Audit log

Every state-changing event for Kame Aggregator: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 18:30:27Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,338,843

   sig

   29uPG38U7tYx…LBMS8ycMcopyexplorer ↗

   hash

   BLtpgafuVgTL…MyfBpFiMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5126 B) ▸

   {"actor":"system:backfill","investigation_id":"fc3166bc-cdac-442b-a51b-eae4fce81fe4","kind":"publish","page_slug":"kame-aggregator","published_at":"2026-05-26T18:30:27.431Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Kame Aggregator","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","type":"other","url":""},{"credibility":3,"name":"https://revoke.cash/exploits/kame","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/kameaggregatorswapfunctionarbitraryexecutorcallbug.php","type":"other","url":""},{"credibility":3,"name":"https://blockonomi.com/kame-aggregator-on-sei-hit-by-1m-exploit-hacker-returns-185-eth","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/kameaggregatorswapfunctionarbitraryexecutorcallbug.php","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/the-hidden-danger-of-unlimited-token","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptopolitan.com/kame-aggregator-recovers-185-eth/","type":"other","url":""},{"credibility":3,"name":"https://coinedition.com/kame-aggregator-185eth-recovery-sei-hack/","type":"other","url":""},{"credibility":3,"name":"https://revoke.cash/exploits/kame","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/news/95334","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.mexc.com/news/95334","type":"other","url":""},{"credibility":3,"name":"https://phemex.com/news/article/kame-aggregator-recovers-185-eth-posthack-plans-user-compensation-18436","type":"other","url":""},{"credibility":3,"name":"https://revoke.cash/exploits/kame","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://stouy.com/kame-dex-aggregator-on-sei-guide/","type":"other","url":""},{"credibility":3,"name":"https://web3.bitget.com/en/dapp/kame-aggregator-31324","type":"other","url":""},{"credibility":3,"name":"https://tracxn.com/d/companies/kame/__8YJXssv554ck8xcBPEZIFCjFYJLEEmiehR6l3qua8rU/founders-and-board-of-directors","type":"other","url":""},{"credibility":3,"name":"https://alphagrowth.io/kame-aggregator","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://revoke.cash/exploits/kame","type":"other","url":""},{"credibility":3,"name":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit","type":"other","url":""}]}],"sources_used":[],"summary":"Kame Aggregator is a decentralized exchange (DEX) aggregator protocol built on the Sei blockchain, launched in late May 2025, designed to route token swaps across multiple liquidity sources for optimal pricing. On September 13, 2025, the protocol suffered a critical smart contract exploit in which approximately $1.325 million was drained from 830 user wallets via an arbitrary external call vulnerability in its swap() function. The primary exploiter returned approximately $946,000 after negotiations, while secondary exploiters retained approximately $357,000; the team initiated a compensation program that reached over $1 million USDC in distributions by November 2025.","timeline":[{"date":"2025-05-01","event":"Kame Aggregator launches on the Sei blockchain as the network's first native DEX aggregator, aggregating liquidity from 12+ sources.","source":""},{"date":"2025-09-13","event":"Critical exploit in the AggregationRouter swap() function; attackers abuse arbitrary external call vulnerability and unlimited token approvals to drain approximately $1.325 million from 830 user wallets.","source":""},{"date":"2025-09-13","event":"Kame team detects exploit and immediately alerts users across X, Telegram, and Discord to revoke token approvals. Platform temporarily closes.","source":""},{"date":"2025-09-13","event":"Kame team establishes direct contact with primary exploiter and begins negotiation.","source":""},{"date":"2025-09-14","event":"Primary exploiter accepts 20% bounty offer and transfers 185 ETH (~$946,195) to Kame's recovery wallet via on-chain Ethereum transaction.","source":""},{"date":"2025-09-14","event":"White hat hackers recover an additional approximately $21,900 from the exploit.","source":""},{"date":"2025-09-14","event":"Kame publishes post-mortem detailing the vulnerability, affected contracts, and five-point remediation plan.","source":""},{"date":"2025-10-01","event":"Kame begins rolling out compensation distributions to affected users in multiple stages.","source":""},{"date":"2025-11-01","event":"Cumulative compensation distributions exceed $1,031,115 USDC across all stages; team states commitment to 100% reimbursement.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 79d1743d-2e5f-4f65-8e46-82b8ea40b6bdcopy
2. #2rescoreby systemsystem

   2026-10-10 18:48:12Z
   Score: 32 → 53 (+21)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 53. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,227

   sig

   5tzBzhFp3mtU…64yQFDR3copyexplorer ↗

   hash

   BY7jGYxC7vvx…spgR8MVScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (611 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:48:12.060Z","decision":"rescore","investigation_id":"fc3166bc-cdac-442b-a51b-eae4fce81fe4","new_score":53,"page_slug":"kame-aggregator","prev_score":32,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 53. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4.","score_delta":21,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9f93c23f-4cfb-44ac-9bc2-ffac43e2784fcopy
3. #3reviewby reviewerreviewer

   2026-11-02 00:50:39Z
   Score: 53 → 53 (no score change)
   The core exploit facts (about $1.3245M, 830 users, about $946k returned, about $22k from whitehats, 20% bounty) match Kame's post-mortem. Weak points are the exploit date (primary sources say Sept 12, the page says Sept 13), the derived $356k figure, a dead mexc source that was the only apparent support for the compensation totals, and unsupported founder and launch claims. Current status was not determined. Several fetches went through a summarising tool and the sources were not read in full.
   anchoranchored

   chain

   ●mainnet-betaslot 464,299,935

   sig

   5gPupHiQtyh6…GEpYnVgccopyexplorer ↗

   hash

   72nWZTkccrHV…mJ2EJyrycopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1388 B) ▸

   {"actor":"reviewer","artifact_identity":"3656fdfe743bdde4d6fb3fb2b0e861b8","blocked_count":1,"decided_at":"2026-11-02T00:50:39.773Z","decision":"review","disputed_pct":0.2857,"findings_hash":"FTXsozRREykbDcXU8NMjkAgDG9SH5rdciHQArmDkw1YG","investigation_id":"fc3166bc-cdac-442b-a51b-eae4fce81fe4","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"omissions":{"material":0,"total":2},"page_content_hash":"2fb810da5530d4f8eae9ed821ff7e9fdd221106737739ab0018b76be5ead8fb6","page_slug":"kame-aggregator","prev_score":53,"reason":"The core exploit facts (about $1.3245M, 830 users, about $946k returned, about $22k from whitehats, 20% bounty) match Kame's post-mortem. Weak points are the exploit date (primary sources say Sept 12, the page says Sept 13), the derived $356k figure, a dead mexc source that was the only apparent support for the compensation totals, and unsupported founder and launch claims. Current status was not determined. Several fetches went through a summarising tool and the sources were not read in full.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":14,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 77af4d75-4dfc-47a6-aa5b-ed306944e242copy
4. #4review reviseby judgejudge

   2026-11-02 00:50:40Z
   Score: 53 → 53 (no score change)
   The core exploit figures (about $1.3245M drained, 830 users, about $946k returned, 20% bounty) match the team's own post-mortem (claim_findings[1], [3]), and no claim was outright disputed. Of 14 countable findings (one blocked founder-name check excluded), 4 could not be verified, about 29%, which falls in the minor-issues band. The main weaknesses are the exploit date, which primary sources put on September 12 rather than 13 (claim_findings[0]), the compensation total of $1,031,115 whose only apparent source is a dead mexc.com link (claim_findings[10], [11], [12]), and a $356,438 secondary-exploiter figure that is derived rather than reported (claim_findings[4]). The omissions are minor and the reviewer found no evidence of a shutdown; current operating status remains an open high-priority gap. The reviewer's confidence is moderate (0.55), so the penalty is kept in the lower half of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,299,940

   sig

   4BsRgDMtUkJL…eQgUHQEDcopyexplorer ↗

   hash

   3GYe6oJZUHPv…cR4WwnVAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1593 B) ▸

   {"actor":"judge","artifact_identity":"3656fdfe743bdde4d6fb3fb2b0e861b8","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T00:50:39.773Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2857,"investigation_id":"fc3166bc-cdac-442b-a51b-eae4fce81fe4","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"page_slug":"kame-aggregator","prev_score":53,"reason":"The core exploit figures (about $1.3245M drained, 830 users, about $946k returned, 20% bounty) match the team's own post-mortem (claim_findings[1], [3]), and no claim was outright disputed. Of 14 countable findings (one blocked founder-name check excluded), 4 could not be verified, about 29%, which falls in the minor-issues band. The main weaknesses are the exploit date, which primary sources put on September 12 rather than 13 (claim_findings[0]), the compensation total of $1,031,115 whose only apparent source is a dead mexc.com link (claim_findings[10], [11], [12]), and a $356,438 secondary-exploiter figure that is derived rather than reported (claim_findings[4]). The omissions are minor and the reviewer found no evidence of a shutdown; current operating status remains an open high-priority gap. The reviewer's confidence is moderate (0.55), so the penalty is kept in the lower half of the band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":14,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 97103528-240a-4112-bee7-90da195ee07dcopy
5. #5rescoreby systemsystem

   2026-11-02 00:50:41Z
   Score: 53 → 54 (+1)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 54. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,299,945

   sig

   2dsXcQzNqezD…k12P2Vibcopyexplorer ↗

   hash

   EL9ZKzxkR8SH…Kj34q1fxcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (721 B) ▸

   {"actor":"system","decided_at":"2026-11-02T00:50:39.773Z","decision":"rescore","investigation_id":"fc3166bc-cdac-442b-a51b-eae4fce81fe4","new_score":54,"page_slug":"kame-aggregator","prev_score":53,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 54. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":1,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 419de35d-cf5d-41c2-9bb0-830da9577c3bcopy