Audit log

Every state-changing event for EraLend: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 15:33:53Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,748,336

   sig

   4ofsyF8TDNaz…Um2VyXYfcopyexplorer ↗

   hash

   84xS76fDt98z…j7aYciikcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4330 B) ▸

   {"actor":"system:backfill","investigation_id":"58dfd95d-061d-4889-8631-bdb547d06e1a","kind":"publish","page_slug":"eralend","published_at":"2026-05-28T15:33:53.207Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"EraLend","sections":[{"content":"","heading":"","severity":"critical","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/eralend-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/eralend-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2023/07/25/zksyncs-largest-lender-struck-by-34m-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/eralend-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/eralend-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":3,"name":"https://rekt.news/eralend-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://eralend.medium.com/charting-the-path-forward-eralends-response-and-blueprint-following-the-security-incident-aa8ae4961b4c","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2023/08/08/eralend-separates-exploited-contract-relaunches/","type":"other","url":""},{"credibility":3,"name":"https://www.binance.com/en/square/post/868073","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/eralend","type":"other","url":""}]},{"content":"","heading":"","severity":"low","sources":[{"credibility":3,"name":"https://eralend.medium.com/nexon-finance-is-now-eralend-1aa9caeac537","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/eralend-crypto-lending-protocol-security-breach/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/eralend-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/eralend","type":"other","url":""},{"credibility":3,"name":"https://dappradar.com/dapp/eralend","type":"other","url":""},{"credibility":3,"name":"https://eralend.medium.com/","type":"other","url":""}]}],"sources_used":[],"summary":"EraLend (formerly Nexon Finance) is a decentralized lending protocol on zkSync Era that suffered a $3.4 million read-only reentrancy exploit on July 25, 2023, draining its USDC pool due to a vulnerability in inherited SyncSwap oracle code. The protocol's pre-hack audit by PeckShield explicitly assumed a trusted price oracle, leaving the vulnerable oracle mechanism unexamined. EraLend relaunched post-hack with a fee-based compensation plan but has seen its TVL decline sharply to approximately $138,000 as of 2025-2026.","timeline":[{"date":"2023-02-09","event":"Nexon Finance public testnet launches on zkSync","source":""},{"date":"2023-03-01","event":"PeckShield audits Nexon Finance; audit assumes a trusted price oracle, leaving oracle mechanism unexamined","source":""},{"date":"2023-04-01","event":"Nexon Finance goes live on zkSync Era mainnet","source":""},{"date":"2023-05-20","event":"Nexon Finance rebrands to EraLend","source":""},{"date":"2023-07-25","event":"EraLend exploited via read-only reentrancy attack; approximately $3.4M stolen from USDC pool by attacker 0xf1D076c9Be4533086f967e14EE6aFf204D5ECE7a","source":""},{"date":"2023-07-26","event":"EraLend confirms attack, suspends borrowing, advises against USDC deposits; SlowMist engaged for asset tracing","source":""},{"date":"2023-08-08","event":"EraLend separates exploited contract into 'EraLend Classic' and relaunches new protocol without SyncSwap LP pool; 10% recovery reward offered","source":""},{"date":"2024-02-07","event":"EraLend announces partnership with Pyth Network — last known public communication","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ed297aa1-3869-48a8-be22-d0790b657abecopy
2. #2rescoreby systemsystem

   2026-10-27 06:07:06Z
   Score: 28 → 43 (+15)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 43. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −6, problems around the subject, caused by others −1.9; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,255

   sig

   5sfUqDNiCTox…WaNFM1F4copyexplorer ↗

   hash

   2WQF3Yuk5YSm…BbG5Nqoucopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (635 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:06.245Z","decision":"rescore","investigation_id":"58dfd95d-061d-4889-8631-bdb547d06e1a","new_score":43,"page_slug":"eralend","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 43. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −6, problems around the subject, caused by others −1.9; legitimacy credit long-running +2.","score_delta":15,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f5cba267-2bc0-4bad-b47c-7011888bbe13copy
3. #3reviewby reviewerreviewer

   2026-11-02 05:02:24Z
   Score: 43 → 43 (no score change)
   The core incident facts (July 25, 2023, ~$3.4M, read-only reentrancy, SyncSwap-derived code, PeckShield trusted-oracle assumption, attacker address) are supported by Rekt, CoinDesk and CertiK. Unsupported or unchecked are the Hacken multi-chain tracing, the marketing claim about avoiding external oracles, the August 2023 relaunch details and the current TVL (sources blocked). No outright disputed claims found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,370,474

   sig

   DfRJ9BwRYKbQ…TMkJDaCMcopyexplorer ↗

   hash

   3JpzzHZyfTua…QffnEoJecopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1259 B) ▸

   {"actor":"reviewer","artifact_identity":"9d7e6a9df54a922ad852a67b72c2f822","blocked_count":3,"decided_at":"2026-11-02T05:02:24.363Z","decision":"review","disputed_pct":0.3333,"findings_hash":"4hk2WKZgnLQexvhJw1Qobmk2UZtCRRDFvmAU3EhmhVDC","investigation_id":"58dfd95d-061d-4889-8631-bdb547d06e1a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":43,"page_content_hash":"2f6a13f65afa80d96a74707b810fc672aeb262c731202a2fdf0087b3d63638e3","page_slug":"eralend","prev_score":43,"reason":"The core incident facts (July 25, 2023, ~$3.4M, read-only reentrancy, SyncSwap-derived code, PeckShield trusted-oracle assumption, attacker address) are supported by Rekt, CoinDesk and CertiK. Unsupported or unchecked are the Hacken multi-chain tracing, the marketing claim about avoiding external oracles, the August 2023 relaunch details and the current TVL (sources blocked). No outright disputed claims found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d56ca8b3-4f62-43fb-94d5-20d9190b57f9copy
4. #4review reviseby judgejudge

   2026-11-02 05:02:24Z
   Score: 43 → 43 (no score change)
   The core incident facts (July 25, 2023 read-only reentrancy, about $3.4M lost, attacker address, SyncSwap-derived code, PeckShield trusted-oracle assumption) were confirmed by Rekt, CoinDesk and CertiK, and no claim was disputed. However, 3 of the 9 scoreable claims could not be verified: the Hacken cross-chain tracing (claim_findings[2]), the statement that EraLend marketed itself as safer for avoiding external oracles (claim_findings[6]), and the 'no communications since February 2024' claim (claim_findings[11]). That is a 33% unverified share, which falls in the significant band. The penalty is set at the mild end because nothing was contradicted and the reviewer's confidence is moderate. Three further claims could not be checked because their sources blocked the reviewer (August 2023 relaunch details, current TVL, rebrand date); these are a coverage limit, not a defect of the page.
   anchoranchored

   chain

   ●mainnet-betaslot 464,370,480

   sig

   2VuHd9nWJZpX…kauKA6szcopyexplorer ↗

   hash

   FUpSQjMvaQf3…MZphbVtPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1575 B) ▸

   {"actor":"judge","artifact_identity":"9d7e6a9df54a922ad852a67b72c2f822","band_override":null,"blocked_count":3,"decided_at":"2026-11-02T05:02:24.363Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3333,"investigation_id":"58dfd95d-061d-4889-8631-bdb547d06e1a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":43,"page_slug":"eralend","prev_score":43,"reason":"The core incident facts (July 25, 2023 read-only reentrancy, about $3.4M lost, attacker address, SyncSwap-derived code, PeckShield trusted-oracle assumption) were confirmed by Rekt, CoinDesk and CertiK, and no claim was disputed. However, 3 of the 9 scoreable claims could not be verified: the Hacken cross-chain tracing (claim_findings[2]), the statement that EraLend marketed itself as safer for avoiding external oracles (claim_findings[6]), and the 'no communications since February 2024' claim (claim_findings[11]). That is a 33% unverified share, which falls in the significant band. The penalty is set at the mild end because nothing was contradicted and the reviewer's confidence is moderate. Three further claims could not be checked because their sources blocked the reviewer (August 2023 relaunch details, current TVL, rebrand date); these are a coverage limit, not a defect of the page.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f92a43a0-065c-477e-9359-1b3d3ea63ad0copy
5. #5rescoreby systemsystem

   2026-11-02 05:02:25Z
   Score: 43 → 45 (+2)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 43 → 45. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −6, problems around the subject, caused by others −0.3; legitimacy credit long-running +2; 2 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,370,484

   sig

   YAfeKLNjBeur…EewL7i8Kcopyexplorer ↗

   hash

   FxuzZC9LrydU…hERxM3LXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (745 B) ▸

   {"actor":"system","decided_at":"2026-11-02T05:02:24.363Z","decision":"rescore","investigation_id":"58dfd95d-061d-4889-8631-bdb547d06e1a","new_score":45,"page_slug":"eralend","prev_score":43,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 43 → 45. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −6, problems around the subject, caused by others −0.3; legitimacy credit long-running +2; 2 section(s) set aside until a failed fact-check is resolved.","score_delta":2,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 27fc3ec3-a2f5-4500-8047-b8f75dc5a7c2copy