Skip to main content
AVOID.NET
← Raft Protocolreviewed 2026-10-16 · 25 claims checked

Fact-check findings

What an automated fact-checker found when it re-read Raft Protocol against the sources the page cites. Only the most recent review is shown.

Read this first

These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.

“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.

Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.

disputed 5unverifiable 3link rot 8confirmed 913 corrections pending · 0 applied

disputed

5 claims

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

  1. #6[disputed][awaiting moderator]in section: R Stablecoin Depeg and Market Impact
    “The stablecoin dropped as much as 50% from its peg in the hours following the attack, trading as low as approximately $0.70 on decentralized exchanges.”
    reviewerR stablecoin traded as low as approximately $0.70 on DEXs after a 50% dropA 50% drop from a $1 peg mathematically implies a low near $0.50, not $0.70; $0.70 was the recovery level per the section's own cited source. Internally inconsistent with the page's own hedged summary claim of a $0.18-$0.70 range.
    Proposed correction (not yet applied)
    The stablecoin dropped as much as 50% from its peg in the hours following the attack, trading as low as approximately $0.50 before partially recovering to around $0.70 on decentralized exchanges.
    citedwww.coindesk.com/tech/2023/11/10/defi-pl…ss-on-the-attack
  2. #7[disputed][awaiting moderator]in section: Attacker's Self-Defeating Outcome
    “After the botched execution, they retained only 7 ETH from the operation.”
    reviewerAttacker retained only 7 ETH from the operation, and subtracting 18 ETH prepaid plus gas yields a net loss of approximately 4 ETHThe 7 ETH figure (the remainder of the 1,577 stolen ETH after 1,570 was burned) appears in some secondary sources describing a different pool of funds than the attacker's funding wallet; conflating it with the 18-ETH funding wallet produces incorrect arithmetic. The page's own cited CoinDesk source gives a self-consistent 18-before/14-after/4-net-loss accounting.
    Proposed correction (not yet applied)
    After the botched execution, their wallet held approximately 14 ETH after gas costs.
    citedwww.coindesk.com/tech/2023/11/10/defi-pl…ss-on-the-attack
  3. #8[disputed][awaiting moderator]in the timeline
    “Attacker retained only 7 ETH, resulting in a net loss of ~4 ETH after the 18 ETH attack setup cost.”
    reviewerTimeline: attacker retained only 7 ETH, resulting in a net loss of ~4 ETH after the 18 ETH attack setup costSame underlying defect as the Attacker's Self-Defeating Outcome section; final -4 ETH conclusion is directionally correct, but the stated arithmetic leading to it is wrong.
    Proposed correction (not yet applied)
    The attacker's wallet held approximately 14 ETH after gas costs, resulting in a net loss of ~4 ETH relative to the 18 ETH used to fund the attack.
    citedwww.web3isgoinggreat.com/?id=raft-hack
  4. #11[disputed][awaiting moderator]in section: Protocol Response and Recovery Plan
    “On November 11, 2023, the protocol issued an official post-mortem and announced it was developing a recovery plan for affected users.”
    reviewerRaft published an official post-mortem on November 11, 2023Convergent secondary reporting (Cointelegraph and other outlets) dates the actual post-mortem publication to November 13, 2023, two days after the page's stated date; the Nov 11 date more likely corresponds to Raft's initial announcement that it was 'formulating' a recovery plan, not the post-mortem itself. Could not fetch the primary mirror.xyz document directly (403) to fully settle this, so treat with moderate confidence.
    Proposed correction (not yet applied)
    On November 13, 2023, the protocol issued an official post-mortem and announced it was developing a recovery plan for affected users.
    citedmirror.xyz/0xa486d3a7679D56D545dd5d35746…tYSsGYGHSfOhcO1I
  5. #12[disputed][awaiting moderator]in the timeline
    “2023-11-11”
    reviewerTimeline date field for post-mortem is 2023-11-11This is the correct set_field finding for the timeline date; the prior entry in this array duplicated the same issue against the wrong field shape and should be disregarded by the corrector in favor of this one.
    Proposed correction (not yet applied)
    2023-11-13
    citedmirror.xyz/0xa486d3a7679D56D545dd5d35746…tYSsGYGHSfOhcO1I

unverifiable

3 claims

No source the reviewer could reach confirms or contradicts the claim.

  1. #10[unverifiable][awaiting moderator]in section: Audit Failure
    “The post-mortem noted that Trail of Bits' own report had flagged that the codebase could benefit from improved testing and formal verification practices — but the specific rounding flaw was not surfaced as a finding.”
    reviewerTrail of Bits' own report flagged that the codebase could benefit from improved testing and formal verification practicesCould not independently confirm or contradict this specific characterization of the Trail of Bits report's content; treat as unverified rather than disputed.
    citedmirror.xyz/0xa486d3a7679D56D545dd5d35746…tYSsGYGHSfOhcO1I
  2. #13[unverifiable][awaiting moderator]in section: Protocol Response and Recovery Plan
    “A revised recovery plan was published on November 17, 2023, which set a recovery rate of approximately 42% for affected users and liquidity providers, including LPs on Aerodrome.”
    reviewerA revised recovery plan published Nov 17, 2023 set a ~42% recovery rate for affected users and LPs, including LPs on AerodromeNo independent source could be found confirming the specific 42% recovery rate or Aerodrome LP detail; the only cited source is now a dead domain with no archived copy. The general existence of a recovery plan using protocol-owned sDAI is corroborated elsewhere, but these specific figures are unconfirmed and warrant scrutiny given Aerodrome is a Base-native DEX not otherwise described as part of Raft's deployment footprint on this page.
    citedforum.raft.fi/t/revised-raft-recovery-pl…ovember-2023/256
  3. #14[unverifiable][awaiting moderator]in the timeline
    “Raft published revised recovery plan setting a ~42% recovery rate for affected users and LPs, using protocol-owned sDAI from the Peg Stability Module.”
    reviewerTimeline: revised recovery plan set ~42% recovery rate using sDAI from the PSMSame unverified figure as the corresponding section claim.
    citedforum.raft.fi/t/revised-raft-recovery-pl…ovember-2023/256

confirmed

9 claims

The cited evidence supports the claim as written.

  1. #1[confirmed][no action needed]in section: November 2023 Flash Loan Exploit
    “On November 10, 2023 at approximately 18:59 UTC, an attacker exploited a critical vulnerability in Raft Protocol's smart contracts to mint approximately 6.7 million unbacked R stablecoins.”
    reviewerExploit occurred on November 10, 2023 at approximately 18:59 UTCThe apparent Nov 10/11 discrepancy across outlets is explained by timezone conversion; the page's precise UTC time is independently corroborated.
    citedwww.coindesk.com/tech/2023/11/10/defi-pl…ss-on-the-attack
  2. #2[confirmed][no action needed]in section: November 2023 Flash Loan Exploit
    “The attacker began by borrowing 6,000 cbETH (Coinbase-wrapped staked Ether) from Aave via a flash loan.”
    reviewerAttacker borrowed 6,000 cbETH via Aave flash loanDirectly confirmed by cited source.
    citedcointelegraph.com/news/de-fi-vulnerabili…cted-by-auditors
  3. #3[confirmed][no action needed]in section: November 2023 Flash Loan Exploit
    “The precision rounding flaw in the protocol's divUp function meant that when the attacker subsequently made tiny minting calls, the smart contract rounded share tokens up rather than down — granting the attacker one share per call where mathematically zero shares were due.”
    reviewerThe divUp function rounded share tokens up rather than down, the core precision bugConfirmed by directly fetching the cited technical write-up.
    citedsmartcontractshacking.com/hacks/raft-hack-2023
  4. #4[confirmed][no action needed]in section: November 2023 Flash Loan Exploit
    “The attacker redeemed the inflated shares for cbETH and used this to borrow and then sell massive quantities of R on Balancer and Uniswap liquidity pools, netting approximately 1,577 ETH (~$3.3 million).”
    reviewerAttacker netted approximately 1,577 ETH (~$3.3 million)Directly confirmed.
    citedwww.coindesk.com/tech/2023/11/10/defi-pl…ss-on-the-attack
  5. #5[confirmed][no action needed]in the summary
    “with the stablecoin falling as low as approximately $0.18 to $0.70 depending on the reporting source”
    reviewerR stablecoin fell as low as approximately $0.18 to $0.70 depending on reporting sourceSources genuinely disagree on the exact low ($0.18 vs $0.50); the page's explicit hedge ('depending on the reporting source') is an honest and accurate way to present this disagreement.
    citedwww.coindesk.com/tech/2023/11/10/defi-pl…ss-on-the-attack
  6. #9[confirmed][no action needed]in section: Audit Failure
    “Raft Protocol's smart contracts had been audited by multiple security firms prior to the November 2023 exploit, including Trail of Bits and Hats Finance, as well as Curious Apple and a researcher identified as Aviggiano.”
    reviewerRaft Protocol's smart contracts were audited by Trail of Bits, Hats Finance, Curious Apple, and a researcher identified as AviggianoAll four named auditors are corroborated across independent sources.
    citedcryptodaily.co.uk/2023/11/security-audit…t-hacked-for-67mblockworks.co/news/audits-cannot-guarantee-defi-exploits
  7. #15[confirmed][no action needed]in section: Background and Protocol Design
    “Raft Protocol was developed by Tempus Labs and launched on Ethereum as an over-collateralized stablecoin protocol in the LSDfi (liquid staking derivative finance) sector.”
    reviewerRaft Protocol was developed by Tempus LabsCircumstantial but convergent evidence (audit filenames, SDK package naming, launch article sponsorship) supports the Tempus Labs attribution.
    citedwww.theblock.co/post/233388/raft-goes-af…sdfi-opportunity
  8. #16[confirmed][no action needed]in section: Background and Protocol Design
    “Co-founders identified in connection with the project include David Garai.”
    reviewerDavid Garai is a co-founder of Raft ProtocolConfirmed directly.
    citedwww.theblock.co/post/233388/raft-goes-af…sdfi-opportunity
  9. #17[confirmed][no action needed]in the timeline
    “Raft Protocol launched on Ethereum mainnet as an LSDfi over-collateralized stablecoin protocol backed by stETH/cbETH collateral.”
    reviewerTimeline: Raft Protocol launched on Ethereum mainnet as an LSDfi protocol in 2023Year-level date is accurate; precise month (June) is not asserted by the page so there is no conflict.
    citedwww.theblock.co/post/233388/raft-goes-af…sdfi-opportunity
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.