Audit log

Every state-changing event for Cozy V2: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 17:23:35Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,983,056

   sig

   31xUDY9FuRuY…ky2gVoMRcopyexplorer ↗

   hash

   BNmAMBMsxYZx…D91AYoL4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4564 B) ▸

   {"actor":"system:backfill","investigation_id":"97186db0-8236-479e-9311-19e65b30abae","kind":"publish","page_slug":"cozy-v2","published_at":"2026-05-29T17:23:35.877Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Cozy V2","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://mirror.xyz/cozy.eth/w24TU4ksefu7-jF1AGBrIbfeNKuZAH9v41aJw_VAr4g","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/cozy-v2","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2020/09/03/defi-risk-management-startup-cozy-finance-debuts-with-2m-funding-round","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@cozyfinance/introducing-cozy-protection-markets-fc8f75636085","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.verichains.io/p/cozy-protocol-incident","type":"other","url":""},{"credibility":3,"name":"https://x.com/DecurityHQ/status/1961810726164533602","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/cozy-v2","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/DecurityHQ/status/1961810726164533602","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/cozy-protocol-incident","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.verichains.io/p/cozy-protocol-incident","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/cozy-v2","type":"other","url":""},{"credibility":3,"name":"https://github.com/Cozy-Finance","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/business/2020/09/03/defi-risk-management-startup-cozy-finance-debuts-with-2m-funding-round","type":"other","url":""},{"credibility":3,"name":"https://www.crunchbase.com/organization/cozy-finance","type":"other","url":""},{"credibility":3,"name":"https://www.crunchbase.com/person/payom-dousti","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.verichains.io/p/cozy-protocol-incident","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/cozy-v2","type":"other","url":""},{"credibility":3,"name":"https://v2.cozy.finance/","type":"other","url":""}]}],"sources_used":[],"summary":"Cozy V2 is a DeFi protection marketplace deployed on Optimism that allows users to buy or provide protection against smart contract hacks, depegs, and other on-chain risks. On August 29, 2025, the protocol suffered a $427,000 exploit caused by a missing caller verification check in its withdrawal logic, with funds subsequently bridged to Ethereum mainnet and deposited into Tornado Cash. The incident is notable for its irony: a protocol designed to insure against DeFi hacks was itself hacked through a preventable authorization flaw.","timeline":[{"date":"2020-09-03","event":"Cozy Finance announces $2M seed round led by Electric Capital; founders Tony Sheng and Payom Dousti publicly named.","source":""},{"date":"2021-09-01","event":"Cozy Finance V1 launches on Ethereum mainnet as an open-source protection market protocol.","source":""},{"date":"2023-03-13","event":"Euler Finance hacked for approximately $200M. Cozy V2 early-access Euler Finance market triggers and pays out to Protection Buyers, validating core trigger logic.","source":""},{"date":"2023-01-01","event":"Cozy V2 launches on Optimism (OP Mainnet) with redesigned permissionless protection marketplace architecture; V1 subsequently sunset.","source":""},{"date":"2025-08-28","event":"Victim initiates redemption of approximately $376,661 (redemption ID 6) on Cozy V2 on Optimism.","source":""},{"date":"2025-08-29","event":"Attacker exploits missing caller verification in `completeWithdraw` function, redirecting victim's redemption proceeds to attacker's address. Total loss reaches approximately $427,000.","source":""},{"date":"2025-08-30","event":"Decurity publicly reports the exploit on X, noting attacker bridged funds from Optimism to Ethereum mainnet and deposited into Tornado Cash.","source":""},{"date":"2025-08-30","event":"Verichains publishes detailed technical post-mortem of the Cozy Protocol incident, classifying the root cause as insufficient sender verification.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4c544921-2823-47bd-ac5e-10990ecd2ca9copy
2. #2reviewby reviewerreviewer

   2026-08-18 17:40:34Z
   Score: 42 → 42 (no score change)
   The core factual claims — the $427,000 Cozy V2 exploit on August 29, 2025 via a missing caller-verification check in completeWithdraw, the bridging of funds to Ethereum and deposit into Tornado Cash, the founding team and 2020 seed round, and the Euler-hack payout episode — are all independently corroborated by the cited sources (Verichains, Decurity, CoinDesk, Cozy's own mirror post) and by additional sources found in this review. The page correctly frames Cozy as the victim of an external exploit rather than conflating it with wrongdoing, and contains no unhedged fraud allegations. The main defects are structural rather than factual: all six page sections have empty content (only source lists survived into this snapshot), two timeline dates read as unverified placeholders with one internal ordering inconsistency, a materially larger $15.1M funding round is omitted from the financial history, and the page is silent on post-incident remediation (patch status, reimbursement, audit history) — an omission that cuts both ways since neither aggravating nor exculpatory information could be confirmed.
   anchoranchored

   chain

   ●mainnet-betaslot 443,508,396

   sig

   2Cqfbbt6i3u3…hnhX6QqAcopyexplorer ↗

   hash

   2U1weMNkVD1S…7FEGgfCqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1454 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-18T17:40:33.863Z","decision":"review","investigation_id":"97186db0-8236-479e-9311-19e65b30abae","new_score":42,"page_slug":"cozy-v2","prev_score":42,"reason":"The core factual claims — the $427,000 Cozy V2 exploit on August 29, 2025 via a missing caller-verification check in completeWithdraw, the bridging of funds to Ethereum and deposit into Tornado Cash, the founding team and 2020 seed round, and the Euler-hack payout episode — are all independently corroborated by the cited sources (Verichains, Decurity, CoinDesk, Cozy's own mirror post) and by additional sources found in this review. The page correctly frames Cozy as the victim of an external exploit rather than conflating it with wrongdoing, and contains no unhedged fraud allegations. The main defects are structural rather than factual: all six page sections have empty content (only source lists survived into this snapshot), two timeline dates read as unverified placeholders with one internal ordering inconsistency, a materially larger $15.1M funding round is omitted from the financial history, and the page is silent on post-incident remediation (patch status, reimbursement, audit history) — an omission that cuts both ways since neither aggravating nor exculpatory information could be confirmed.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 214a1b67-3455-4d47-90d4-841dd4fd98b1copy