Audit log

Every state-changing event for Lendf.me: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 19:07:01Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,780,604

   sig

   3VQQu8Hj5Du2…XqzAv41Zcopyexplorer ↗

   hash

   2o9JxGhJayJm…7qiiGGi3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7541 B) ▸

   {"actor":"system:backfill","investigation_id":"83cab2d1-6d9a-46e6-8786-9df49fcc4fe7","kind":"publish","page_slug":"lendfme","published_at":"2026-05-28T19:07:01.812Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Lendf.me","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/26033/dforce-lendfme-defi-hack-25m","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2020/04/14/chinese-defi-platform-dforce-raises-15m-from-multicoin-huobi-capital","type":"other","url":""},{"credibility":3,"name":"https://medium.com/dforcenet/a-summary-of-the-attack-on-lendf-me-on-april-19-2020-e2f1c5d96640","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://peckshield.medium.com/uniswap-lendf-me-hacks-root-cause-and-loss-analysis-50f3263dcc09","type":"other","url":""},{"credibility":3,"name":"https://slowmist.medium.com/slowmist-details-of-lendf-me-reentrancy-attack-3e168ab5f2b1","type":"other","url":""},{"credibility":3,"name":"https://quantstamp.com/blog/how-the-dforce-hacker-used-reentrancy-to-steal-25-million","type":"other","url":""},{"credibility":3,"name":"https://valid.network/post/the-reentrancy-strikes-again-the-case-of-lendf-me","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/dforce-hacker-returns-stolen-money-as-criticism-of-the-project-continues","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://slowmist.medium.com/slowmist-details-of-lendf-me-reentrancy-attack-3e168ab5f2b1","type":"other","url":""},{"credibility":3,"name":"https://peckshield.medium.com/uniswap-lendf-me-hacks-root-cause-and-loss-analysis-50f3263dcc09","type":"other","url":""},{"credibility":3,"name":"https://quantstamp.com/blog/how-the-dforce-hacker-used-reentrancy-to-steal-25-million","type":"other","url":""},{"credibility":3,"name":"https://securityaffairs.com/101895/cyber-crime/uniswap-lendf-me-hacked.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/dforcenet/lendf-me-hack-resolution-part-i-asset-redistribution-plan-9cefee49f209","type":"other","url":""},{"credibility":3,"name":"https://medium.com/dforcenet/lendf-me-resolution-part-ii-dforce-better-future-proposal-76a07b65ca24","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/63141/defi-dforce-attack-24-million-funds-return","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/dforce-hacker-returns-25m-stolen-funds/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/the-dforce-hacker-is-returning-stolen-funds/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/26069/exclusive-an-interview-with-dforce-founder-mindao-yang","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2020/04/14/chinese-defi-platform-dforce-raises-15m-from-multicoin-huobi-capital","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@mindao.yang/update-on-lendf-me-ee83f4380b70","type":"other","url":""},{"credibility":3,"name":"https://medium.com/dforcenet/a-summary-of-the-attack-on-lendf-me-on-april-19-2020-e2f1c5d96640","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/dforce-hacker-returns-stolen-money-as-criticism-of-the-project-continues","type":"other","url":""},{"credibility":3,"name":"https://quantstamp.com/blog/how-the-dforce-hacker-used-reentrancy-to-steal-25-million","type":"other","url":""},{"credibility":3,"name":"https://valid.network/post/the-reentrancy-strikes-again-the-case-of-lendf-me","type":"other","url":""},{"credibility":3,"name":"https://github.com/dforce-network/documents/blob/master/audit_report/Lending/dForceLending-Audit-Report-TrailofBits-Mar-2021.pdf","type":"other","url":""},{"credibility":3,"name":"https://medium.com/dforcenet/lendf-me-resolution-part-ii-dforce-better-future-proposal-76a07b65ca24","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.americancryptoassociation.com/2020/04/20/dforce-hacker-attempts-to-negotiate-after-allegedly-leaking-his-identity/","type":"other","url":""},{"credibility":3,"name":"https://www.newsbtc.com/2020/04/21/2-reasons-why-ethereum-defi-hacker-returned-25-million-in-hacked-funds/","type":"other","url":""},{"credibility":3,"name":"https://www.bitsofblocks.io/post/theft-and-giving-it-back-25m-stolen-and-returned-in-lendf-me-debacle","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/dforcelendfmedefiprotocolbreached.php","type":"other","url":""}]}],"sources_used":[],"summary":"Lendf.me was a decentralized lending protocol built by dForce Network and launched in September 2019 as a fork of Compound v1. On April 19, 2020, an attacker exploited a reentrancy vulnerability involving ERC-777 tokens to drain approximately $25.2 million from the protocol — at the time representing 99.95% of its total value locked. The attacker returned nearly all funds within two days after inadvertently exposing identifying metadata, and the original Lendf.me contract was permanently deprecated following the incident.","timeline":[{"date":"2018-01-01","event":"Mindao Yang founds dForce Network in late 2018 as a China-based open finance protocol.","source":""},{"date":"2019-09-01","event":"Lendf.me lending protocol launches as a fork of Compound v1, initially supporting a limited set of Ethereum assets.","source":""},{"date":"2020-04-14","event":"dForce announces a $1.5 million strategic funding round led by Multicoin Capital, with Huobi Capital and CMBI participating.","source":""},{"date":"2020-04-19","event":"At approximately 12:58 AM UTC, attacker (EOA: 0xa9bf70a420d364e923c74448d9d817d3f2a77822) begins exploiting the ERC-777 reentrancy vulnerability. By 9:15 AM UTC+8, dForce discovers the attack. Lendf.me contracts are paused approximately one hour after the exploit begins. Approximately $25.2 million (~99.95% of TVL) is drained across 12 liquidity pools.","source":""},{"date":"2020-04-20","event":"dForce files a police report with Singapore authorities. The attacker's identifying metadata — including IP address and device fingerprint — is obtained from a CDN provider via subpoena. The attacker returns approximately $2.79 million as a first partial repayment.","source":""},{"date":"2020-04-21","event":"The attacker returns the remaining stolen funds, completing near-total restitution. dForce opens its Asset Recovery System for user withdrawals.","source":""},{"date":"2020-04-27","event":"dForce reports that over 90% of recovered assets have been redistributed to users and that 100% of affected users will be made whole.","source":""},{"date":"2020-05-01","event":"dForce publishes the 'Better Future' Proposal announcing 2,000,000 DF token airdrop to hack-affected users, creation of the dSAFU insurance fund with 50,000,000 DF tokens, and security improvement commitments. The original Lendf.me contract is permanently deprecated.","source":""},{"date":"2021-03-01","event":"Trail of Bits publishes a security audit of the redesigned dForce Lending protocol, reflecting post-incident security improvements.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b14542c3-0861-4eff-bc10-4ea7776e7678copy
2. #2rescoreby systemsystem

   2026-10-27 06:07:15Z
   Score: 30 → 50 (+20)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 30 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +6, regulated +5; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,450

   sig

   58EFnTW7HNru…f4GCNNNwcopyexplorer ↗

   hash

   BCzTkpgTo4yo…XqaZA4c5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (690 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:15.051Z","decision":"rescore","investigation_id":"83cab2d1-6d9a-46e6-8786-9df49fcc4fe7","new_score":50,"page_slug":"lendfme","prev_score":30,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 30 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +6, regulated +5; no longer operating, so capped at 50.","score_delta":20,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c0d4868f-3065-4a60-89e3-9f93eee4a02fcopy
3. #3reviewby reviewerreviewer

   2026-11-01 22:18:06Z
   Score: 50 → 50 (no score change)
   The core narrative (April 2020 ERC-777/imBTC reentrancy, about $25M drained, funds returned, $1.5M raise five days earlier) is well supported. Weak spots are the 'Compound appears four times' claim, which the cited CoinTelegraph article does not contain, the stated-as-fact subpoena and police report details, an uncited ZachXBT sentence, and two inconsistent loss totals. The page omits dForce's 2023 exploit. Many primary sources were blocked, which limited verification of on-chain details.
   anchoranchored

   chain

   ●mainnet-betaslot 464,257,232

   sig

   2EB3wnXv8qVR…imTyvUHNcopyexplorer ↗

   hash

   HWrxv2By4jBQ…J1hZCmmpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1375 B) ▸

   {"actor":"reviewer","artifact_identity":"f998b3b6c4587e72410db94176b3047e","blocked_count":2,"decided_at":"2026-11-01T22:18:05.938Z","decision":"review","disputed_pct":0.375,"findings_hash":"2WN1TmX3FnATfgqirSud9zCKdGx43DBuGK6DXiko64No","investigation_id":"83cab2d1-6d9a-46e6-8786-9df49fcc4fe7","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":1,"total":1},"page_content_hash":"fb3397e5534a7af30873767f1846f018499f639b32d51f3ca4255be9b589b262","page_slug":"lendfme","prev_score":50,"reason":"The core narrative (April 2020 ERC-777/imBTC reentrancy, about $25M drained, funds returned, $1.5M raise five days earlier) is well supported. Weak spots are the 'Compound appears four times' claim, which the cited CoinTelegraph article does not contain, the stated-as-fact subpoena and police report details, an uncited ZachXBT sentence, and two inconsistent loss totals. The page omits dForce's 2023 exploit. Many primary sources were blocked, which limited verification of on-chain details.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":8,"sequence_num":3,"subject_status":"rebranded","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cdd7bb43-6ae5-437d-8fdd-22e72dd080e3copy
4. #4review reviseby judgejudge

   2026-11-01 22:18:06Z
   Score: 50 → 50 (no score change)
   Of the 8 claims the reviewer could check (2 were excluded because the sources blocked the reviewer), 3 could not be verified (37.5%), which puts the page in the significant-issues band. The 'Compound appears four times' detail (claim_findings[2] and [3]) is not in the cited CoinTelegraph article, and the ZachXBT sentence (claim_findings[8]) has no citation and nothing found to support it. The page also omits dForce's 2023 exploit (omission_findings[0]). The core 2020 incident, the roughly $25M loss, the mechanism and the $1.5M funding round are well supported, so the penalty sits at the lower end of the band and the page is not delisted.
   anchoranchored

   chain

   ●mainnet-betaslot 464,257,237

   sig

   15oMoZi5pceq…xLiNvCcMcopyexplorer ↗

   hash

   FukA21Uu8ysd…sTxTpHHbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1735 B) ▸

   {"actor":"judge","artifact_identity":"f998b3b6c4587e72410db94176b3047e","band_override":null,"blocked_count":2,"decided_at":"2026-11-01T22:18:05.938Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.375,"investigation_id":"83cab2d1-6d9a-46e6-8786-9df49fcc4fe7","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"lendfme","prev_score":50,"reason":"Of the 8 claims the reviewer could check (2 were excluded because the sources blocked the reviewer), 3 could not be verified (37.5%), which puts the page in the significant-issues band. The 'Compound appears four times' detail (claim_findings[2] and [3]) is not in the cited CoinTelegraph article, and the ZachXBT sentence (claim_findings[8]) has no citation and nothing found to support it. The page also omits dForce's 2023 exploit (omission_findings[0]). The core 2020 incident, the roughly $25M loss, the mechanism and the $1.5M funding round are well supported, so the penalty sits at the lower end of the band and the page is not delisted.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":8,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"The review reports a material omission (omission_findings[0]): dForce's February 2023 read-only reentrancy exploit of about $3.65M is not mentioned, and the page frames the later audit as a post-incident improvement. The percentage band is already significant, so the omission confirms that band rather than moving it."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b192e6ef-5dc2-498d-9499-b6482f094beccopy