Audit log

Every state-changing event for Rhea Lend: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 20:13:19Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,839,288

   sig

   4u4gkHqgLf6U…Hi76TQBhcopyexplorer ↗

   hash

   36JvVdojUFhq…jEWjhqAQcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5986 B) ▸

   {"actor":"system:backfill","investigation_id":"9b3955d1-a1de-427d-bfb0-14671152301d","kind":"publish","page_slug":"rhea-lend","published_at":"2026-05-19T20:13:19.058Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Rhea Lend","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://iq.wiki/wiki/rhea-finance"},{"credibility":3,"name":"","type":"other","url":"https://learnnear.club/introducing-rhea-finance/"},{"credibility":3,"name":"","type":"other","url":"https://www.near.org/blog/rhea-finance-debuts-rhea-token-unifying-nea-rs-leading-de-fi-protocols-with-chain-abstracted-liquidity"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/rhea-finance"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://guide.rhea.finance/docs/rhea-finance-white-paper"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/rhea-finance"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://guide.rhea.finance/developers/audits"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates"},{"credibility":3,"name":"","type":"other","url":"https://coinedition.com/18-4m-rhea-finance-hack-built-over-two-days-post-mortem-reveals/"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2026/04/18/hacker-returns-all-the-funds-to-rhea-finance-fact-check/"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2026/04/16/rhea-finance-loses-7-6m-in-exploit-says-certik/"},{"credibility":3,"name":"","type":"other","url":"https://phemex.com/news/article/rhea-finance-suffers-184-million-exploit-due-to-slippage-protection-flaw-74100"},{"credibility":3,"name":"","type":"other","url":"https://www.web3isgoinggreat.com/single/rhea-finance-exploit"},{"credibility":3,"name":"","type":"other","url":"https://ambcrypto.com/rhea-finance-revises-exploit-losses-to-18-4m-confirms-slippage-flaw-as-funds-partially-recovered/"},{"credibility":3,"name":"","type":"other","url":"https://www.mexc.com/news/1036012"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://iq.wiki/wiki/rhea-finance"},{"credibility":3,"name":"","type":"other","url":"https://learnnear.club/introducing-rhea-finance/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates"},{"credibility":3,"name":"","type":"other","url":"https://www.ccn.com/education/crypto/defi-hacks-2026-137m-lost-step-finance-truebit-resolv-exploits/"},{"credibility":3,"name":"","type":"other","url":"https://www.coingabbar.com/en/crypto-currency-news/rhea-finance-crypto-hack-update-near-defi-rhea-token-price-drop"}]}],"sources_used":[],"summary":"Rhea Lend is the lending arm of Rhea Finance, a DeFi protocol on NEAR Protocol formed in early 2025 through the merger of Ref Finance and Burrow Finance. In April 2026, Rhea Lend suffered a major exploit in which an attacker drained approximately $18.4 million by exploiting a flaw in the protocol's slippage protection mechanism via a fake-token pool manipulation scheme. Partial recovery of approximately $9–13 million was achieved through voluntary returns and asset freezes, but the incident represents a critical security failure on an audited protocol.","timeline":[{"date":"2025-02-01","event":"Ref Finance and Burrow Finance announce merger to form Rhea Finance on NEAR Protocol","source":""},{"date":"2025-02-19","event":"Trail of Bits completes smart contract audit of Ref Finance DeFi protocol","source":""},{"date":"2025-03-01","event":"Rhea Finance merger formally announced; $RHEA token introduced as unified governance token","source":""},{"date":"2025-04-02","event":"BlockSec completes audit of Burrow Margin Trading module","source":""},{"date":"2025-08-05","event":"BlockSec completes audit of rNEAR Contract","source":""},{"date":"2025-10-09","event":"Resonance Security completes audit of Liquid Staking Protocol","source":""},{"date":"2026-04-13","event":"Attacker begins two-day preparation: creates 423 intermediary wallets and eight fake token pools on Ref Finance","source":""},{"date":"2026-04-16","event":"Exploit executed: attacker exploits slippage protection flaw in margin trading, draining approximately $7.6 million (initial estimate) from Rhea Lend; CertiK flags the incident; RHEA token price drops approximately 8%","source":""},{"date":"2026-04-17","event":"Additional on-chain activity observed: ~$3.49 million in AAVE USDC V3 tokens moved on Ethereum; attacker returns $3.359 million USDC and $1.564 million NEAR to Rhea Lend contract","source":""},{"date":"2026-04-18","event":"Post-mortem published revising total losses to $18.4 million; Tether freezes $3.291 million USDT in attacker wallet; NEAR Intents freezes additional $1.053 million USDT; Halborn and The Block publish detailed exploit analyses","source":""},{"date":"2026-04-18","event":"Near Intents team states attacker may be identifiable with public social media presence; centralized exchanges notified to assist tracing","source":""},{"date":"2026-05-19","event":"Protocol TVL stands at approximately $120.96 million; compensation framework described as 'in development' with no specifics disclosed; estimated $5.4–9.4 million in losses remain unaccounted for","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a88ddbb9-bd80-479c-9085-3b48edf68c80copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:11Z
   Score: 20 → 58 (+38)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 58. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,172

   sig

   2wUDTNiHKaHM…zpW639kfcopyexplorer ↗

   hash

   8UbYnbHumcoT…NCczPAJFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (606 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:11.366Z","decision":"rescore","investigation_id":"9b3955d1-a1de-427d-bfb0-14671152301d","new_score":58,"page_slug":"rhea-lend","prev_score":20,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 58. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +2.","score_delta":38,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b30b1115-826a-4a70-ad70-06a9e4a6955ecopy
3. #3reviewby reviewerreviewer

   2026-11-02 00:46:25Z
   Score: 58 → 58 (no score change)
   The core exploit narrative is well supported: the April 16, 2026 date, the $18.4M loss revised from $7.6M, the April 13-15 preparation, the 423 wallets and the recovery figures all match The Block and Coin Edition. Problems are the attribution of the flaw's identification to Halborn, the unsupported claim that the exploited code passed a BlockSec April 2025 audit (not listed on the audits page), the inconsistent February and March merger dates, and stale status as of November 2026. Sampled sources were mostly secondary and not all cited URLs were fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,839

   sig

   5GxYYxTcaqZR…1nLPar38copyexplorer ↗

   hash

   2ayHRjJEkt32…4kAcXdLTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1446 B) ▸

   {"actor":"reviewer","artifact_identity":"12d2f00aeac8c16dfcecd8aa931fc4d1","blocked_count":1,"decided_at":"2026-11-02T00:46:25.343Z","decision":"review","disputed_pct":0.4444,"findings_hash":"67CbN4QacZYos4T3d6vmjPGWY7VKzDTHToBQwFx1ucPa","investigation_id":"9b3955d1-a1de-427d-bfb0-14671152301d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":58,"omissions":{"material":1,"total":2},"page_content_hash":"107a9db580b52db057e67c39e98ef5400d892b3165645ddc0f9b1762e577ab76","page_slug":"rhea-lend","prev_score":58,"reason":"The core exploit narrative is well supported: the April 16, 2026 date, the $18.4M loss revised from $7.6M, the April 13-15 preparation, the 423 wallets and the recovery figures all match The Block and Coin Edition. Problems are the attribution of the flaw's identification to Halborn, the unsupported claim that the exploited code passed a BlockSec April 2025 audit (not listed on the audits page), the inconsistent February and March merger dates, and stale status as of November 2026. Sampled sources were mostly secondary and not all cited URLs were fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ac0ff239-588c-4f2b-94be-b3385f370dcacopy
4. #4review reviseby judgejudge

   2026-11-02 00:46:25Z
   Score: 58 → 58 (no score change)
   Of the 9 claims the reviewer could check, 4 (44%) were disputed or could not be verified, which falls in the significant-issues band. The core exploit narrative (April 16, 2026 date, $18.4M loss revised from $7.6M, April 13-15 preparation) is confirmed, but claim_findings[2] disputes the attribution of the flaw's discovery to Halborn, and claim_findings[6] and [7] find no source for a BlockSec April 2025 audit of the exploited code, which the page states as fact while hedging elsewhere. The page also omits that lending was paused after the exploit (omission_findings[0]), and has a high-priority gap on status after May 2026. One TVL claim was not checked because the source blocked the reviewer and is not counted. Reviewer confidence is moderate (0.6) and the core incident is sound, so the penalty is set mid-band and the page is not denied.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,844

   sig

   7k9TEogcgGYH…ymbdbHzDcopyexplorer ↗

   hash

   7nzXD966SXBv…6QZABe4Kcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1898 B) ▸

   {"actor":"judge","artifact_identity":"12d2f00aeac8c16dfcecd8aa931fc4d1","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T00:46:25.343Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4444,"investigation_id":"9b3955d1-a1de-427d-bfb0-14671152301d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":58,"page_slug":"rhea-lend","prev_score":58,"reason":"Of the 9 claims the reviewer could check, 4 (44%) were disputed or could not be verified, which falls in the significant-issues band. The core exploit narrative (April 16, 2026 date, $18.4M loss revised from $7.6M, April 13-15 preparation) is confirmed, but claim_findings[2] disputes the attribution of the flaw's discovery to Halborn, and claim_findings[6] and [7] find no source for a BlockSec April 2025 audit of the exploited code, which the page states as fact while hedging elsewhere. The page also omits that lending was paused after the exploit (omission_findings[0]), and has a high-priority gap on status after May 2026. One TVL claim was not checked because the source blocked the reviewer and is not counted. Reviewer confidence is moderate (0.6) and the core incident is sound, so the penalty is set mid-band and the page is not denied.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"omission_findings[0] is material: the page does not say Rhea paused its lending contracts after the exploit or that the flaw was in Rhea Lend rather than Rhea DEX, and the page's status is out of date. This keeps the verdict in the significant band rather than a lower one."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 49331feb-f0ab-4888-a338-815eca6aba9acopy
5. #5rescoreby systemsystem

   2026-11-02 00:46:26Z
   Score: 58 → 59 (+1)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 58 → 59. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +2; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,847

   sig

   2E4CvRxtYq76…a2ZxAn1Scopyexplorer ↗

   hash

   9HSCePgtVBTX…nsaae5Qpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (716 B) ▸

   {"actor":"system","decided_at":"2026-11-02T00:46:25.343Z","decision":"rescore","investigation_id":"9b3955d1-a1de-427d-bfb0-14671152301d","new_score":59,"page_slug":"rhea-lend","prev_score":58,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 58 → 59. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +2; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":1,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7e167827-bdbd-456f-b926-b14a1bfdb9a7copy