Audit log

Every state-changing event for Matcha: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-20 03:30:51Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,905,010

   sig

   ohWY5mx2Wezt…37jSC9q2copyexplorer ↗

   hash

   54Biv4eUjQQb…MfoaThaPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5606 B) ▸

   {"actor":"system:backfill","investigation_id":"1b600779-6561-4201-8014-61c0c7125aa1","kind":"publish","page_slug":"matcha","published_at":"2026-05-20T03:30:51.356Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Matcha","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.businesswire.com/news/home/20220426006160/en/0x-Labs-Raises-%2470M-Led-By-Greylock-to-Continue-Expanding-Web3s-Core-Exchange-Infrastructure"},{"credibility":3,"name":"","type":"other","url":"https://matcha.xyz/about-matcha-dex-aggregator"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2023/05/24/0x-labs-releases-latest-version-of-dex-aggregator-matcha"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.matcha.xyz/article/permit2"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/349429/0x-dex-aggregator-matcha-solana-cross-chain-avoid-memecoin-rug-pulls"},{"credibility":3,"name":"","type":"other","url":"https://0x.org/case-studies/matcha-v2"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/386986/matcha-meta-swapnet-incident"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/matcha-meta-swapnet-defi-exploit-loss/"},{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/defi/matcha-meta-users-lose-millions-after-security-breach-at-integrated-protocol/"},{"credibility":3,"name":"","type":"other","url":"https://samczsun.com/the-0x-vulnerability-explained/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/0x-dex-protocol-suspended-because-of-vulnerability-funds-safe"},{"credibility":3,"name":"","type":"other","url":"https://0x.org/post/0x-v2-bug-bounty-program"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.businesswire.com/news/home/20220426006160/en/0x-Labs-Raises-%2470M-Led-By-Greylock-to-Continue-Expanding-Web3s-Core-Exchange-Infrastructure"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/organization/0x-project"},{"credibility":3,"name":"","type":"other","url":"https://0x.org/legal/terms-of-service"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://0x.org/docs/developer-resources/bounties"},{"credibility":3,"name":"","type":"other","url":"https://cryptopolitan.com/matcha-meta-security-breach-16-8m-drained/"},{"credibility":3,"name":"","type":"other","url":"https://www.livebitcoinnews.com/matcha-meta-removes-direct-allowances-after-16-8m-swapnet-exploit-as-crypto-hacks-rise/"}]}],"sources_used":[],"summary":"Matcha (matcha.xyz) is a DEX aggregator built and operated by 0x Labs, launched in 2020, that routes trades across 130+ liquidity sources on 15+ blockchains using the 0x Protocol. The core Matcha platform has no history of direct exploits; however, Matcha Meta — a related but distinct meta-aggregator product launched later by the same team — suffered a $13.4M exploit in January 2026 via a third-party SwapNet contract, affecting users who had disabled the platform's default one-time approval security setting. 0x Labs is a well-funded, established entity whose protocol contracts have been audited by Trail of Bits, OpenZeppelin, and Ouroboros, and whose bug bounty program offers up to $1M via Immunefi.","timeline":[{"date":"2016-01-01","event":"0x Labs founded by Will Warren and Amir Bandeali in San Francisco.","source":""},{"date":"2018-01-01","event":"0x Protocol v1 launches on Ethereum mainnet, enabling peer-to-peer token exchange via off-chain order books and on-chain settlement.","source":""},{"date":"2019-07-12","event":"Critical vulnerability disclosed in 0x v2.0 Exchange contract by researcher samczsun, allowing signature bypass. 0x team shuts down contracts within hours; no funds lost.","source":""},{"date":"2020-04-01","event":"Matcha launches in closed beta as a DEX aggregator frontend built on 0x Protocol.","source":""},{"date":"2020-06-01","event":"Matcha opens to the public with gas-free trades and smart order routing across 15 DEXs.","source":""},{"date":"2022-04-26","event":"0x Labs raises $70M Series B led by Greylock, with participation from Pantera Capital, Jump Crypto, Coinbase, and others.","source":""},{"date":"2023-05-24","event":"Matcha v2 launches with multi-chain support including Ethereum, BNB Chain, and Polygon.","source":""},{"date":"2023-12-01","event":"Cross-chain swap functionality launches on Matcha.","source":""},{"date":"2024-07-01","event":"0x Labs launches bug bounty program via Immunefi for 0x v2, offering up to $1M for critical vulnerabilities.","source":""},{"date":"2025-01-01","event":"Matcha expands to Solana, becoming one of the first DEX aggregators to support both SVM and EVM chains in a single app.","source":""},{"date":"2026-01-26","event":"Matcha Meta (meta.matcha.xyz) suffers $13.4M exploit via a vulnerability in integrated third-party SwapNet router contract. 18 users affected; those who had disabled the default one-time approval setting were exposed. 0x Labs' own contracts were not compromised.","source":""},{"date":"2026-01-27","event":"Matcha Meta removes SwapNet as an available aggregator, disables the toggle allowing users to turn off one-time approvals, and publishes post-mortem.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 544d40f8-5e7c-45b5-893d-085ffba26de1copy
2. #2reviewby reviewerreviewer

   2026-06-04 00:14:54Z
   Score: 72 → 72 (no score change)
   The Matcha investigation page is broadly accurate. The most significant error is the 0x Protocol v1 mainnet launch date (listed as 2018 but confirmed as August 2017). The Matcha Solana launch date is also off (listed as January 2025, confirmed as April 2025), and the SwapNet exploit date is one day off (listed as January 26, confirmed as January 25, 2026). The $13.4M exploit figure is accurate for the SwapNet-specific loss but the page does not acknowledge the $16.8M figure that circulated widely and requires disambiguation. No link rot was detected and all major claims about 0x Labs' funding, audits, and security posture are confirmed.
   anchoranchored

   chain

   ●mainnet-betaslot 424,133,125

   sig

   35t538R2FBMq…UfrhCwW6copyexplorer ↗

   hash

   86RBqtTY2Fqz…tLSDRqBTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (986 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-04T00:14:53.823Z","decision":"review","investigation_id":"1b600779-6561-4201-8014-61c0c7125aa1","new_score":72,"page_slug":"matcha","prev_score":72,"reason":"The Matcha investigation page is broadly accurate. The most significant error is the 0x Protocol v1 mainnet launch date (listed as 2018 but confirmed as August 2017). The Matcha Solana launch date is also off (listed as January 2025, confirmed as April 2025), and the SwapNet exploit date is one day off (listed as January 26, confirmed as January 25, 2026). The $13.4M exploit figure is accurate for the SwapNet-specific loss but the page does not acknowledge the $16.8M figure that circulated widely and requires disambiguation. No link rot was detected and all major claims about 0x Labs' funding, audits, and security posture are confirmed.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 37562510-78d0-424d-873f-3a453d2a87d9copy
3. #3review reviseby judgejudge

   2026-06-04 00:14:54Z
   Score: 72 → 62 (-10)
   The reviewer confirmed 17 of 22 claims outright, with 3 partially supported and 1 disputed, yielding an 18% non-confirmed rate that falls in the minor-issues band. The single disputed claim (claim_findings[11]) is a date error: the page lists 0x Protocol v1 mainnet launch as 2018 but three sources — including a co-founder post — place it in August 2017. Two partially supported claims (claim_findings[19] and claim_findings[20]) reflect further date inaccuracies: the Matcha Solana launch is off by approximately three months, and the SwapNet exploit date is off by one day. No disputed claims touch the core risk or security posture of the entity. A high-priority coverage gap (claim_findings[20] notes area; coverage_gaps[2]) — the absence of any information on user compensation or restitution after the $13.4M SwapNet exploit — should be addressed before the page is considered complete. Auditor name spelling (Ouroboros vs. Ourovoros) is also noted for correction.
   anchoranchored

   chain

   ●mainnet-betaslot 424,133,140

   sig

   2yhJicFv8XB5…cSoUDC7Ccopyexplorer ↗

   hash

   FS3Ep3zjgni4…buxnRA5Ncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1319 B) ▸

   {"actor":"judge","decided_at":"2026-06-04T00:14:53.823Z","decision":"review_revise","investigation_id":"1b600779-6561-4201-8014-61c0c7125aa1","new_score":62,"page_slug":"matcha","prev_score":72,"reason":"The reviewer confirmed 17 of 22 claims outright, with 3 partially supported and 1 disputed, yielding an 18% non-confirmed rate that falls in the minor-issues band. The single disputed claim (claim_findings[11]) is a date error: the page lists 0x Protocol v1 mainnet launch as 2018 but three sources — including a co-founder post — place it in August 2017. Two partially supported claims (claim_findings[19] and claim_findings[20]) reflect further date inaccuracies: the Matcha Solana launch is off by approximately three months, and the SwapNet exploit date is off by one day. No disputed claims touch the core risk or security posture of the entity. A high-priority coverage gap (claim_findings[20] notes area; coverage_gaps[2]) — the absence of any information on user compensation or restitution after the $13.4M SwapNet exploit — should be addressed before the page is considered complete. Auditor name spelling (Ouroboros vs. Ourovoros) is also noted for correction.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b02f93c4-8ad1-4889-9402-88c2f588cfe7copy