Audit log

Every state-changing event for Harbor Protocol: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 02:28:21Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,847,451

   sig

   CKveSrhtTNwM…kEoqEik5copyexplorer ↗

   hash

   BNZFXHfNuMeL…1hoU5hy9copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5779 B) ▸

   {"actor":"system:backfill","investigation_id":"a95c7e99-75b1-4edf-bcf5-96d923ec7662","kind":"publish","page_slug":"harbor-protocol","published_at":"2026-05-29T02:28:21.023Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Harbor Protocol","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://anieljoshua94.medium.com/understanding-the-harbor-protocol-ecosystem-and-tokenomics-harbor-and-veharbor-af658df1216f","type":"other","url":""},{"credibility":3,"name":"https://www.coinlive.com/news-flash/7793","type":"other","url":""},{"credibility":3,"name":"https://harborprotocol.one/","type":"other","url":""},{"credibility":3,"name":"https://docs.harborprotocol.one/harbor-protocol","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.comdex.one/harbor-protocol-oracle-incident-report-654ff67b25b","type":"other","url":""},{"credibility":3,"name":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=harbor-protocol-exploit","type":"other","url":""},{"credibility":3,"name":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/harbor-protocol-reports-exploit-as-funds-stolen-from-vaults/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/harbor-protocol-falls-victim-attack-funds-missing/","type":"other","url":""},{"credibility":3,"name":"https://www.bitdegree.org/crypto/news/over-7m-stolen-in-separate-attacks-against-defi-protocols-exactly-and-harbor","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/harbor-protocol","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","type":"other","url":""},{"credibility":3,"name":"https://blog.comdex.one/harbor-protocol-exploit-breakdown-incident-report-b07cd117b1d6","type":"other","url":""},{"credibility":3,"name":"https://blocktelegraph.io/harbor-protocol-airdrop-siddarth-patil-of-comdex/","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/people/siddarth-patil/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/harbor-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.coinbase.com/price/harbor-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/harbor-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.coincarp.com/currencies/harbor-protocol/","type":"other","url":""},{"credibility":3,"name":"https://holder.io/coins/harbor/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=harbor-protocol-exploit","type":"other","url":""},{"credibility":3,"name":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/harbor-protocol","type":"other","url":""},{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""},{"credibility":3,"name":"https://blog.comdex.one/harbor-protocol-oracle-incident-report-654ff67b25b","type":"other","url":""}]}],"sources_used":[],"summary":"Harbor Protocol is a decentralized collateralized-debt-position (CDP) protocol built on the Comdex chain (Cosmos SDK / CosmWasm) that enabled users to mint the Composite stablecoin (CMST) against whitelisted collateral assets. The protocol suffered two distinct security incidents in 2023 — an oracle-manipulation liquidation event in June and a direct vault drain exploit in August — after which its total value locked collapsed to effectively zero. As of 2025 the protocol appears inactive, with the HARBOR governance token near worthless and no meaningful community or development activity detected.","timeline":[{"date":"2022-11-24","event":"Harbor Protocol officially launches on the Comdex mainnet, enabling CMST minting against safelisted collateral assets.","source":""},{"date":"2023-06-29","event":"Oracle incident: stATOM vault liquidations triggered by a faulty CoinGecko volume-weighted price feed that recorded stATOM at ~$0.02 instead of ~$10, causing vaults to be liquidated at deep discounts to market value.","source":""},{"date":"2023-08-18","event":"Vault drain exploit begins: attacker (comdex1sma0ntw7fq3fpux8suxkm9h8y642fuqt0ujwt5) manipulates cSwap prices for LUNA, stOSMO, and WMATIC collateral to borrow CMST far above real collateral values.","source":""},{"date":"2023-08-19","event":"Harbor Protocol publicly discloses the exploit, confirming funds were drained from stable-mint and multiple collateral vaults. TVL drops from approximately $370,000 to $81,000. Team appeals to attacker to make contact.","source":""},{"date":"2023-08-19","event":"Blockchain security firms DeDotFi and PeckShield confirm the Harbor exploit is unrelated to a concurrent Exactly Protocol attack on BNB Chain.","source":""},{"date":"2024-01-11","event":"HARBOR token records its all-time high price on CoinGecko before subsequently collapsing in value.","source":""},{"date":"2025-01-01","event":"DefiLlama records Harbor Protocol TVL at $0. No active governance, development, or community updates detected as of 2025. Protocol appears effectively inactive.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ece68f57-217b-4f73-87f4-21d2fa414568copy
2. #2rescoreby systemsystem

   2026-10-27 06:07:24Z
   Score: 28 → 50 (+22)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +4; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,649

   sig

   HyMYeCceRCKt…CHdmzL4Ecopyexplorer ↗

   hash

   91wGEN8hkbFJ…S8k9RYiAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (685 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:24.640Z","decision":"rescore","investigation_id":"a95c7e99-75b1-4edf-bcf5-96d923ec7662","new_score":50,"page_slug":"harbor-protocol","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +4; no longer operating, so capped at 50.","score_delta":22,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e5668870-a8ec-4ccf-b358-974b1f1f2a58copy
3. #3reviewby reviewerreviewer

   2026-11-02 00:12:36Z
   Score: 50 → 50 (no score change)
   The core narrative holds: a June 2023 incident, an August 18-19, 2023 vault exploit with TVL falling from about $370k to $81k, and a later deprecated, zero-TVL protocol. Two attributions are unsupported by the cited sources. The DeDotFi and PeckShield 'confirmed unrelated' claim appears in the section text and the timeline, and the ZachXBT 'flagged' claim has no support either. The named attacker address and the June oracle mechanics could not be verified because the primary Comdex posts were unreachable.
   anchoranchored

   chain

   ●mainnet-betaslot 464,289,408

   sig

   3SgnrjFBvvBL…vusF5syHcopyexplorer ↗

   hash

   5r4AaR8ZYCW2…FswQPSLCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1399 B) ▸

   {"actor":"reviewer","artifact_identity":"b2f63ebe82bec9cc7fa96e9787a76dc3","blocked_count":1,"decided_at":"2026-11-02T00:12:36.372Z","decision":"review","disputed_pct":0.5,"findings_hash":"8v9Z7SJpCwdogL3HvRQoU6TPNPjtCC4hh2AgqQMA98Yh","investigation_id":"a95c7e99-75b1-4edf-bcf5-96d923ec7662","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":0,"total":1},"page_content_hash":"45098991af49dcfa5b731fd159f2a02b5727f7d605adb0bcf4c4073044b8bacd","page_slug":"harbor-protocol","prev_score":50,"reason":"The core narrative holds: a June 2023 incident, an August 18-19, 2023 vault exploit with TVL falling from about $370k to $81k, and a later deprecated, zero-TVL protocol. Two attributions are unsupported by the cited sources. The DeDotFi and PeckShield 'confirmed unrelated' claim appears in the section text and the timeline, and the ZachXBT 'flagged' claim has no support either. The named attacker address and the June oracle mechanics could not be verified because the primary Comdex posts were unreachable.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":10,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8619163a-1d6e-40f8-948d-db19d38dcdaccopy
4. #4review reviseby judgejudge

   2026-11-02 00:12:36Z
   Score: 50 → 50 (no score change)
   Of 10 countable claim findings (one was excluded because its source was blocked), 3 were disputed and 2 could not be verified, giving 50%, which falls in the significant-issues band. The disputed items are attributions that no fetched source supports: DeDotFi and PeckShield 'confirming' the exploit was unrelated to the Exactly attack (claim_findings[0] and [1], in both the section text and the timeline), and ZachXBT 'flagging' the protocol (claim_findings[2]). The named attacker address (claim_findings[3]) could not be found in any source, and the primary Comdex post-mortems were unreachable, which is a high-priority coverage limit rather than a defect of the page. The core account of two 2023 incidents, the roughly $370k to $81k TVL drop and the later zero-TVL status is supported, so the penalty sits in the lower-middle of the band and the page is not delisted.
   anchoranchored

   chain

   ●mainnet-betaslot 464,289,413

   sig

   4mfsBGdrqbpa…CnyPeMnccopyexplorer ↗

   hash

   6hXth1akSsro…2CZKzFyocopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1557 B) ▸

   {"actor":"judge","artifact_identity":"b2f63ebe82bec9cc7fa96e9787a76dc3","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T00:12:36.372Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.5,"investigation_id":"a95c7e99-75b1-4edf-bcf5-96d923ec7662","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"harbor-protocol","prev_score":50,"reason":"Of 10 countable claim findings (one was excluded because its source was blocked), 3 were disputed and 2 could not be verified, giving 50%, which falls in the significant-issues band. The disputed items are attributions that no fetched source supports: DeDotFi and PeckShield 'confirming' the exploit was unrelated to the Exactly attack (claim_findings[0] and [1], in both the section text and the timeline), and ZachXBT 'flagging' the protocol (claim_findings[2]). The named attacker address (claim_findings[3]) could not be found in any source, and the primary Comdex post-mortems were unreachable, which is a high-priority coverage limit rather than a defect of the page. The core account of two 2023 incidents, the roughly $370k to $81k TVL drop and the later zero-TVL status is supported, so the penalty sits in the lower-middle of the band and the page is not delisted.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":10,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b009c1f0-0eaa-4685-8679-a6a35d247a45copy