises-5-5m-backed-by-road-capital-a16z-csx-and-strategic-investors-to-build-tokenized-risk-infrastructure/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2025/05/28/a16z-backed-cork-protocol-suffers-usd12m-smart-contract-exploit"},{"credibility":3,"name":"","type":"other","url":"https://www.web3isgoinggreat.com/?id=cork-protocol-hack"},{"credibility":3,"name":"","type":"other","url":"https://protos.com/cork-hacker-sends-eth-to-tornado-cash-donates-to-roman-storms-fund/"},{"credibility":3,"name":"","type":"other","url":"https://www.bitget.com/news/detail/12560604835357"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/cork-protocol-hacked-contracts-paused"}]}],"sources_used":[],"summary":"Cork V1 is a DeFi depeg protection protocol built on Ethereum that launched its public beta on March 4, 2025 and was exploited for approximately $12 million on May 28, 2025, less than three months after launch. The exploit resulted from a lack of input validation in the CorkHook smart contract and permissionless market creation logic, a vulnerability that slipped past four separate security audits from Quantstamp, Cantina, Sherlock, and Runtime Verification — three of which explicitly excluded the vulnerable contract from scope. All protocol functions were paused following the incident, stolen funds were laundered through Tornado Cash, and no user compensation plan has been publicly confirmed.","timeline":[{"date":"2023-01-01","event":"Cork Protocol founded by Phil Fogel, Robert Schmitt, Anna Stone, and David Stancel.","source":""},{"date":"2024-09-10","event":"Cork Protocol joins a16z Crypto's Fall 2024 accelerator cohort and secures initial funding.","source":""},{"date":"2025-01-08","event":"Cork Protocol launches Phoenix, described as one of the first risk management solutions operating as a decentralized layer on Ethereum.","source":""},{"date":"2025-03-04","event":"Cork V1 public beta goes live on Ethereum Mainnet with launch partners Lido Finance, EtherFi, Ethena, and Sky.","source":""},{"date":"2025-05-28","event":"Cork Protocol exploited for approximately $12 million (3,761.878 wstETH) via a flawed CorkHook access control and permissionless fake market creation. All contracts paused. Attacker wallet: 0xea6f30e360192bae715599e15e2f765b49e4da98.","source":""},{"date":"2025-05-29","event":"Multiple security firms (SlowMist, QuillAudits, Halborn, CertiK, Dedaub) publish exploit analysis reports. Post-mortem published by Cork team.","source":""},{"date":"2025-06-25","event":"Cork exploiter resurfaces and launders approximately 4,520 ETH (~$11 million) through Tornado Cash. Also donates 10 ETH to Roman Storm's legal defense fund. Sends on-chain messages criticizing audit firms, stating 'Sherlock missed it.'","source":""},{"date":"2026-01-21","event":"Cork raises $5.5M seed round led by a16z CSX and Road Capital to continue building tokenized risk infrastructure.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8218e166-cf24-4509-a60b-67e2bee51003copy
2. #2reviewby reviewerreviewer

   2026-11-03 23:25:57Z
   Score: 10 → 10 (no score change)
   The core exploit facts (date, time, amount, wstETH to ETH conversion, Tornado Cash laundering, 10 ETH donation) hold. Problems: the claim that three auditors explicitly excluded CorkHook rests largely on Sherlock's contested account, one timeline entry merges events from different dates, and the page leaves out that most remaining user funds were withdrawn from the unaffected markets. Founder biographies and the funding round were not checked.
   anchoranchored

   chain

   ●mainnet-betaslot 465,082,912

   sig

   5Kh9HhbP14Gu…RJWc3W1Pcopyexplorer ↗

   hash

   Es3L2qFdhiEN…RFGyK81kcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1288 B) ▸

   {"actor":"reviewer","artifact_identity":"0eae4b321c053b65b977813af0431d13","decided_at":"2026-11-03T23:25:57.497Z","decision":"review","disputed_pct":0,"findings_hash":"DykDTUQFuiXoLtfKfTmEUTQgUXhnASiGzgGpYXCRauwa","investigation_id":"d46de3f5-5b77-4b7f-bab5-692907d54b7d","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":10,"omissions":{"material":1,"total":2},"page_content_hash":"b5d17ef3e09fbf6457356dcdd781bd65dd9b2d3c58171964d8fe87a1b6ed0eda","page_slug":"cork-v1","prev_score":10,"reason":"The core exploit facts (date, time, amount, wstETH to ETH conversion, Tornado Cash laundering, 10 ETH donation) hold. Problems: the claim that three auditors explicitly excluded CorkHook rests largely on Sherlock's contested account, one timeline entry merges events from different dates, and the page leaves out that most remaining user funds were withdrawn from the unaffected markets. Founder biographies and the funding round were not checked.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":2,"subject_status":"operating","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6eff93ae-f19d-4283-8ec0-703921bb4620copy
3. #3review reviseby judgejudge

   2026-11-03 23:25:57Z
   Score: 10 → 0 (-10)
   The core exploit facts (date, time, amount, wstETH to ETH conversion, Tornado Cash laundering) were confirmed, and no claim was disputed outright. The page does contradict the project's own latest status. claim_findings[3] is stale: it says funds are locked with no withdrawal timeline, but Cork reported over $21 million withdrawn from the four unaffected markets. omission_findings[0] reports this as a material omission. claim_findings[2] (the three-auditor scope exclusion) rests largely on Sherlock's contested account, and claim_findings[1] merges events from different dates. A modest penalty and a banner apply until the page is corrected.
   anchoranchored

   chain

   ●mainnet-betaslot 465,082,918

   sig

   4ZRr8AZeUYiL…pFsYUGa9copyexplorer ↗

   hash

   GaydrjyfXHhN…kS2tBJUzcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1851 B) ▸

   {"actor":"judge","artifact_identity":"0eae4b321c053b65b977813af0431d13","band_override":null,"decided_at":"2026-11-03T23:25:57.497Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"d46de3f5-5b77-4b7f-bab5-692907d54b7d","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":0,"page_slug":"cork-v1","prev_score":10,"reason":"The core exploit facts (date, time, amount, wstETH to ETH conversion, Tornado Cash laundering) were confirmed, and no claim was disputed outright. The page does contradict the project's own latest status. claim_findings[3] is stale: it says funds are locked with no withdrawal timeline, but Cork reported over $21 million withdrawn from the four unaffected markets. omission_findings[0] reports this as a material omission. claim_findings[2] (the three-auditor scope exclusion) rests largely on Sherlock's contested account, and claim_findings[1] merges events from different dates. A modest penalty and a banner apply until the page is corrected.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":-10,"sequence_num":3,"severity_override":{"applied":true,"band":"minor","from_band":"approve","reason":"Claim findings alone give 0% disputed or unverifiable (no finding is disputed or unverifiable; 2 confirmed, 3 partially supported, 1 stale). However, the review reports a material omission (omission_findings[0]: four of five markets unaffected and over $21M withdrawn) and subject_status.contradicts_page is true. The page implies depositors remain locked out. Escalated to the minor band, not higher, because the core exploit facts hold and the reviewer's confidence is only 0.55."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d0f0fbe7-40e0-4521-b82a-bfe5895972e7copy