Audit log

Every state-changing event for PaintSwap: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-14 06:02:56Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 419,629,031

   sig

   5UXqciEA9ifp…6mwyvHjvcopyexplorer ↗

   hash

   CWDRhMEsAVM3…UAkpv5G2copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (17943 B) ▸

   {"actor":"system:backfill","investigation_id":"db6e62bd-77b0-4b73-9a74-3a98505925f4","kind":"publish","page_slug":"paintswap","published_at":"2026-05-14T06:02:56.558Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"PaintSwap","sections":[{"content":"PaintSwap launched in May 2021 on the Fantom Opera network, initially as a yield farming and AMM DEX, before opening Fantom's first multi-standard secondary NFT marketplace in September 2021. The platform supports ERC-721 and ERC-1155 NFTs and introduced version 2 of its marketplace in October 2021, shifting the primary trading currency from BRUSH to FTM. Version 3 launched in July-August 2022, adding batch minting, bulk transfers, checkout cart functionality, and NFT vaults. In December 2024, PaintSwap migrated to the Sonic chain (a rebrand of Fantom Labs), releasing a redesigned marketplace UI and halting further BRUSH token emissions. The team is pseudonymous, known publicly by handles: Arod (digital marketing lead), SamWitch (lead backend developer and smart contracts), CheeseKnight (UI lead), Paintoshi (lead frontend developer), Dyeharder (software development), and N0rm (designer). The Fantom Foundation has featured PaintSwap as a notable ecosystem project.","heading":"Overview and Background","severity":"low","sources":[{"credibility":2,"name":"PaintSwap — A Brand new NFT Marketplace on Fantom Opera (Medium)","type":"official","url":"https://medium.com/paint-swap-finance/paintswap-a-brand-new-nft-marketplace-on-fantom-opera-db113bf2c8be"},{"credibility":2,"name":"Fantom Ecosystem Spotlight — PaintSwap (Fantom Foundation)","type":"official","url":"https://blog.fantom.foundation/fantom-ecosystem-spotlight-paintswap/"},{"credibility":2,"name":"BRUSH & LP migration from Fantom Opera to Sonic (Medium)","type":"official","url":"https://medium.com/paint-swap-finance/brush-lp-migration-from-fantom-opera-to-sonic-8ef52c1ccf5f"}]},{"content":"BRUSH is PaintSwap's native ERC-20 governance and utility token. Its original maximum supply was planned at 450 million, but following the Sonic migration in late 2024, the team halted all further BRUSH emissions, capping effective circulating supply at approximately 407 million tokens. The token reached an all-time high of approximately $0.2491 on January 16, 2022, and has since declined approximately 99.7% to around $0.0006 as of early 2026, giving it a market capitalization of roughly $264,000. The all-time low was recorded on February 6, 2026 at approximately $0.0005399. PaintSwap applies deflationary mechanisms: 50% of marketplace and launchpad fees are used to buy back and burn BRUSH. The token concentration identified in a 2021 audit showed the top five holders controlling approximately 28.87% of total supply, with 26.73% held in the Decorator contract. The owner address retained the ability to mint unlimited tokens at the time of the initial audit, though this risk was partially mitigated by a 24-hour Timelock contract on the Decorator. It is not confirmed whether mint authority has since been renounced.","heading":"Token Economics and BRUSH Price Decline","severity":"medium","sources":[{"credibility":2,"name":"Paintswap (BRUSH) price today — CoinMarketCap","type":"research","url":"https://coinmarketcap.com/currencies/paintswap/"},{"credibility":2,"name":"$BRUSH Tokenomics — PaintSwap Documentation","type":"official","url":"https://docs.paintswap.io/tokenomics/brush"},{"credibility":2,"name":"PaintSwap Smart Contract Audit — SourceHat","type":"research","url":"https://sourcehat.com/audits/PaintSwap/"}]},{"content":"PaintSwap underwent a smart contract audit conducted by SourceHat (formerly Solidity Finance) on November 1, 2021. The audit covered the BRUSH token, Decorator, Timelock, Factory, Router, and Multicall contracts deployed on Fantom mainnet. The overall result was a pass, with no critical or high severity vulnerabilities identified and no external attack vectors found across 14 vulnerability categories including arbitrary storage writes, integer overflow/underflow, ether or token theft, and unchecked return values. The primary risks flagged were governance and operational rather than technical: the owner held centralized control with the ability to mint unlimited tokens to any address, adjust withdrawal fees, and modify emission rates without restriction. Ownership of the Decorator contract was assigned to a 24-hour Timelock contract, providing a minimal delay before administrative changes could take effect. Token concentration was flagged, with the top five holders controlling 28.87% of supply. No subsequent public audit has been identified for contracts deployed after the Sonic migration. The Estfor Kingdom smart contracts are open-source and available on GitHub.","heading":"Smart Contract Security and Audit","severity":"medium","sources":[{"credibility":2,"name":"PaintSwap Smart Contract Audit — SourceHat","type":"research","url":"https://sourcehat.com/audits/PaintSwap/"},{"credibility":2,"name":"PaintSwap Estfor Kingdom Contracts — GitHub","type":"on_chain","url":"https://github.com/PaintSwap/estfor-contracts"}]},{"content":"On October 10, 2025, all PaintSwap-owned domains hosted through the privacy registrar Njalla were taken offline when Njalla reset the domain name servers without prior notice. The root cause was a deprecated application at paintswap.live, hosted on GitHub Pages, which had been flagged by a small number of vendors on VirusTotal. Njalla suspended PaintSwap's entire account — affecting the domains estfor.com, estforkingdom.com, paintswap.io, paintswap.finance, and paintswap.live — based on this low-detection-rate flag without contacting the project first. Support correspondence over October 10-12 revealed minimal explanation from Njalla. Domain transfers were approved on October 12, 2025, with a mandatory seven-day waiting period; all domains except paintswap.live were transferred to a new registrar by October 17, 2025. Smart contract infrastructure was unaffected throughout the incident, and no user funds were reported lost. PaintSwap publicly advised users to avoid Njalla or similar privacy-focused proxy registrars that own domains on behalf of customers, and recommended distributing critical domains across multiple providers. This incident is classified as an operational security failure at the infrastructure level, not a protocol exploit.","heading":"Domain Hijacking Incident (October 2025)","severity":"medium","sources":[{"credibility":2,"name":"Paintswap domain incident — Word of Advice (Medium, by Paintoshi)","type":"official","url":"https://medium.com/paint-swap-finance/paintswap-domain-incident-word-of-advice-3e808e72a99a"}]},{"content":"A domain airdrop.paintswap.pro was identified as a low-risk crypto drainer phishing threat by at least one security vendor on VirusTotal, as reported in April 2026. The domain is not operated by PaintSwap and appears to be a third-party impersonation site. The site reportedly displayed a page designed to impersonate an airdrop offering. The domain was flagged as offline at the time of identification. This type of scam domain targeting PaintSwap users is consistent with broader patterns of airdrop phishing observed across DeFi ecosystems and does not reflect on PaintSwap's own security practices. Users should verify all PaintSwap domain activity through the official paintswap.io or paintswap.finance domains.","heading":"Impersonation and Phishing Risk","severity":"high","sources":[{"credibility":2,"name":"airdrop.paintswap.pro — Scam or Legit? Domain Security Report (PhishDestroy)","type":"community_report","url":"https://phishdestroy.io/domain/airdrop.paintswap.pro/"}]},{"content":"PaintSwap's core team operates under pseudonymous handles — Arod, SamWitch, CheeseKnight, Paintoshi, Dyeharder, and N0rm — and no verified legal identities have been publicly disclosed. The Fantom Foundation has published a team profile describing combined experience of 70 or more years across crypto, finance, and software development, with individual members cited as having 5 to 26 years of industry experience. The team has maintained an active public presence through Medium blog posts, AMAs, and official social media since May 2021. Pseudonymous operation is common among DeFi projects but does present an accountability risk: in the event of disputes or fund mismanagement, legal recourse against identifiable individuals is limited. No evidence of exit intent, insider dumping, or abandonment has been documented in public sources.","heading":"Team Anonymity and Transparency","severity":"medium","sources":[{"credibility":2,"name":"Fantom Ecosystem Spotlight — PaintSwap (Fantom Foundation)","type":"official","url":"https://blog.fantom.foundation/fantom-ecosystem-spotlight-paintswap/"},{"credibility":2,"name":"PaintSwap AMA Sept 2021 — Hosted by FTM Community Alerts (Medium)","type":"official","url":"https://medium.com/paint-swap-finance/paintswap-ama-sept-2021-hosted-by-ftm-community-alerts-ac8ae0b15dcf"}]},{"content":"No regulatory actions, SEC or CFTC enforcement actions, court filings, or government investigations involving PaintSwap or its operators have been identified in publicly available sources as of May 2026. The BRUSH token has not been publicly classified as a security by any regulator. PaintSwap operates as an open decentralized protocol without a centralized corporate entity publicly identified in regulatory filings. The project does not appear to have sought or disclosed any money transmitter licenses or formal regulatory approvals. The absence of identified regulatory action does not confirm regulatory compliance, particularly given evolving international rules around NFT marketplaces and DeFi protocols.","heading":"Regulatory and Legal Status","severity":"low","sources":[{"credibility":2,"name":"Paintswap (BRUSH) — CoinMarketCap listing","type":"other","url":"https://coinmarketcap.com/currencies/paintswap/"}]},{"content":"PaintSwap was the leading NFT marketplace on the Fantom Opera chain from 2021 through 2024. Following the migration to Sonic in December 2024, it rebranded to operate as the primary NFT marketplace and launchpad on that network. The platform also hosts Estfor Kingdom, a fully on-chain free-to-play idle MMORPG in which all items are ERC-1155 NFTs, and which uses BRUSH as its in-game currency. As of early 2026, BRUSH has a market cap of approximately $264,000 and sits outside the top 6,000 tokens by market capitalization on CoinMarketCap, reflecting the overall decline of the Fantom DeFi ecosystem relative to its 2021-2022 peak. GitHub activity is publicly available under the PaintSwap organization, and the Estfor Kingdom contracts are open-source. No venture capital funding rounds, institutional backing, or external investment has been publicly disclosed.","heading":"Market Position and Ecosystem Activity","severity":"low","sources":[{"credibility":2,"name":"Paintswap — The Future of Web3 (Official site)","type":"official","url":"https://paintswap.io/"},{"credibility":2,"name":"Paintswap (BRUSH) — CoinGecko","type":"research","url":"https://www.coingecko.com/en/coins/paint-swap"},{"credibility":2,"name":"Paintswap · GitHub","type":"on_chain","url":"https://github.com/paintswap"},{"credibility":3,"name":"Estfor Kingdom browser RPG review — JuiceNews","type":"news_article","url":"https://juicenews.io/article/estfor-kingdom-browser-rpg/"}]}],"sources_used":[{"credibility":2,"name":"PaintSwap — A Brand new NFT Marketplace on Fantom Opera (Medium)","type":"official","url":"https://medium.com/paint-swap-finance/paintswap-a-brand-new-nft-marketplace-on-fantom-opera-db113bf2c8be"},{"credibility":2,"name":"Fantom Ecosystem Spotlight — PaintSwap (Fantom Foundation)","type":"official","url":"https://blog.fantom.foundation/fantom-ecosystem-spotlight-paintswap/"},{"credibility":2,"name":"BRUSH & LP migration from Fantom Opera to Sonic (Medium)","type":"official","url":"https://medium.com/paint-swap-finance/brush-lp-migration-from-fantom-opera-to-sonic-8ef52c1ccf5f"},{"credibility":2,"name":"Paintswap (BRUSH) price today — CoinMarketCap","type":"research","url":"https://coinmarketcap.com/currencies/paintswap/"},{"credibility":2,"name":"$BRUSH Tokenomics — PaintSwap Documentation","type":"official","url":"https://docs.paintswap.io/tokenomics/brush"},{"credibility":2,"name":"PaintSwap Smart Contract Audit — SourceHat","type":"research","url":"https://sourcehat.com/audits/PaintSwap/"},{"credibility":2,"name":"Paintswap domain incident — Word of Advice (Medium, by Paintoshi)","type":"official","url":"https://medium.com/paint-swap-finance/paintswap-domain-incident-word-of-advice-3e808e72a99a"},{"credibility":2,"name":"airdrop.paintswap.pro — Domain Security Report (PhishDestroy)","type":"community_report","url":"https://phishdestroy.io/domain/airdrop.paintswap.pro/"},{"credibility":2,"name":"PaintSwap AMA Sept 2021 — FTM Community Alerts (Medium)","type":"official","url":"https://medium.com/paint-swap-finance/paintswap-ama-sept-2021-hosted-by-ftm-community-alerts-ac8ae0b15dcf"},{"credibility":2,"name":"PaintSwap NFT Marketplace v3.0 (Medium)","type":"official","url":"https://medium.com/paint-swap-finance/paintswap-v3-0-nft-marketplace-9774a229971f"},{"credibility":2,"name":"Paintswap (BRUSH) — CoinGecko","type":"research","url":"https://www.coingecko.com/en/coins/paint-swap"},{"credibility":2,"name":"Paintswap · GitHub","type":"on_chain","url":"https://github.com/paintswap"},{"credibility":2,"name":"PaintSwap Estfor Kingdom Contracts — GitHub","type":"on_chain","url":"https://github.com/PaintSwap/estfor-contracts"},{"credibility":2,"name":"PaintSwap NFT Marketplace Documentation","type":"official","url":"https://docs.paintswap.io/paintswap-dapp-suite/nft-marketplace"},{"credibility":2,"name":"Sonic Labs August 2024 Newsletter","type":"news_article","url":"https://blog.soniclabs.com/august-24-newsletter/"},{"credibility":2,"name":"PaintSwap Token Tracker — FTMScan","type":"on_chain","url":"https://ftmscan.com/token/0x85dec8c4b2680793661bca91a8f129607571863d"}],"summary":"PaintSwap is a decentralized NFT marketplace and DeFi protocol originally launched on the Fantom Opera blockchain in May 2021, which migrated to the Sonic chain (formerly Fantom) in late 2024. The platform operates an open NFT marketplace, an AMM DEX, yield farming, and an on-chain idle MMORPG called Estfor Kingdom, all powered by its native BRUSH token. No confirmed rug pull, hack, or regulatory action has been identified; the primary documented incident is a domain hijacking by a third-party registrar in October 2025.","timeline":[{"date":"2021-05-10","event":"PaintSwap launches on Fantom Opera with yield farming and staking; BRUSH token introduced.","source":"PaintSwap Medium (Arod)","source_url":"https://medium.com/paint-swap-finance/introducing-paintswap-finance-8dc74d0766f"},{"date":"2021-05-20","event":"BRUSH liquidity pools opened for community trading.","source":"PaintSwap Medium (Arod)","source_url":"https://medium.com/paint-swap-finance/introducing-paintswap-finance-8dc74d0766f"},{"date":"2021-09-03","event":"PaintSwap opens Fantom's first multi-standard open NFT marketplace supporting ERC-721 and ERC-1155 tokens.","source":"PaintSwap Medium (Arod)","source_url":"https://medium.com/paint-swap-finance/paintswap-a-brand-new-nft-marketplace-on-fantom-opera-db113bf2c8be"},{"date":"2021-10","event":"NFT Marketplace v2 launched after more than 1 million FTM traded; primary currency switched from BRUSH to FTM.","source":"PaintSwap Medium (Arod)","source_url":"https://medium.com/paint-swap-finance/paintswap-nft-marketplace-2-0-262de9dc4f98"},{"date":"2021-11-01","event":"SourceHat publishes smart contract audit of PaintSwap. No critical or high severity vulnerabilities identified; centralized mint authority flagged as governance risk.","source":"SourceHat Audit Report","source_url":"https://sourcehat.com/audits/PaintSwap/"},{"date":"2022-01-16","event":"BRUSH token reaches all-time high of approximately $0.2491.","source":"CoinMarketCap","source_url":"https://coinmarketcap.com/currencies/paintswap/"},{"date":"2022-07","event":"NFT Marketplace v3.0 launched with batch minting, bulk transfers, checkout cart, NFT vaults, and one-click liquidation.","source":"PaintSwap Medium (Arod)","source_url":"https://medium.com/paint-swap-finance/paintswap-v3-0-nft-marketplace-9774a229971f"},{"date":"2024-07-20","event":"PaintSwap NFT Launchpad goes live.","source":"Sonic Labs August 2024 Newsletter","source_url":"https://blog.soniclabs.com/august-24-newsletter/"},{"date":"2024-12","event":"BRUSH token and liquidity pools migrated from Fantom Opera to Sonic chain; redesigned Sonic-native marketplace UI released.","source":"PaintSwap Medium (Arod)","source_url":"https://medium.com/paint-swap-finance/brush-lp-migration-from-fantom-opera-to-sonic-8ef52c1ccf5f"},{"date":"2025-01","event":"BRUSH farming emissions halted; token becomes net-deflationary.","source":"PaintSwap Documentation","source_url":"https://docs.paintswap.io/tokenomics/brush"},{"date":"2025-10-10","event":"Njalla domain registrar suspends PaintSwap's entire account without notice, taking all platform domains offline. Root cause: low-detection-rate VirusTotal flag on a deprecated subdomain.","source":"Paintswap Medium (Paintoshi)","source_url":"https://medium.com/paint-swap-finance/paintswap-domain-incident-word-of-advice-3e808e72a99a"},{"date":"2025-10-17","event":"Domain transfers to a new registrar completed; all primary PaintSwap domains restored except paintswap.live.","source":"Paintswap Medium (Paintoshi)","source_url":"https://medium.com/paint-swap-finance/paintswap-domain-incident-word-of-advice-3e808e72a99a"},{"date":"2026-02-06","event":"BRUSH token hits all-time low of approximately $0.0005399.","source":"CoinMarketCap","source_url":"https://coinmarketcap.com/currencies/paintswap/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision aad78da2-5236-423b-8b45-1d2e2d2d97b6copy