Audit log

Every state-changing event for GoonFi: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 02:28:26Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,847,469

   sig

   5QaTnJkuQPmH…ob5PgVabcopyexplorer ↗

   hash

   CTerKynDpwsh…FDUV35kvcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5036 B) ▸

   {"actor":"system:backfill","investigation_id":"688e79fa-eb82-48bc-936a-f1fca1c23495","kind":"publish","page_slug":"goonfi","published_at":"2026-05-29T02:28:26.802Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"GoonFi","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/goonfi","type":"other","url":""},{"credibility":3,"name":"https://www.helius.dev/blog/solanas-proprietary-amm-revolution","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/centralization-again-4a8c774b2bdd","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://smartcontractshacking.com/hacks/goonfi-hack-2026","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/goonfi","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/centralization-again-4a8c774b2bdd","type":"other","url":""},{"credibility":3,"name":"https://www.helius.dev/blog/solanas-proprietary-amm-revolution","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","type":"other","url":""},{"credibility":3,"name":"https://x.com/smyyguy/status/1941500890336329733","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/centralization-again-4a8c774b2bdd","type":"other","url":""},{"credibility":3,"name":"https://www.benzinga.com/Opinion/25/10/48120742/defi-new-landlords","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://solscan.io/token/6kKBtdEoStQoHg1cTmjiXkRvEpyin1gadJctCoRPiT6f","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/price/goonfi","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/goonfi","type":"other","url":""},{"credibility":3,"name":"https://dexscreener.com/solana/8hbubwoji41pnxjoqhgtjimhpwmtoeytoqmy8h4be5cz","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://smartcontractshacking.com/hacks/goonfi-hack-2026","type":"other","url":""},{"credibility":3,"name":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://smartcontractshacking.com/hacks/goonfi-hack-2026","type":"other","url":""},{"credibility":3,"name":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","type":"other","url":""},{"credibility":3,"name":"https://www.helius.dev/blog/solanas-proprietary-amm-revolution","type":"other","url":""}]}],"sources_used":[],"summary":"GoonFi is a proprietary automated market maker (Prop AMM) operating on Solana, launched in June 2025 with no public team, no frontend, and no published smart-contract audit. On March 28, 2026, a protocol logic vulnerability was exploited via mispricing arbitrage, resulting in approximately $254,000 in losses with no recovery reported. The protocol has been flagged by ZachXBT and is cited by researchers as representative of a broader Solana centralization concern, wherein anonymous, closed-source market makers capture an outsized share of DEX volume with minimal accountability.","timeline":[{"date":"2025-01-01","event":"ZeroFi, an early Solana Prop AMM peer, begins operations on Solana ahead of GoonFi's launch.","source":""},{"date":"2025-06-01","event":"GoonFi launches on Solana as a proprietary AMM with a single active trading pair (SOL-USD), no public team, and no frontend.","source":""},{"date":"2025-07-04","event":"Dan Smith (X: @smyyguy) publicly notes GoonFi's emergence, citing $25–50 million in daily volume on a single SOL-USD pair.","source":""},{"date":"2025-07-01","event":"Data shows 99.2% of GoonFi volume is aggregator-driven via Jupiter, indicating near-total routing dependency.","source":""},{"date":"2025-08-26","event":"GF token reaches its all-time high price before beginning a sustained decline.","source":""},{"date":"2026-03-28","event":"GoonFi exploited via mispricing arbitrage attack on Solana; approximately $254,000 drained. Funds allegedly moved through mixers. No recovery reported. Post-mortem published by 'cetipo' on X.","source":""},{"date":"2026-03-28","event":"ZachXBT flags GoonFi following the exploit. No public team response or compensation plan issued.","source":""},{"date":"2026-05-28","event":"GoonFi DEX cumulative volume stands at approximately $29.8 billion per DeFiLlama, while GF token 24-hour trading volume is approximately $702. Protocol TVL remains at $0.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4a9d83b3-de28-4095-aee7-08c3dc4790e5copy
2. #2rescoreby systemsystem

   2026-10-27 06:07:11Z
   Score: 32 → 49 (+17)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 49. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,286

   sig

   vDuW8evqekXx…gFBdf4rMcopyexplorer ↗

   hash

   AejVtfkUJQZp…TB31Uw3scopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (638 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:11.609Z","decision":"rescore","investigation_id":"688e79fa-eb82-48bc-936a-f1fca1c23495","new_score":49,"page_slug":"goonfi","prev_score":32,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 49. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +2.","score_delta":17,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f39cdda2-6c19-4f39-b426-48de4ee44f69copy
3. #3reviewby reviewerreviewer

   2026-10-27 19:21:38Z
   Score: 49 → 49 (no score change)
   The core incident (Mar 28 2026, ~$254K, pool mispricing on Solana) is confirmed. Several specifics are not supported by the cited sources: a 'could have been caught in audit' quote that does not appear on the cited page, the 'post-mortem' by cetipo (an alert), mixer laundering, the ZachXBT flag, a 6%/$113M market share figure (which Helius attributes to Tessera), and a Jupiter-specific 99.2%. The page also says no team response, while the source says the program was reportedly halted. Many other sources were not verified.
   anchoranchored

   chain

   ●mainnet-betaslot 462,187,213

   sig

   JgnKV8gyZdR9…NXC4MoFzcopyexplorer ↗

   hash

   6JNY7QMXY1B9…fPDcXbdscopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1408 B) ▸

   {"actor":"reviewer","artifact_identity":"76defe12c84df40d21590379ceee2a01","blocked_count":1,"decided_at":"2026-10-27T19:21:38.679Z","decision":"review","disputed_pct":0.6364,"findings_hash":"9nfJxCt51aa91VGZD1gsXUCtfvMFbQxUM92JPfQvr8RB","investigation_id":"688e79fa-eb82-48bc-936a-f1fca1c23495","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":49,"omissions":{"material":1,"total":1},"page_content_hash":"9ad417cb9112bb5a6eaae66630761dae9855a374be15b30fb627d812763ed423","page_slug":"goonfi","prev_score":49,"reason":"The core incident (Mar 28 2026, ~$254K, pool mispricing on Solana) is confirmed. Several specifics are not supported by the cited sources: a 'could have been caught in audit' quote that does not appear on the cited page, the 'post-mortem' by cetipo (an alert), mixer laundering, the ZachXBT flag, a 6%/$113M market share figure (which Helius attributes to Tessera), and a Jupiter-specific 99.2%. The page also says no team response, while the source says the program was reportedly halted. Many other sources were not verified.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":11,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 276a17c0-94ce-44b4-8c51-50ca1f432843copy
4. #4review reviseby judgejudge

   2026-10-27 19:21:39Z
   Score: 49 → 49 (no score change)
   The core incident (March 28, 2026, about $254,000, pool mispricing on Solana) is confirmed (claim_findings[0]). Of 11 scorable claims (one DeFiLlama claim was blocked and excluded), 2 were disputed and 5 could not be found in any source, about 64%. The disputed items include a 'could have been caught in audit' quote that does not appear on the cited page (claim_findings[1], [2]). The unsupported items include a ZachXBT flag stated flatly in the summary and timeline (claim_findings[5], [6]), mixer laundering, and a market-share figure that Helius attributes to a different protocol (claim_findings[9]). The page also says there was no team response while the source reports the program was halted (omission_findings[0]). The percentage alone falls in the deny band, but the verdict is revise rather than deny because the reviewer's confidence was only 0.55, the central exploit claim holds, and the unsupported claims were mostly not found rather than contradicted.
   anchoranchored

   chain

   ●mainnet-betaslot 462,187,218

   sig

   22WVtpH1x6i9…mNyuATo8copyexplorer ↗

   hash

   GNkLKtrdqf7o…wNybUmMEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (3197 B) ▸

   {"actor":"judge","artifact_identity":"76defe12c84df40d21590379ceee2a01","band_override":{"actual_delta":-30,"actual_verdict":"review_revise","disputed_pct":0.6364,"expected_delta_range":[-50,-30],"expected_verdict":"review_deny","rationale":"The core incident (March 28, 2026, about $254,000, pool mispricing on Solana) is confirmed (claim_findings[0]). Of 11 scorable claims (one DeFiLlama claim was blocked and excluded), 2 were disputed and 5 could not be found in any source, about 64%. The disputed items include a 'could have been caught in audit' quote that does not appear on the cited page (claim_findings[1], [2]). The unsupported items include a ZachXBT flag stated flatly in the summary and timeline (claim_findings[5], [6]), mixer laundering, and a market-share figure that Helius attributes to a different protocol (claim_findings[9]). The page also says there was no team response while the source reports the program was halted (omission_findings[0]). The percentage alone falls in the deny band, but the verdict is revise rather than deny because the reviewer's confidence was only 0.55, the central exploit claim holds, and the unsupported claims were mostly not found rather than contradicted."},"blocked_count":1,"decided_at":"2026-10-27T19:21:38.679Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.6364,"investigation_id":"688e79fa-eb82-48bc-936a-f1fca1c23495","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":49,"page_slug":"goonfi","prev_score":49,"reason":"The core incident (March 28, 2026, about $254,000, pool mispricing on Solana) is confirmed (claim_findings[0]). Of 11 scorable claims (one DeFiLlama claim was blocked and excluded), 2 were disputed and 5 could not be found in any source, about 64%. The disputed items include a 'could have been caught in audit' quote that does not appear on the cited page (claim_findings[1], [2]). The unsupported items include a ZachXBT flag stated flatly in the summary and timeline (claim_findings[5], [6]), mixer laundering, and a market-share figure that Helius attributes to a different protocol (claim_findings[9]). The page also says there was no team response while the source reports the program was halted (omission_findings[0]). The percentage alone falls in the deny band, but the verdict is revise rather than deny because the reviewer's confidence was only 0.55, the central exploit claim holds, and the unsupported claims were mostly not found rather than contradicted.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":11,"sequence_num":4,"severity_override":{"applied":false,"band":null,"from_band":"deny","reason":"The material omission (source reports the program was reportedly halted, page says no team response) is already reflected in the unsupported-claim count, which puts the page in the harshest percentage band. It does not add a separate reason to change the verdict. The subject's current operating status is unknown and does not contradict the page."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 101df3a1-86e6-4b09-94df-5ed86eae35e4copy