Audit log

Every state-changing event for Rodeo Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-30 12:14:27Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,154,283

   sig

   2FUKBf9cd6EV…fE7RcwBmcopyexplorer ↗

   hash

   GZd6BLvKARcM…Da77wbSbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (11015 B) ▸

   {"actor":"system:backfill","investigation_id":"d1d86c62-e8a7-4bbe-9461-574f58b927a6","kind":"publish","page_slug":"rodeo","published_at":"2026-05-30T12:14:26.031Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Rodeo Finance","sections":[{"content":"","heading":"Protocol Overview","severity":"medium","sources":[{"credibility":2,"name":"Rodeo Finance Security Overview (Official Medium)","type":"official","url":"https://medium.com/@Rodeo_Finance/rodeo-finance-security-f47da92f0c10"},{"credibility":2,"name":"Rodeo Finance Exploit Post Mortem (Official Medium)","type":"official","url":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"}]},{"content":"","heading":"First Exploit — July 5, 2023 (mintProtocolReserves Vulnerability)","severity":"high","sources":[{"credibility":2,"name":"BlockSec Phalcon on X — mintProtocolReserves exploit details","type":"research","url":"https://x.com/Phalcon_xyz/status/1676511696603729921"},{"credibility":2,"name":"CoinTelegraph — Rodeo Finance exploited for second time, $1.5M stolen","type":"news_article","url":"https://cointelegraph.com/news/arbitrum-based-rodeo-finance-exploited-for-1-53m-the-second-time-in-a-week"},{"credibility":2,"name":"Protos — Latest attack on Arbitrum network costs Rodeo Finance $885k in ETH","type":"news_article","url":"https://protos.com/latest-attack-on-arbitrum-network-costs-rodeo-finance-885k-in-eth/"}]},{"content":"","heading":"Second Exploit — July 11, 2023 (TWAP Oracle Manipulation Attack)","severity":"critical","sources":[{"credibility":2,"name":"QuillAudits — Decoding Rodeo Finance Hack","type":"research","url":"https://www.quillaudits.com/blog/hack-analysis/rodeo-finance-hack"},{"credibility":2,"name":"Neptune Mutual — Understanding Rodeo Finance Exploit","type":"research","url":"https://medium.com/neptune-mutual/understanding-rodeo-finance-exploit-5425b30fbf20"},{"credibility":2,"name":"Rodeo Finance Exploit Post Mortem (Official)","type":"official","url":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"},{"credibility":2,"name":"Decrypt — Rodeo Finance Hacked for $888,000 in Ethereum","type":"news_article","url":"https://decrypt.co/148068/layer-2-defi-project-rodeo-finance-hacked-472-ethereum"},{"credibility":2,"name":"The Block — Arbitrum-based Rodeo Finance loses $888,000 in latest DeFi exploit","type":"news_article","url":"https://www.theblock.co/post/238819/arbitrum-rodeo-finance-1-5-million-defi-exploit"}]},{"content":"","heading":"Attacker On-Chain Trail and Fund Laundering","severity":"critical","sources":[{"credibility":2,"name":"QuillAudits — Decoding Rodeo Finance Hack (attacker address and tx hash)","type":"research","url":"https://www.quillaudits.com/blog/hack-analysis/rodeo-finance-hack"},{"credibility":2,"name":"Neptune Mutual — Understanding Rodeo Finance Exploit (fund flow analysis)","type":"research","url":"https://medium.com/neptune-mutual/understanding-rodeo-finance-exploit-5425b30fbf20"},{"credibility":2,"name":"Crypto Briefing — DeFi Protocol Rodeo Finance Hacked; $1.53M of ETH Stolen","type":"news_article","url":"https://cryptobriefing.com/defi-protocol-rodeo-finance-hacked-1-53m-of-eth-stolen/"},{"credibility":2,"name":"Protos — Latest attack on Arbitrum network costs Rodeo Finance $885k in ETH","type":"news_article","url":"https://protos.com/latest-attack-on-arbitrum-network-costs-rodeo-finance-885k-in-eth/"}]},{"content":"","heading":"Team Response and Compensation Plan","severity":"high","sources":[{"credibility":2,"name":"Rodeo Finance Exploit Post Mortem (Official Medium)","type":"official","url":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"},{"credibility":2,"name":"CoinTelegraph — Rodeo Finance exploited for second time, $1.5M stolen","type":"news_article","url":"https://cointelegraph.com/news/arbitrum-based-rodeo-finance-exploited-for-1-53m-the-second-time-in-a-week"}]},{"content":"","heading":"Market Impact and Protocol Collapse","severity":"critical","sources":[{"credibility":2,"name":"CryptoBriefing — DeFi Protocol Rodeo Finance Hacked; $1.53M of ETH Stolen","type":"news_article","url":"https://cryptobriefing.com/defi-protocol-rodeo-finance-hacked-1-53m-of-eth-stolen/"},{"credibility":2,"name":"Decrypt — Rodeo Finance Hacked for $888,000 in Ethereum","type":"news_article","url":"https://decrypt.co/148068/layer-2-defi-project-rodeo-finance-hacked-472-ethereum"},{"credibility":2,"name":"Blockonomi — Arbitrum: Rodeo Finance Hacked, Price Crashes 60%","type":"news_article","url":"https://blockonomi.com/arbitrum-rodeo-finance-hacked-price-crashes-60/"},{"credibility":2,"name":"DeFi Llama — Rodeo Protocol TVL","type":"on_chain","url":"https://defillama.com/protocol/rodeo"}]},{"content":"","heading":"Oracle Design Failure and Security Analysis","severity":"critical","sources":[{"credibility":2,"name":"QuillAudits — Decoding Rodeo Finance Hack","type":"research","url":"https://www.quillaudits.com/blog/hack-analysis/rodeo-finance-hack"},{"credibility":2,"name":"ImmuneByes — Rodeo Finance Hack Analysis Report July 11 2023","type":"research","url":"https://immunebytes.com/blog/rodeo-finance-hack-analysis-report-july-11-2023/"},{"credibility":2,"name":"Neptune Mutual — Understanding Rodeo Finance Exploit","type":"research","url":"https://medium.com/neptune-mutual/understanding-rodeo-finance-exploit-5425b30fbf20"}]}],"sources_used":[{"credibility":2,"name":"Rodeo Finance Exploit Post Mortem (Official Medium)","type":"official","url":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"},{"credibility":2,"name":"Rodeo Finance Security Overview (Official Medium)","type":"official","url":"https://medium.com/@Rodeo_Finance/rodeo-finance-security-f47da92f0c10"},{"credibility":2,"name":"QuillAudits — Decoding Rodeo Finance Hack","type":"research","url":"https://www.quillaudits.com/blog/hack-analysis/rodeo-finance-hack"},{"credibility":2,"name":"ImmuneByes — Rodeo Finance Hack Analysis Report July 11 2023","type":"research","url":"https://immunebytes.com/blog/rodeo-finance-hack-analysis-report-july-11-2023/"},{"credibility":2,"name":"Neptune Mutual — Understanding Rodeo Finance Exploit","type":"research","url":"https://medium.com/neptune-mutual/understanding-rodeo-finance-exploit-5425b30fbf20"},{"credibility":2,"name":"The Block — Arbitrum-based Rodeo Finance loses $888,000 in latest DeFi exploit","type":"news_article","url":"https://www.theblock.co/post/238819/arbitrum-rodeo-finance-1-5-million-defi-exploit"},{"credibility":2,"name":"CoinTelegraph — Rodeo Finance exploited for second time, $1.5M stolen","type":"news_article","url":"https://cointelegraph.com/news/arbitrum-based-rodeo-finance-exploited-for-1-53m-the-second-time-in-a-week"},{"credibility":2,"name":"Decrypt — Rodeo Finance Hacked for $888,000 in Ethereum","type":"news_article","url":"https://decrypt.co/148068/layer-2-defi-project-rodeo-finance-hacked-472-ethereum"},{"credibility":2,"name":"CryptoBriefing — DeFi Protocol Rodeo Finance Hacked; $1.53M of ETH Stolen","type":"news_article","url":"https://cryptobriefing.com/defi-protocol-rodeo-finance-hacked-1-53m-of-eth-stolen/"},{"credibility":2,"name":"Protos — Latest attack on Arbitrum network costs Rodeo Finance $885k in ETH","type":"news_article","url":"https://protos.com/latest-attack-on-arbitrum-network-costs-rodeo-finance-885k-in-eth/"},{"credibility":2,"name":"Blockonomi — Arbitrum: Rodeo Finance Hacked, Price Crashes 60%","type":"news_article","url":"https://blockonomi.com/arbitrum-rodeo-finance-hacked-price-crashes-60/"},{"credibility":2,"name":"BlockSec Phalcon on X — mintProtocolReserves vulnerability details","type":"social_media","url":"https://x.com/Phalcon_xyz/status/1676511696603729921"},{"credibility":2,"name":"DeFi Llama — Rodeo Protocol TVL","type":"on_chain","url":"https://defillama.com/protocol/rodeo"}],"summary":"Rodeo Finance was an Arbitrum-based leveraged yield protocol that allowed users to open leveraged positions in DeFi yield strategies using borrowed USDC from an integrated lending pool. The protocol suffered two separate security exploits in July 2023 within six days of each other, with the second — a TWAP oracle manipulation attack — draining approximately 472 ETH (roughly $888,000 net) and collapsing its total value locked from $20 million to under $500. The attacker bridged stolen funds to Ethereum, routed 150 ETH through Tornado Cash, and the protocol never fully recovered operationally.","timeline":[{"date":"2023-07-05","event":"First exploit: approximately $89,000 stolen via a vulnerability in the mintProtocolReserves function and StrategyGamma balance manipulation. Hypernative Labs detected the attack.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/arbitrum-based-rodeo-finance-exploited-for-1-53m-the-second-time-in-a-week"},{"date":"2023-07-11","event":"Second exploit at approximately 07:54 UTC: attacker (0x2f3788F2396127061c46fC07BD0fcb91faAcE328) executes a multiblock TWAP oracle sandwich attack on the ETH/unshETH strategy. 472 ETH (~$888,000 net) drained from the USDC lending pool. PeckShield first publicly alerts the team on Twitter.","source":"QuillAudits / Rodeo Finance Post Mortem","source_url":"https://www.quillaudits.com/blog/hack-analysis/rodeo-finance-hack"},{"date":"2023-07-11","event":"Rodeo Finance pauses all protocol operations. TWAP-dependent farms disabled. Team initiates forensic analysis and contacts law enforcement.","source":"Rodeo Finance Official Post Mortem","source_url":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"},{"date":"2023-07-11","event":"Attacker bridges stolen ETH from Arbitrum to Ethereum mainnet. 285 ETH swapped for unshETH and deposited to Ankr ETH2 staking. 150 ETH sent to Tornado Cash. Approximately 371 ETH remains in attacker wallet.","source":"Neptune Mutual Exploit Analysis","source_url":"https://medium.com/neptune-mutual/understanding-rodeo-finance-exploit-5425b30fbf20"},{"date":"2023-07-11","event":"RDO token price drops approximately 60%, from ~$0.20 to ~$0.08. Protocol TVL collapses from $20 million to under $500.","source":"Blockonomi / CryptoBriefing","source_url":"https://blockonomi.com/arbitrum-rodeo-finance-hacked-price-crashes-60/"},{"date":"2023-07-12","event":"Team recovers approximately $816,342 USDC worth of unshETH left in exploited contracts. Funds transferred to Rodeo multisig and swapped to USDC. Team announces weekly repayment plan for USDC pool LP losses from treasury.","source":"Rodeo Finance Official Post Mortem","source_url":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"},{"date":"2023-07-12","event":"On-chain white hat bounty message sent to attacker wallet. No funds returned. Third-party auditors engaged for full codebase review before any potential relaunch.","source":"Rodeo Finance Official Post Mortem","source_url":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 193454f7-3d56-4f46-b316-1bf85193df34copy