Audit log

Every state-changing event for Orange Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-30 04:47:53Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,086,625

   sig

   5rrj3ntJJi88…RUuPqaZ2copyexplorer ↗

   hash

   7xowMsNw3itN…jWHHDn2Gcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6970 B) ▸

   {"actor":"system:backfill","investigation_id":"553a92d2-ee3f-4280-ae05-a6e447c45f5c","kind":"publish","page_slug":"orange-finance","published_at":"2026-05-30T04:47:53.323Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Orange Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.orangefinance.io/","type":"other","url":""},{"credibility":3,"name":"https://mirror.xyz/0x6FA2aF9a4d6fFe654361F713780963C10412e7c3/IYCNZKmmxDL5V94ScyCZVXqoRzl7kIkhRxUIpMkUE1Y","type":"other","url":""},{"credibility":3,"name":"https://forum.arbitrum.foundation/t/orange-finance-ltipp-application-final/21664","type":"other","url":""},{"credibility":3,"name":"https://blog.stryke.xyz/articles/elevating-defi-stryke-orange-finance-unite","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/orange-finance-rekt/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/single/orange-finance-hack","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/orangefinancesmartcontractprivatekeycompromised.php","type":"other","url":""},{"credibility":3,"name":"https://www.sentnl.io/resources/explained-orange-finance-falls-to-multi-sig-exploit-january-2025","type":"other","url":""},{"credibility":3,"name":"https://ashourics.medium.com/orange-finance-exploit-a-deep-technical-analysis-of-defi-security-architecture-failures-85fcf4380e62","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/arbitrums-largest-liquidity-manager-orange-finance-loses-840k-in-hacker-attack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.sentnl.io/resources/explained-orange-finance-falls-to-multi-sig-exploit-january-2025","type":"other","url":""},{"credibility":3,"name":"https://ashourics.medium.com/orange-finance-exploit-a-deep-technical-analysis-of-defi-security-architecture-failures-85fcf4380e62","type":"other","url":""},{"credibility":3,"name":"https://zircon.tech/blog/security-breach-at-orange-finance-a-wake-up-call-for-web3-projects/","type":"other","url":""},{"credibility":3,"name":"https://github.com/orange-finance/alpha-contract/blob/main/audit-report/Orange_Finance_Audit_Report_by_WatchPug.pdf","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptopolitan.com/orange-finance-compromised-contract-arbitrum/","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/orangefinancesmartcontractprivatekeycompromised.php","type":"other","url":""},{"credibility":3,"name":"https://mirror.xyz/0x6FA2aF9a4d6fFe654361F713780963C10412e7c3/gN17YMrLhKKg9YT9a391U74pWr9IhqBUDWUqDyDamjE","type":"other","url":""},{"credibility":3,"name":"https://www.mitrade.com/insights/news/live-news/article-3-559683-20250108","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://t.me/s/investigations","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/white-hat-hackers-arbitrum-orange-attack/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/orange-finance","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/single/orange-finance-hack","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://forum.arbitrum.foundation/t/orange-finance-ltipp-application-final/21664","type":"other","url":""},{"credibility":3,"name":"https://mirror.xyz/0x6FA2aF9a4d6fFe654361F713780963C10412e7c3/_lqeem2-b20xw4kFWERYtVyXHgSvvpFNiTUvyDi5irg","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/orange-finance","type":"other","url":""}]}],"sources_used":[],"summary":"Orange Finance is an Arbitrum-based automated liquidity management protocol designed for LPDfi (liquidity provider DeFi), enabling users to earn swap fees and options premiums via concentrated AMM vaults. On January 8, 2025, the protocol suffered a critical security breach in which an attacker compromised the admin private key, exploited a misconfigured multi-signature wallet that required only a single signature to execute, and drained approximately $843,556 across all active vaults. The protocol was flagged by ZachXBT and has not resumed normal operations since the incident.","timeline":[{"date":"2023-01-01","event":"Orange Finance publishes 2023 roadmap on Mirror, outlining plans for Uniswap v3 automated liquidity management vaults on Arbitrum.","source":""},{"date":"2023-06-01","event":"Orange Finance Alpha Orange Vault launches on Arbitrum, targeting the USDC.e/ETH pool with delta-hedging via Aave.","source":""},{"date":"2024-04-01","event":"Orange Finance submits LTIPP grant application to the Arbitrum Foundation requesting 150,000 ARB, reporting $1.32M TVL and 170 depositors.","source":""},{"date":"2024-06-01","event":"Orange Finance and Stryke Protocol announce vault integration partnership, enabling liquidity management for Stryke's options AMM.","source":""},{"date":"2024-12-01","event":"Orange Finance expands to Berachain, launching Orange Vaults with Stryke. Protocol TVL reaches approximately $1.5M on Arbitrum.","source":""},{"date":"2025-01-08","event":"Attacker compromises Orange Finance admin private key, exploits single-signature multi-sig misconfiguration, upgrades all smart contracts, and drains approximately $843,556 across all active vaults on Arbitrum. Stolen assets converted to ETH and bridged via Stargate.","source":""},{"date":"2025-01-08","event":"Orange Finance posts warning on X advising users to revoke all contract approvals. Team states they are 'not sure what happened' and that contracts are no longer under their control.","source":""},{"date":"2025-01-08","event":"Orange Finance sends on-chain message to attacker's address offering white-hat arrangement with 24-hour deadline and guarantee of no law enforcement involvement.","source":""},{"date":"2025-01-08","event":"Stryke Protocol pauses associated vaults and disables deposits/withdrawals as a precautionary measure following the exploit.","source":""},{"date":"2025-01-09","event":"Orange Finance publishes follow-up incident report on Mirror detailing loss breakdown by wallet, attack steps, and notes engagement of Seal 911 for investigation.","source":""},{"date":"2025-01-09","event":"A separate Arbitrum-based protocol targeted by a copycat attack similar to Orange Finance's exploit; white-hat hackers successfully prevent fund loss.","source":""},{"date":"2025-01-09","event":"CyversAlerts and multiple on-chain security monitors publish alerts cataloguing the Orange Finance exploit. Incident flagged by ZachXBT's investigations channel.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c7f5ec52-547b-404f-940e-1d6ad7f64ab1copy
2. #2rescoreby systemsystem

   2026-10-27 06:07:05Z
   Score: 28 → 50 (+22)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +4; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,249

   sig

   4QtrkfYV7Ngy…a1dREwDkcopyexplorer ↗

   hash

   F4eJAWbzQbEJ…Bqm4rxc4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (683 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:05.405Z","decision":"rescore","investigation_id":"553a92d2-ee3f-4280-ae05-a6e447c45f5c","new_score":50,"page_slug":"orange-finance","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +4; no longer operating, so capped at 50.","score_delta":22,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 73bb84d3-c190-4a13-b619-8bc65e3f3778copy
3. #3reviewby reviewerreviewer

   2026-11-02 00:13:51Z
   Score: 50 → 50 (no score change)
   The core exploit facts (date, total loss, per-DEX breakdown, loss categories, attacker address, single-signature multisig, Stargate exit, white-hat message) are supported by Rekt and Web3 Is Going Great. The ZachXBT flagging claim, which appears in the summary and a section heading, has no supporting source and cites only a generic Telegram channel root. The Seal 911 and Stryke 50% claims were not verified. Timeline entries carry no sources.
   anchoranchored

   chain

   ●mainnet-betaslot 464,289,698

   sig

   bc6uBcatefAp…AND3hpDRcopyexplorer ↗

   hash

   98ugADnPDBRY…QemA1Wzccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1296 B) ▸

   {"actor":"reviewer","artifact_identity":"6c69ab08c6eee7a2dd4a7ad3187c28e5","blocked_count":1,"decided_at":"2026-11-02T00:13:51.892Z","decision":"review","disputed_pct":0.375,"findings_hash":"18CKxpLbbQHcBZaSqnUWkFYPUpz3ox1yCPrBbqi6Jdu","investigation_id":"553a92d2-ee3f-4280-ae05-a6e447c45f5c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_content_hash":"edac48a0582902244e1ea6bc6c9c0267bebdcf6031cd8f490bd68101092587b9","page_slug":"orange-finance","prev_score":50,"reason":"The core exploit facts (date, total loss, per-DEX breakdown, loss categories, attacker address, single-signature multisig, Stargate exit, white-hat message) are supported by Rekt and Web3 Is Going Great. The ZachXBT flagging claim, which appears in the summary and a section heading, has no supporting source and cites only a generic Telegram channel root. The Seal 911 and Stryke 50% claims were not verified. Timeline entries carry no sources.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":8,"sequence_num":3,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7ca02431-1458-42e3-bd14-73baa47eabb2copy
4. #4review reviseby judgejudge

   2026-11-02 00:13:52Z
   Score: 50 → 50 (no score change)
   The core exploit facts hold up: the date, the roughly $843,557 loss, the per-DEX breakdown, the attacker address and the single-signature multisig misconfiguration are confirmed by Rekt and Web3 Is Going Great (claim_findings[0-2], [5]). However, 3 of 8 countable claims (37.5%) could not be verified: the ZachXBT flagging claim appears in the summary, a section heading and the timeline but has no supporting source and cites only a generic Telegram channel root (claim_findings[3-4]), and the Stryke '50% of TVL retained' figure was not found (claim_findings[8]). One further claim, the Seal 911 engagement, was excluded because its source blocked the reviewer. The penalty sits at the lighter end of the band because the central allegations are confirmed, the reviewer's confidence is moderate (0.6), and no omissions or status contradictions were reported.
   anchoranchored

   chain

   ●mainnet-betaslot 464,289,703

   sig

   5TdzfcKjJJNZ…kEtxpdM9copyexplorer ↗

   hash

   GDKYof9GgSnZ…M3ou6in9copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1543 B) ▸

   {"actor":"judge","artifact_identity":"6c69ab08c6eee7a2dd4a7ad3187c28e5","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T00:13:51.892Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.375,"investigation_id":"553a92d2-ee3f-4280-ae05-a6e447c45f5c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"orange-finance","prev_score":50,"reason":"The core exploit facts hold up: the date, the roughly $843,557 loss, the per-DEX breakdown, the attacker address and the single-signature multisig misconfiguration are confirmed by Rekt and Web3 Is Going Great (claim_findings[0-2], [5]). However, 3 of 8 countable claims (37.5%) could not be verified: the ZachXBT flagging claim appears in the summary, a section heading and the timeline but has no supporting source and cites only a generic Telegram channel root (claim_findings[3-4]), and the Stryke '50% of TVL retained' figure was not found (claim_findings[8]). One further claim, the Seal 911 engagement, was excluded because its source blocked the reviewer. The penalty sits at the lighter end of the band because the central allegations are confirmed, the reviewer's confidence is moderate (0.6), and no omissions or status contradictions were reported.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":8,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a8945a01-a412-4099-9e3b-4a8204c15202copy