← Gondi V3reviewed 2026-09-07 · 20 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Gondi V3 against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in section: Protocol Overview and Background
“The protocol has been flagged by blockchain investigator ZachXBT in connection with the March 2026 exploit incident.”
reviewerGondi has been flagged by blockchain investigator ZachXBT in connection with the March 2026 Purchase Bundler exploitNone of the section's own cited sources, nor any dedicated Gondi-exploit coverage found, tie ZachXBT to this incident. The likely source of this claim is a separate, unrelated September 2025 ZachXBT report about stolen Hypurr NFTs on HyperEVM, which appears to have been conflated with Gondi's March 2026 exploit. - #6[disputed][awaiting moderator]in section: March 2026 Smart Contract Exploit
“The exploit was deployed on both Ethereum Mainnet and HypeEVM.”
reviewerThe exploit was deployed on both Ethereum Mainnet and HypeEVMNone of the page's own cited exploit sources, nor the most detailed independent technical writeup found, mention HypeEVM in connection with the exploit itself (Gondi's protocol does support HypeEVM generally for lending, which is a separate and accurate claim). This sentence appears to conflate the exploit with an unrelated September 2025 incident involving Hypurr NFTs stolen from compromised HyperEVM wallets, flagged separately by ZachXBT.
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in the summary
“raised a $5.35 million seed round from Hack.vc, Dragonfly Capital, and Pantera Capital”
reviewerFlorida Street raised a $5.35 million seed round from Hack.vc, Dragonfly Capital, and Pantera Capital (summary omits co-lead status and 6th Man Ventures)CoinDesk, Benzinga, CryptoSlate and TokenInsight all describe the round as co-led by Hack.vc AND Foundation Capital, with Dragonfly, Pantera and 6th Man Ventures as additional participants. The summary's phrasing implies Hack.vc alone led with only Dragonfly and Pantera participating, which understates Foundation Capital's co-lead role (the section body text gets this right). - #5[partially supported][awaiting moderator]in section: March 2026 Smart Contract Exploit
“The vulnerability consisted of a missing msg.sender ownership check in the contract's buy function: any caller could invoke the function and instruct it to transfer NFTs using approvals that users had previously granted during normal platform interactions.”
reviewerThe vulnerability was a missing msg.sender check in the Purchase Bundler's 'buy' functionThe page's cited source does support the 'buy' framing, but a more technically detailed, primary forensic writeup (DarkNavy, not cited by the page) names the function 'executeSell' and describes a borrower/active-loan check rather than a simple ownership check. Not flagged as fully disputed because a cited source does back the page's wording, but the discrepancy with the more rigorous technical source should be noted. - #9[partially supported][awaiting moderator]in section: Incident Response and Remediation
“Crypto researcher "Tinoch" was credited in press coverage for identifying the largest single victim's losses.”
reviewerCrypto researcher "Tinoch" was credited in press coverage for identifying the largest single victim's lossesThe substance of the attribution (identifying the ~$108K largest loss) is correct, but the description of tinoch as a 'researcher' is not what TheBlock's coverage uses; this is a minor characterization issue. - #12[partially supported][awaiting moderator]in section: Audit History and Security Posture
“Documented auditors include Zenith (formerly Code4rena), Halborn, 0xQuit, and Qckhp.”
reviewerDocumented auditors of Gondi V3 include Zenith (formerly Code4rena), Halborn, 0xQuit, and QckhpThe V3-specific auditors listed are accurate, but the section presents this as the complete audit history without noting the additional V1/V2 auditors documented in the same cited source. - #14[partially supported][awaiting moderator]in section: Market Context and Protocol Standing
“Average NFT loan sizes reportedly dropped approximately 71% year-over-year from approximately $14,000 in May 2024 to approximately $4,000 in 2025.”
reviewerAverage NFT loan sizes dropped ~71% year-over-year from ~$14,000 (May 2024) to ~$4,000 (2025)The 71%/$14,000-to-$4,000 figure is independently verifiable and appears accurate (matches DappRadar-sourced reporting found via broader search), but none of the three sources actually cited for this section contain this specific statistic — a sourcing mismatch rather than a factual error.
confirmed
13 claimsThe cited evidence supports the claim as written.
- #2[confirmed][no action needed]in section: Protocol Overview and Background
“As of mid-2025, Gondi reported over $100 million in total value locked, approximately $45 million in outstanding debt, and annualized loan volume above $400 million, making it the largest NFT lending protocol by share of outstanding loans at roughly 54% of market share.”
reviewerAs of mid-2025, Gondi had over $100M TVL, ~$45M in outstanding debt, >$400M annualized loan volume, and ~54% NFT lending market shareFigures are corroborated by the cited press release and an independent outlet reporting a closely aligned earlier snapshot. - #4[confirmed][no action needed]in section: March 2026 Smart Contract Exploit
“On March 9, 2026, at approximately 8:12 AM UTC, Gondi V3 was exploited through a logic flaw in its Purchase Bundler smart contract, a component of the Sell & Repay feature that had been deployed on February 20, 2026.”
reviewerOn March 9, 2026 at approximately 8:12 AM UTC, Gondi V3 was exploited via a logic flaw in the Purchase Bundler, deployed Feb 20, 2026, as part of Sell & RepayMarch 9, 2026 is independently confirmed to fall on a Monday, matching the source articles' day-of-week references; a Cointelegraph AI-generated summary mislabeled the day as 'Monday, March 10' which is internally inconsistent (March 10, 2026 is a Tuesday). - #7[confirmed][no action needed]in section: March 2026 Smart Contract Exploit
“The attacker executed approximately 40 transactions, draining an estimated 78 NFTs.”
reviewerThe attacker executed ~40 transactions draining an estimated 78 NFTs, worth ~$230,000 total, with the largest single victim losing ~$108,000The 40 transactions / 78 NFTs distinction is corroborated by the page's own cited dev.to report and TheBlock, and by an independent technical writeup (DarkNavy) with on-chain forensic detail. One lower-credibility cited source (autosec.dev) conflates the two figures, but this does not undermine the page's more precise and better-supported framing. - #8[confirmed][no action needed]in section: Incident Response and Remediation
“Platform operations resumed on March 10, 2026, with the compromised contracts excluded. Gondi engaged Blockaid, a blockchain security firm, and retained an independent auditor who subsequently reviewed the remaining contracts and determined the platform to be safe for continued use.”
reviewerPlatform operations resumed on March 10, 2026, with compromised contracts excluded; Blockaid and an independent auditor reviewed remaining contracts and cleared them as safeConsistent across sources; the independent auditor is not named in any source found, which limits full verification of that specific detail. - #10[confirmed][no action needed]in section: Restitution and Compensation
“"While not the exact same piece, we believe this is a fair and meaningful resolution and are coordinating directly with each owner."”
reviewerGondi's official statement on restitution: "While not the exact same piece, we believe this is a fair and meaningful resolution and are coordinating directly with each owner."Quote and restitution mechanism (protocol-fee-funded comparable NFT purchases) are corroborated across TheBlock and crypto.news. - #11[confirmed][no action needed]in section: Audit History and Security Posture
“Code4rena conducted a Gondi Invitational audit in April 2024 with $74,600 in USDC allocated to the contest, followed by a Gondi Mitigation Review in May 2024.”
reviewerCode4rena Gondi Invitational audit conducted in April 2024 with $74,600 USDC allocatedDates, prize amount, and specific documented findings all directly verified against the primary Code4rena contest pages. - #13[confirmed][no action needed]in section: Audit History and Security Posture
“Gondi's documentation lists a bug bounty program accessible via Discord private ticket, but does not publish specific bounty amounts or severity tiers.”
reviewerGondi's bug bounty program is accessible via Discord private ticket and does not publish specific bounty amounts or severity tiersDirectly confirmed against the cited documentation page. - #15[confirmed][no action needed]in section: Market Context and Protocol Standing
“Gondi reported growth milestones including the largest on-chain NFT loan ever — a $2.75 million USDC loan secured by a seven-attribute CryptoPunk”
reviewerGondi facilitated the largest on-chain NFT loan ever — a $2.75 million USDC loan secured by a seven-attribute CryptoPunkConfirmed by multiple independent outlets beyond the page's own cited source. - #16[confirmed][no action needed]in the timeline
“Gondi NFT lending protocol launches publicly on Ethereum; Florida Street announces $5.35 million seed round co-led by Hack.vc and Foundation Capital with participation from Dragonfly Capital and Pantera Capital.”
reviewerGondi launched publicly July 11, 2023 with the $5.35M seed round announcementTimeline entry's date and event description (unlike the summary) correctly reflect the co-lead structure. - #17[confirmed][no action needed]in the timeline
“Code4rena (Zenith) conducts a Gondi Invitational audit with $74,600 USDC in prizes, reviewing V3 smart contracts.”
reviewerCode4rena Gondi Invitational audit began April 8, 2024Directly confirmed. - #18[confirmed][no action needed]in the timeline
“Code4rena conducts a Gondi Mitigation Review audit, identifying issues including tranche accounting errors, division ordering bugs, and access control gaps; mitigation review period runs through May 24, 2024.”
reviewerCode4rena Mitigation Review conducted starting May 14, 2024, running through May 24, 2024Directly confirmed against primary Code4rena page. - #19[confirmed][no action needed]in the timeline
“Gondi deploys an updated version of the Sell & Repay contract containing the Purchase Bundler component with a missing caller-verification check in the buy function.”
reviewerPurchase Bundler component deployed February 20, 2026 with the missing caller-verification checkDeployment date is well corroborated; the 'buy function' framing carries the same caveat noted in the section-level finding above. - #20[confirmed][no action needed]in the timeline
“Gondi platform resumes operations for buying, selling, trading, and lending functions with the compromised contract excluded. Blockaid and an independent auditor review remaining contracts and clear them as safe. Gondi pledges restitution via protocol fee-funded comparable NFT purchases.”
reviewerPlatform resumed operations March 10, 2026 for buying/selling/trading/lending with compromised contract excludedConsistent with the archive timestamp of the cited TheBlock source (2026-03-10T11:10:59Z), reinforcing the resumption date.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.