Audit log

Every state-changing event for Fortress Loans: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 17:25:09Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,765,200

   sig

   3GjVKqSaocfy…HcAVUz3zcopyexplorer ↗

   hash

   GZeupq97vYd2…cc758vhvcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5823 B) ▸

   {"actor":"system:backfill","investigation_id":"c5ebecba-a25f-435c-afcf-b26ea3e8969d","kind":"publish","page_slug":"fortress-loans","published_at":"2026-05-28T17:25:09.253Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Fortress Loans","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://bsc.news/post/fortress-credit-and-lending-project-insight","type":"other","url":""},{"credibility":3,"name":"https://jetfuelfinance.medium.com/how-to-use-the-fortress-protocol-lending-borrowing-and-collecting-fts-rewards-aa6812389b9b","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/fortress-loans","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/k6eZOpnK5Kdde7RfHBZgw-fortress-loans-exploit","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/fortress-rekt","type":"other","url":""},{"credibility":3,"name":"https://slowmist.medium.com/slowmist-fortress-protocol-hack-analysis-19af24af723c","type":"other","url":""},{"credibility":3,"name":"https://therecord.media/defi-protocol-fortress-announces-3-million-hack","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/examination-of-the-fortress-protocol-hack-e261c96ea450","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/umbrella-network/update-on-umbrella-oracle-exploit-67ac0fe4414b","type":"other","url":""},{"credibility":3,"name":"https://therecord.media/defi-protocol-fortress-announces-3-million-hack","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/k6eZOpnK5Kdde7RfHBZgw-fortress-loans-exploit","type":"other","url":""},{"credibility":3,"name":"https://sayfer.io/blog/3-hacks-an-audit-could-not-find/","type":"other","url":""},{"credibility":3,"name":"https://fortress.loans/audit_hash0x.pdf","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://jetfuelfinance.medium.com/fortress-attack-update-and-compensation-e7a66621cfe6","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/fortress-loans","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/fortress-protocol-hacked-for-3-million-drained-of-all-funds/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinmarketcap.com/currencies/fortress-lending/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/fortress-loans","type":"other","url":""},{"credibility":3,"name":"https://coingecko.com/en/coins/fortress","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/k6eZOpnK5Kdde7RfHBZgw-fortress-loans-exploit","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/fortress-rekt","type":"other","url":""},{"credibility":3,"name":"https://slowmist.medium.com/slowmist-fortress-protocol-hack-analysis-19af24af723c","type":"other","url":""}]}],"sources_used":[],"summary":"Fortress Loans (fortress.loans) was an algorithmic money market and lending protocol on BNB Chain (Binance Smart Chain), launched in April 2021 by the JetFuel Finance team. On May 8, 2022, the protocol was drained of all funds — approximately $2.98 million — through a combined governance manipulation and oracle price manipulation attack. The protocol has been effectively inactive since, with DefiLlama recording a TVL of approximately $1,168 as of 2024, and the FTS governance token has lost effectively all of its value.","timeline":[{"date":"2021-04-01","event":"Fortress Loans launches on Binance Smart Chain as an algorithmic lending protocol developed by JetFuel Finance.","source":""},{"date":"2021-08-01","event":"Umbrella Network introduces buggy oracle smart contract code that would later be exploited; the code goes unaudited.","source":""},{"date":"2022-04-19","event":"The attacker first interacts with Fortress Loans, deploying an unverified custom contract in preparation for the later exploit.","source":""},{"date":"2022-04-29","event":"Attacker obtains 20 ETH via Tornado Cash on Ethereum mainnet and bridges 12.4 ETH to BNB Chain via cBridge.","source":""},{"date":"2022-05-08","event":"Exploit occurs: attacker purchases ~400,000 FTS tokens (~$8,000–$11 ETH), passes malicious Proposal FIP-11 raising FTS collateral factor to 70%, manipulates Umbrella oracle to inflate FTS price to near $1 trillion, and drains approximately $2.98 million in assets from all fToken markets.","source":""},{"date":"2022-05-08","event":"Fortress Protocol team pauses platform UI and announces hack on social media. FTS token price falls more than 45%. Umbrella Network deploys oracle hotfix.","source":""},{"date":"2022-05-08","event":"Stolen funds (1,048.1 ETH and 400,000 DAI) are bridged to Ethereum via Anyswap/Multichain and deposited into Tornado Cash.","source":""},{"date":"2022-05-14","event":"JetFuel Finance publishes compensation plan via Medium: over $1 million in compensation announced including $300,000 USDC immediate disbursement, $200,000 USDC reserve, and 10,000,000 UMB tokens from Umbrella Network on one-year vesting.","source":""},{"date":"2022-05-14","event":"Protocol restart scheduled; on-chain governance removal planned for May 16–17.","source":""},{"date":"2024-01-01","event":"DefiLlama records Fortress Loans TVL at approximately $1,168 with zero active loans; FTS token market cap approximately $13,900; protocol effectively dormant.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision da0cf183-40e2-486c-8b02-9a068329a88ecopy
2. #2rescoreby systemsystem

   2026-10-10 18:42:37Z
   Score: 18 → 50 (+32)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +4; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 455,362,363

   sig

   2jy5Ry4FT8nj…5M2EcTVTcopyexplorer ↗

   hash

   4o3HnWnooydD…HCg9j9Rzcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (683 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:42:37.309Z","decision":"rescore","investigation_id":"c5ebecba-a25f-435c-afcf-b26ea3e8969d","new_score":50,"page_slug":"fortress-loans","prev_score":18,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +4; no longer operating, so capped at 50.","score_delta":32,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision efaf19bd-b51d-4fb9-a7c0-74b628620ab3copy
3. #3reviewby reviewerreviewer

   2026-10-30 12:24:58Z
   Score: 50 → 50 (no score change)
   Core narrative (governance takeover, Umbrella oracle flaw, about $3M drained, Tornado Cash laundering, no recovery) matches CertiK and The Record, and the page transparently notes source discrepancies. CertiK's view on audit identifiability is overstated, and the DefiLlama TVL year looks off (2024 vs 2025, low confidence). Several claims could not be checked because SlowMist, Umbrella and DefiLlama blocked fetches.
   anchoranchored

   chain

   ●mainnet-betaslot 463,284,304

   sig

   4jqbeTifT3Es…fa3CRpRAcopyexplorer ↗

   hash

   BFZaqWo5M38E…rNjL3N4tcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1308 B) ▸

   {"actor":"reviewer","artifact_identity":"02873c6c2764c2090158b807c59e105f","blocked_count":2,"decided_at":"2026-10-30T12:24:58.443Z","decision":"review","disputed_pct":0.1667,"findings_hash":"E1d5UgJb9TiFcMLGzF7QSDAnTyqCK5RtdYUMhTgNSgHs","investigation_id":"c5ebecba-a25f-435c-afcf-b26ea3e8969d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":0,"total":1},"page_content_hash":"e84f8e26c81732e2aa68c00ed36db5d698295e26bbe39e58efaa4dafdcd74077","page_slug":"fortress-loans","prev_score":50,"reason":"Core narrative (governance takeover, Umbrella oracle flaw, about $3M drained, Tornado Cash laundering, no recovery) matches CertiK and The Record, and the page transparently notes source discrepancies. CertiK's view on audit identifiability is overstated, and the DefiLlama TVL year looks off (2024 vs 2025, low confidence). Several claims could not be checked because SlowMist, Umbrella and DefiLlama blocked fetches.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":6,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ab518331-f518-4ad0-8236-6d29450d9bfecopy
4. #4review reviseby judgejudge

   2026-10-30 12:24:58Z
   Score: 50 → 50 (no score change)
   The core account of the incident (governance takeover, Umbrella oracle flaw, about $3M drained, Tornado Cash laundering) was confirmed by CertiK and The Record (claim_findings[2]). Of the 6 claims that could be checked, 1 could not be verified (claim_findings[1], audit-scope inference), giving about 17%. Two further claims need correction: the page overstates CertiK's view that both weaknesses were identifiable in an audit (claim_findings[0]), and the DefiLlama TVL year appears to be 2025, not 2024 (claim_findings[6] and [7], based on a search snippet). Two claims (Umbrella compensation figures, attacker addresses) could not be checked because the sources blocked the reviewer, so they are a coverage limit and not a defect of the page. The penalty is kept at the mild end because the issues are minor and the reviewer's confidence was moderate.
   anchoranchored

   chain

   ●mainnet-betaslot 463,284,309

   sig

   3kqUs95HoRqq…vJpuZFtfcopyexplorer ↗

   hash

   4TJqAQ6QGjUi…LtJ8FiMjcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1537 B) ▸

   {"actor":"judge","artifact_identity":"02873c6c2764c2090158b807c59e105f","band_override":null,"blocked_count":2,"decided_at":"2026-10-30T12:24:58.443Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1667,"investigation_id":"c5ebecba-a25f-435c-afcf-b26ea3e8969d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"fortress-loans","prev_score":50,"reason":"The core account of the incident (governance takeover, Umbrella oracle flaw, about $3M drained, Tornado Cash laundering) was confirmed by CertiK and The Record (claim_findings[2]). Of the 6 claims that could be checked, 1 could not be verified (claim_findings[1], audit-scope inference), giving about 17%. Two further claims need correction: the page overstates CertiK's view that both weaknesses were identifiable in an audit (claim_findings[0]), and the DefiLlama TVL year appears to be 2025, not 2024 (claim_findings[6] and [7], based on a search snippet). Two claims (Umbrella compensation figures, attacker addresses) could not be checked because the sources blocked the reviewer, so they are a coverage limit and not a defect of the page. The penalty is kept at the mild end because the issues are minor and the reviewer's confidence was moderate.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":6,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 954d235c-4819-405d-93b9-a4c5cee2d4c0copy