Fact-check findings
What an automated fact-checker found when it re-read Fortress Loans against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #2[unverifiable][awaiting moderator]in section: Audit failures and scope gaps
“Neither audit found the oracle flaw, which sat in Umbrella Network's contract rather than in Fortress's own code and so was outside the scope of the Fortress-specific audits.”
reviewerNeither Hash0x nor EtherAuthority audit found the oracle flaw because it was outside audit scope.Scope inference not verified against the audit PDF or Sayfer; I did not fetch them. - #5[unverifiable][awaiting moderator]in section: Oracle provider responsibility
“It deployed a hotfix the same day and compensated Fortress with $500,000 USDC and 10,000,000 UMB tokens vesting linearly over one year; MahaDAO received $500,000 USDC and 2,500,000 UMB.”
reviewerUmbrella post-mortem details (Aug 2021 code, $2.2M Fortress / $700K MahaDAO, compensation).Medium returned 403; The Record corroborates only the hotfix. Not scored. - #6[unverifiable][awaiting moderator]in section: Attack preparation and fund laundering
“The attacker's externally owned account is 0xA6AF2872176320015f8ddB2ba013B38Cb35d22Ad, the attack contract is 0xcd337b920678cf35143322ab31ab8977c3463a45, and the primary attack transaction hash is 0x13d19809b19ac512da6d110764caee75e2157ea62cb70937c8d9471afcb061bf.”
reviewerAttacker address, attack contract and primary transaction hash; attack preparation and laundering route.SlowMist blocked; CertiK confirms 19 April first interaction and unverified custom contract. Addresses not independently checked on-chain.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #7[stale][awaiting moderator]in section: Team response and compensation
“DefiLlama recorded TVL of approximately $1,168 as of 2024, down from several million dollars before the hack, with zero active loans.”
reviewerDefiLlama TVL about $1,168 with zero active loans; protocol effectively defunct.The year 2024 appears wrong per search snippet only (page itself not fetched); low-confidence date correction. The deprecated label supports 'defunct'.Proposed correction (not yet applied)DefiLlama recorded TVL of approximately $1,168 as of 2025, down from several million dollars before the hack, with zero active loans. - #8[stale][awaiting moderator]in the timeline
“2024”
reviewerTimeline entry dates DefiLlama data to 2024.Same issue as sections[7]; based on a search snippet only.Proposed correction (not yet applied)2025
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in section: Audit failures and scope gaps
“CertiK's analysis traced the exploit to the commented-out signature check in Umbrella's submit() function and stated that both weaknesses, the governance threshold and the oracle access-control gap, would have been identifiable in a comprehensive audit covering all integrated dependencies.”
reviewerCertiK stated that both the governance threshold and the oracle access-control gap would have been identifiable in a comprehensive audit.CertiK distinguishes the two weaknesses; page overstates symmetry. Correction is optional (partially_supported). - #4[partially supported][awaiting moderator]in section: Governance attack mechanism
“Because the FTS price was depressed, the attacker could buy that stake cheaply.”
reviewerAttacker bought about 400,000 FTS (4% of supply) for roughly 11 ETH.CertiK supports page; BlockSec via The Record gives a different FTS amount that the page does not mention.
confirmed
1 claimThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: May 2022 exploit
“The FTS token price fell more than 45% after the breach was disclosed.”
reviewerExploit date and amount: about $2.98 million drained in May 2022; ETH/DAI deposited into Tornado Cash; FTS fell more than 45%.Core incident facts and the 8 vs 9 May discrepancy are accurately represented.