Audit log

Every state-changing event for mySwap CL Protocol (Starknet): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-06-25 23:27:27Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 428,904,594

   sig

   ynQqYQ5Cnvuc…1wdSdyuqcopyexplorer ↗

   hash

   7tWXYxECPPgi…R6Djydyqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (13077 B) ▸

   {"actor":"system:backfill","investigation_id":"b1298889-6efa-4cbd-abcb-e2dc2a533ebb","kind":"publish","page_slug":"myswap-cl-protocol-starknet","published_at":"2026-06-25T23:27:27.489Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"mySwap CL Protocol (Starknet)","sections":[{"content":"mySwap launched as the first automated market maker on Starknet, a ZK-rollup Layer 2 network. It subsequently introduced a concentrated liquidity product, mySwap CL, positioning it as analogous to Uniswap v3 on Ethereum by enabling liquidity providers to deploy capital within specified price ranges for improved capital efficiency. According to DefiLlama, mySwap CL reached a peak total value locked of approximately $9.7 million in April 2024, after which TVL declined sharply by over 99.9% to approximately $5,000 by mid-2025. The protocol's cumulative all-time DEX volume was reported at approximately $622 million prior to the June 2026 exploit. By early 2024, mySwap was reportedly the second most active dApp on Starknet by number of active accounts. The protocol closed its interface to new liquidity deposits and was functionally dormant for more than six months prior to the June 2026 exploit.","heading":"Protocol Background","severity":"low","sources":[{"credibility":2,"name":"mySwap CL TVL and Volume - DefiLlama","type":"research","url":"https://defillama.com/protocol/myswap-cl"},{"credibility":3,"name":"mySwap: Leading Starknet's AMM Arena with the Best Yields - Braavos","type":"other","url":"https://braavos.app/myswap-starknet-amm/"},{"credibility":2,"name":"mySwap Concentrated Liquidity on Starknet - Official Site","type":"official","url":"https://www.myswap.xyz/"}]},{"content":"On June 19, 2026, at approximately 7:15 AM UTC, the mySwap CL protocol was exploited via a smart contract vulnerability in its shared-vault accounting layer. The attacker deployed a malicious ERC-20 token named EVIL and used it to manipulate how the CL pool system recognized balances and released assets from the shared vault. The exploit was permissionless — it did not require any private-key compromise, admin-level access, or oracle manipulation. The core vulnerability lay in insufficient validation boundaries between token interactions and the vault accounting layer. By interacting with pool accounting through the EVIL token, the attacker distorted balance recognition, creating a pathway into the shared vault holding real assets across multiple pools. The stolen assets comprised 137.96 ETH, 45,000 USDC, 19,900 USDT, and 230,000 STRK tokens, totaling approximately $305,000. The attack drained funds from over 100,000 LP positions, effectively depleting nearly all remaining liquidity in the protocol. No private key compromise or administrative failure was alleged as contributing to the exploit.","heading":"June 2026 Exploit: EVIL Token Attack","severity":"critical","sources":[{"credibility":2,"name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"credibility":2,"name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069"},{"credibility":2,"name":"SlowMist Hacked Database","type":"research","url":"https://hacked.slowmist.io/"}]},{"content":"Following the drain of assets from the mySwap CL protocol, the attacker bridged the stolen funds cross-chain off Starknet and subsequently routed them through Railgun, a zero-knowledge privacy protocol designed to obscure transaction flows. The use of Railgun is consistent with deliberate efforts to prevent on-chain tracing and impede asset recovery. As of the time of available reporting, no attacker wallet address had been publicly identified by security researchers or the mySwap team. The cross-chain bridging combined with Railgun routing significantly reduces the probability of fund recovery through conventional on-chain forensics.","heading":"Post-Exploit Fund Movement and Obfuscation","severity":"high","sources":[{"credibility":2,"name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"credibility":2,"name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069"}]},{"content":"The mySwap CL protocol had ceased accepting new liquidity deposits for over six months prior to the exploit, indicating the product was in a winding-down or deprecated state. Despite this dormancy, over 100,000 LP positions remained locked in the protocol retaining real asset value. The attack succeeded against a system that was no longer under active development or receiving active security maintenance. The incident illustrates several structural risk factors in concentrated liquidity protocol design: (1) Permissionless pool creation — a feature of CL AMMs — allows attackers to introduce malicious tokens without governance approval or access control bypass, lowering the barrier to entry for accounting exploits. (2) Shared-vault architecture linking multiple pools through a single settlement layer can amplify a single accounting flaw across all pooled assets. (3) Deprecated protocols that retain locked user funds without continued security review present a persistent, unmitigated attack surface. The post-exploit TVL on DefiLlama stood at approximately $5,215, consistent with near-total depletion of liquidity.","heading":"Protocol Dormancy and Systemic Risk Factors","severity":"high","sources":[{"credibility":2,"name":"mySwap CL TVL and Volume - DefiLlama","type":"research","url":"https://defillama.com/protocol/myswap-cl"},{"credibility":2,"name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"credibility":2,"name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069"}]},{"content":"As of June 20, 2026, mySwap confirmed the incident and stated it was assessing the full impact of the exploit. No detailed technical post-mortem, reimbursement plan, or formal security advisory had been published by the protocol team at the time of available reporting. The absence of a post-mortem within the initial reporting window is a transparency concern given that more than 100,000 LP positions were affected. The incident was described in reporting as remaining at the alert stage pending a formal mySwap analysis. No bug bounty payment or white-hat negotiation has been reported. Given the protocol's pre-existing dormant status and near-zero TVL, the likelihood of a formal compensation program for affected liquidity providers is uncertain.","heading":"Official Response and Transparency","severity":"high","sources":[{"credibility":2,"name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069"},{"credibility":2,"name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"}]},{"content":"The mySwap exploit occurred during a period of elevated DeFi security incidents in mid-2026. The Starknet ecosystem has seen parallel smart contract vulnerabilities during this period, with reporting noting other Starknet-native protocol exploits. The attack vector — a permissionless malicious token interaction manipulating shared vault accounting — represents a class of vulnerability applicable to any CL AMM that does not enforce strict token allowlisting or balance-validation invariants. The use of Railgun for post-exploit fund concealment has been observed in multiple DeFi security incidents and presents ongoing challenges for incident response and fund recovery.","heading":"Broader Starknet Ecosystem Security Context","severity":"medium","sources":[{"credibility":2,"name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"credibility":2,"name":"SlowMist Hacked Database","type":"research","url":"https://hacked.slowmist.io/"}]}],"sources_used":[{"credibility":2,"name":"mySwap Loses $305K On Starknet After Fake EVIL Token Abuses CL Pool Accounting - CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"credibility":2,"name":"Starknet's mySwap Protocol Exploited, $300,000 Drained - Phemex News","type":"news_article","url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069"},{"credibility":2,"name":"mySwap CL TVL and Volume - DefiLlama","type":"research","url":"https://defillama.com/protocol/myswap-cl"},{"credibility":2,"name":"mySwap TVL and Volume - DefiLlama","type":"research","url":"https://defillama.com/protocol/myswap"},{"credibility":2,"name":"SlowMist Hacked Database","type":"research","url":"https://hacked.slowmist.io/"},{"credibility":2,"name":"mySwap Concentrated Liquidity on Starknet - Official Site","type":"official","url":"https://www.myswap.xyz/"},{"credibility":3,"name":"mySwap: Leading Starknet's AMM Arena with the Best Yields - Braavos","type":"other","url":"https://braavos.app/myswap-starknet-amm/"},{"credibility":3,"name":"mySwap on X (@mySwapxyz)","type":"social_media","url":"https://x.com/mySwapxyz"}],"summary":"mySwap launched in 2022 as the first automated market maker on Starknet and later introduced a Concentrated Liquidity (CL) product that reached a peak TVL of approximately $9.7 million in April 2024 before declining sharply to near-zero. On June 19, 2026, an attacker deployed a malicious token named EVIL to abuse the protocol's CL pool accounting and shared vault logic, draining approximately $305,000 in residual LP assets from over 100,000 positions. The stolen funds were bridged cross-chain and routed through Railgun; no recovery or formal post-mortem has been confirmed.","timeline":[{"date":"2022-03-01","event":"mySwap launches as the first AMM on Starknet mainnet, initially supporting ETH, USDC, DAI, and WBTC pools.","source":"Braavos Blog","source_url":"https://braavos.app/myswap-starknet-amm/"},{"date":"2023-11-28","event":"mySwap announces migration from the legacy constant-product AMM to mySwap Concentrated Liquidity (CL), offering a 14-day migration window with an incentive reward for users who migrate.","source":"mySwap on X (@mySwapxyz)","source_url":"https://x.com/mySwapxyz/status/1729807820365660315"},{"date":"2024-04-01","event":"mySwap CL reaches peak total value locked of approximately $9.7 million according to DefiLlama.","source":"DefiLlama - mySwap CL","source_url":"https://defillama.com/protocol/myswap-cl"},{"date":"2025-06-01","event":"mySwap CL TVL falls to approximately $5,000, a decline of over 99.9% from its April 2024 peak. Protocol is effectively dormant, with no new deposits accepted.","source":"DefiLlama - mySwap CL","source_url":"https://defillama.com/protocol/myswap-cl"},{"date":"2026-06-19","event":"At approximately 7:15 AM UTC, an attacker deploys a malicious token named EVIL on Starknet and uses it to abuse mySwap CL pool accounting and shared vault logic, draining 137.96 ETH, 45,000 USDC, 19,900 USDT, and 230,000 STRK — approximately $305,000 in total — from over 100,000 LP positions.","source":"CryptoAdventure","source_url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"date":"2026-06-19","event":"Attacker bridges stolen assets off Starknet and routes funds through the Railgun privacy protocol to obscure transaction flows. Protocol liquidity is nearly entirely depleted.","source":"CryptoAdventure","source_url":"https://cryptoadventure.com/myswap-loses-305k-on-starknet-after-fake-evil-token-abuses-cl-pool-accounting/"},{"date":"2026-06-20","event":"mySwap confirms the incident publicly, stating it is assessing the full impact. No post-mortem, recovery plan, or reimbursement announcement is issued as of this date.","source":"Phemex News","source_url":"https://phemex.com/news/article/starknets-myswap-protocol-exploited-300000-drained-90069"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b14ce347-71e5-4fd7-acfd-bfa5cff7f243copy
2. #2rescoreby systemsystem

   2026-10-10 18:42:16Z
   Score: 22 → 48 (+26)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 48. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −12, problems around the subject, caused by others −1.1; legitimacy credit long-running +8; a recent unresolved incident −5.7.
   anchoranchored

   chain

   ●mainnet-betaslot 455,361,789

   sig

   4QP1d8cUS6rs…Kr1ggtqncopyexplorer ↗

   hash

   AF3L4CM49vxM…d8h3ZBoLcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (691 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:42:16.607Z","decision":"rescore","investigation_id":"b1298889-6efa-4cbd-abcb-e2dc2a533ebb","new_score":48,"page_slug":"myswap-cl-protocol-starknet","prev_score":22,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 48. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −12, problems around the subject, caused by others −1.1; legitimacy credit long-running +8; a recent unresolved incident −5.7.","score_delta":26,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3ed7e880-323c-4dbd-b184-7f04426dff9ccopy
3. #3rescoreby systemsystem

   2026-11-02 00:29:56Z
   Score: 48 → 46 (-2)
   Re-read and rescored after the page was re-researched (2026-11-02). Rescored under Scoring v2, the published formula (avoid.net/scoring): 48 → 46. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −12, problems around the subject, caused by others −1.1; legitimacy credit long-running +8; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −3.8.
   anchoranchored

   chain

   ●mainnet-betaslot 464,294,104

   sig

   2uESkdr4iUha…QsNkmtd6copyexplorer ↗

   hash

   43GiynVxiX2Y…p6FJ7SnYcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (814 B) ▸

   {"actor":"system","decided_at":"2026-11-02T00:29:55.569Z","decision":"rescore","investigation_id":"b1298889-6efa-4cbd-abcb-e2dc2a533ebb","new_score":46,"page_slug":"myswap-cl-protocol-starknet","prev_score":48,"reason":"Re-read and rescored after the page was re-researched (2026-11-02). Rescored under Scoring v2, the published formula (avoid.net/scoring): 48 → 46. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −12, problems around the subject, caused by others −1.1; legitimacy credit long-running +8; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −3.8.","score_delta":-2,"score_model":"v2","sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3e959222-3f3f-4ec4-8c4c-4d3fe02ded2ccopy
4. #4reviewby reviewerreviewer

   2026-11-02 00:31:25Z
   Score: 46 → 46 (no score change)
   The core exploit facts hold: a fake EVIL token, about $305K drained (137.96 ETH, 45K USDC, 19.9K USDT, 230K STRK), more than 100,000 LP positions, and mySwap's confirmation with no post-mortem at the time. The Ekubo comparison is wrong in context, because the Ekubo incident hit EVM router contracts and not Starknet. The Railgun and bridging claim rests on a single hedged report but is stated as fact, and the 7:15 AM UTC time appears in no source I read. DefiLlama TVL figures could not be checked. Several sections are inference rather than sourced fact.
   anchoranchored

   chain

   ●mainnet-betaslot 464,294,561

   sig

   4DT5hwJy4yst…DSvKqaLHcopyexplorer ↗

   hash

   43643kLtc5Aa…WUgnRLfRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1423 B) ▸

   {"actor":"reviewer","artifact_identity":"0802781c6386b8866e004d717a5e6ad4","blocked_count":2,"decided_at":"2026-11-02T00:31:25.311Z","decision":"review","disputed_pct":0.375,"findings_hash":"CQa6B92ukwEuopD5DoiugC4j9CFh7Zrt7F6eEmQGw5Gd","investigation_id":"b1298889-6efa-4cbd-abcb-e2dc2a533ebb","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":46,"page_content_hash":"7917ea972c9089c11c25092d6f3baeca7d0d3cf3ebfee1c9d849769af084a6ef","page_slug":"myswap-cl-protocol-starknet","prev_score":46,"reason":"The core exploit facts hold: a fake EVIL token, about $305K drained (137.96 ETH, 45K USDC, 19.9K USDT, 230K STRK), more than 100,000 LP positions, and mySwap's confirmation with no post-mortem at the time. The Ekubo comparison is wrong in context, because the Ekubo incident hit EVM router contracts and not Starknet. The Railgun and bridging claim rests on a single hedged report but is stated as fact, and the 7:15 AM UTC time appears in no source I read. DefiLlama TVL figures could not be checked. Several sections are inference rather than sourced fact.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":8,"sequence_num":4,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 515d14ca-d2d6-4e4f-98eb-e22332a9e793copy
5. #5review reviseby judgejudge

   2026-11-02 00:31:25Z
   Score: 46 → 46 (no score change)
   Of 8 countable claim checks (2 DefiLlama checks were blocked and are excluded), 1 was disputed and 2 could not be verified, giving 37.5%. The core exploit facts hold: the EVIL token mechanism, the stolen amounts, the 100,000+ positions and mySwap's June 20 confirmation were confirmed (claim_findings[0], [1], [5]). The Ekubo comparison is contradicted by its own source, which describes an EVM router exploit that did not affect Starknet (claim_findings[6]). The Railgun and bridging claim is stated as fact but rests on one hedged 'reportedly' report (claim_findings[4]), and the 7:15 AM UTC time appears in no source read (claim_findings[2]). The page also relies on two secondary news articles with no primary technical source (high-priority coverage gap). The penalty sits at the low end of the band because the disputed item is in a medium-severity context section and the central incident is well supported.
   anchoranchored

   chain

   ●mainnet-betaslot 464,294,568

   sig

   2mucaoovBTmE…Po1KJG3vcopyexplorer ↗

   hash

   EDV756upjDP2…eN6JtbB8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1610 B) ▸

   {"actor":"judge","artifact_identity":"0802781c6386b8866e004d717a5e6ad4","band_override":null,"blocked_count":2,"decided_at":"2026-11-02T00:31:25.311Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.375,"investigation_id":"b1298889-6efa-4cbd-abcb-e2dc2a533ebb","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":46,"page_slug":"myswap-cl-protocol-starknet","prev_score":46,"reason":"Of 8 countable claim checks (2 DefiLlama checks were blocked and are excluded), 1 was disputed and 2 could not be verified, giving 37.5%. The core exploit facts hold: the EVIL token mechanism, the stolen amounts, the 100,000+ positions and mySwap's June 20 confirmation were confirmed (claim_findings[0], [1], [5]). The Ekubo comparison is contradicted by its own source, which describes an EVM router exploit that did not affect Starknet (claim_findings[6]). The Railgun and bridging claim is stated as fact but rests on one hedged 'reportedly' report (claim_findings[4]), and the 7:15 AM UTC time appears in no source read (claim_findings[2]). The page also relies on two secondary news articles with no primary technical source (high-priority coverage gap). The penalty sits at the low end of the band because the disputed item is in a medium-severity context section and the central incident is well supported.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":8,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision dc66617e-cf1c-4ce5-b7b4-ef509f955bcbcopy
6. #6rescoreby systemsystem

   2026-11-02 00:31:26Z
   Score: 46 → 47 (+1)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 46 → 47. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −12, problems around the subject, caused by others −0.3; legitimacy credit long-running +8; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −3.8; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,294,572

   sig

   4xZcJkkQ2Jc9…hfgEApZGcopyexplorer ↗

   hash

   F7eb24CGWCxh…YXqb7jj6copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (856 B) ▸

   {"actor":"system","decided_at":"2026-11-02T00:31:25.311Z","decision":"rescore","investigation_id":"b1298889-6efa-4cbd-abcb-e2dc2a533ebb","new_score":47,"page_slug":"myswap-cl-protocol-starknet","prev_score":46,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 46 → 47. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −12, problems around the subject, caused by others −0.3; legitimacy credit long-running +8; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −3.8; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":1,"score_model":"v2","sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d4a74693-6844-4188-a351-5a86b966e4b2copy