Audit log

Every state-changing event for Curio: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 20:13:17Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,839,271

   sig

   hjYonJUZkBf5…24ExeV3Ccopyexplorer ↗

   hash

   22Lmw4zX2oLz…C59mZyC6copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5149 B) ▸

   {"actor":"system:backfill","investigation_id":"fab6ead4-3fe8-4c91-acad-4791c1109db0","kind":"publish","page_slug":"curio","published_at":"2026-05-19T20:13:17.668Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Curio","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://investcurio.medium.com/curiodao-the-future-of-real-assets-2964c789078"},{"credibility":3,"name":"","type":"other","url":"https://www.venturelab.swiss/Meet-CurioInvest-CEO-Rey-Fernando-Verboonen-and-find-out-how-Wikipedia-helps-him-fall-asleep"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/person/fernando-verboonen"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-curio-hack-march-2024"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/curio-rekt"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/neptune-mutual/analysis-of-the-curio-exploit-1df31252fe66"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/curio-hit-by-16-million-exploit-due-to-voting-power-vulnerability/"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2024/03/26/curio-strikes-back-with-cgt-2-0-following-16-million-exploit/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/curio-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-curio-hack-march-2024"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.venturelab.swiss/Meet-CurioInvest-CEO-Rey-Fernando-Verboonen-and-find-out-how-Wikipedia-helps-him-fall-asleep"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/organization/curio-edc3"},{"credibility":3,"name":"","type":"other","url":"https://go.curioinvest.com/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://investcurio.medium.com/curiodaos-recovery-plan-1255427f35de"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2024/03/26/curio-strikes-back-with-cgt-2-0-following-16-million-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/curio-hit-by-16-million-exploit-due-to-voting-power-vulnerability/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-curio-hack-march-2024"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/curio-rekt"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/neptune-mutual/analysis-of-the-curio-exploit-1df31252fe66"},{"credibility":3,"name":"","type":"other","url":"https://investcurio.medium.com/curiodaos-recovery-plan-1255427f35de"}]}],"sources_used":[],"summary":"Curio (CurioDAO) is a multi-chain real-world asset (RWA) DeFi protocol that suffered a critical smart contract exploit on March 23, 2024, resulting in approximately $16 million in losses after an attacker exploited a voting-power privilege escalation vulnerability to mint approximately 1 billion unauthorized CGT governance tokens. The protocol had no known third-party security audits prior to the exploit and relied on internal reviews. Curio announced a recovery plan including a new CGT 2.0 token and a phased compensation program, though independent verification of full compensation delivery remains limited.","timeline":[{"date":"2024-03-23","event":"Exploit executed on Curio's Ethereum governance contract. Attacker acquires minimal CGT tokens, escalates voting privileges via IDSChief/IDSPause contracts, and mints approximately 1 billion unauthorized CGT tokens. Estimated loss: $16 million.","source":""},{"date":"2024-03-23","event":"CurioDAO Association publicly announces the exploit and halts emergency operations.","source":""},{"date":"2024-03-25","event":"Curio publishes official post-mortem identifying a permission access logic vulnerability in the MakerDAO-derived governance smart contract as the root cause.","source":""},{"date":"2024-03-25","event":"Multiple independent security firms (Hacken, Cyvers, Neptune Mutual, Halborn) publish technical analyses of the exploit, corroborating the attack vector.","source":""},{"date":"2024-03-25","event":"Curio announces recovery plan: CGT 2.0 token launch within 2 weeks, four-stage 90-day LP compensation in USDC/USDT, 10% treasury airdrop, and white hat bounty of 10% of recovered funds.","source":""},{"date":"2024-03-26","event":"Curio announces CGT 2.0 token publicly, pledging 100% restoration for pre-exploit CGT holders across all affected networks.","source":""},{"date":"2025-03-23","event":"Projected completion date of the four-stage, one-year compensation program. Independent verification of full delivery is not available in public sources.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b6cd1a91-dad3-4150-894f-26098cd9f932copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:41Z
   Score: 10 → 55 (+45)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 55. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +2, regulated +5.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,754

   sig

   4Gm3FDaF11Ru…JTqKUk3ucopyexplorer ↗

   hash

   3XbhuUdJ8QGs…tfDZa96Lcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (650 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:41.174Z","decision":"rescore","investigation_id":"fab6ead4-3fe8-4c91-acad-4791c1109db0","new_score":55,"page_slug":"curio","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 55. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +2, regulated +5.","score_delta":45,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c16fb8a5-51d0-4085-88f0-58e898955f8fcopy
3. #3reviewby reviewerreviewer

   2026-11-02 00:44:23Z
   Score: 55 → 55 (no score change)
   The core exploit facts (date, $16M loss, 1B CGT minted, attacker address, tx hash, 996B CGT retained, no known audit) are supported by REKT and Halborn. Two weaknesses: the bounty terms are simplified (10% first week, 5% after), and the post-mortem figures ($180k losses, 10% airdrop) could not be verified because the primary source is blocked. The founder biography is unchecked and relies on self-reported sources. The page does not state whether the project is still operating.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,227

   sig

   x9a8vEfjdpfp…HUMap68Scopyexplorer ↗

   hash

   63GyUsWUXurJ…8mitUKTjcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1360 B) ▸

   {"actor":"reviewer","artifact_identity":"b9015643a37d373253068f77253baa08","blocked_count":1,"decided_at":"2026-11-02T00:44:23.719Z","decision":"review","disputed_pct":0.1111,"findings_hash":"75hhzWAJXb95shDqtCeWEJpi7o5ZP5mSoCzTD1earKfh","investigation_id":"fab6ead4-3fe8-4c91-acad-4791c1109db0","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"omissions":{"material":0,"total":1},"page_content_hash":"8f097d531d619ef129fc1157dae00bc30c978fa18321dc58a51d787f79c7f1c0","page_slug":"curio","prev_score":55,"reason":"The core exploit facts (date, $16M loss, 1B CGT minted, attacker address, tx hash, 996B CGT retained, no known audit) are supported by REKT and Halborn. Two weaknesses: the bounty terms are simplified (10% first week, 5% after), and the post-mortem figures ($180k losses, 10% airdrop) could not be verified because the primary source is blocked. The founder biography is unchecked and relies on self-reported sources. The page does not state whether the project is still operating.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1bc862a5-7fdf-444d-9627-0ab8876f0f09copy
4. #4review reviseby judgejudge

   2026-11-02 00:44:23Z
   Score: 55 → 55 (no score change)
   The core exploit facts (March 23, 2024 date, about $16M loss, about 1 billion CGT minted, attacker address, no known audit) were confirmed by REKT and Halborn (claim_findings[0-3], [7]). Counting the claim findings, 1 of 9 scored claims was unverifiable (the founder biography, claim_findings[7]), which is about 11% and puts the page in the minor-issues band; one unverifiable finding was excluded because the source blocked the reviewer (claim_findings[5]). The page also has several partially supported details: the white hat bounty is simplified to a flat 10% when sources describe 10% in week one and 5% after (claim_findings[4]), and the CGT 2.0 date reflects press coverage rather than the March 25 plan announcement (claim_findings[8]). The primary recovery-plan source could not be read, which is a high-priority coverage gap, so the penalty is kept small given the reviewer's moderate confidence.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,232

   sig

   3itoZF3acUia…i5d7bcsVcopyexplorer ↗

   hash

   DJ45GzFKK2bv…44WNUYZfcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1581 B) ▸

   {"actor":"judge","artifact_identity":"b9015643a37d373253068f77253baa08","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T00:44:23.719Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1111,"investigation_id":"fab6ead4-3fe8-4c91-acad-4791c1109db0","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"page_slug":"curio","prev_score":55,"reason":"The core exploit facts (March 23, 2024 date, about $16M loss, about 1 billion CGT minted, attacker address, no known audit) were confirmed by REKT and Halborn (claim_findings[0-3], [7]). Counting the claim findings, 1 of 9 scored claims was unverifiable (the founder biography, claim_findings[7]), which is about 11% and puts the page in the minor-issues band; one unverifiable finding was excluded because the source blocked the reviewer (claim_findings[5]). The page also has several partially supported details: the white hat bounty is simplified to a flat 10% when sources describe 10% in week one and 5% after (claim_findings[4]), and the CGT 2.0 date reflects press coverage rather than the March 25 plan announcement (claim_findings[8]). The primary recovery-plan source could not be read, which is a high-priority coverage gap, so the penalty is kept small given the reviewer's moderate confidence.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ce23716d-6c86-4b07-a6d2-8a9d702ec9cacopy
5. #5rescoreby systemsystem

   2026-11-02 00:44:24Z
   Score: 55 → 56 (+1)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 55 → 56. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4; legitimacy credit long-running +2, regulated +5; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,237

   sig

   E4ofWVnWHwFA…Sb6rcoXNcopyexplorer ↗

   hash

   7Xacv4nG5Ri7…Hkmw2ksmcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (708 B) ▸

   {"actor":"system","decided_at":"2026-11-02T00:44:23.719Z","decision":"rescore","investigation_id":"fab6ead4-3fe8-4c91-acad-4791c1109db0","new_score":56,"page_slug":"curio","prev_score":55,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 55 → 56. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4; legitimacy credit long-running +2, regulated +5; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":1,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7e2d17da-eebb-4e5e-9867-aa10670358efcopy