Audit log

Every state-changing event for Sharwa.Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 16:12:59Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,972,367

   sig

   WzxSXUbhTv7V…BYoH9hCfcopyexplorer ↗

   hash

   7UmjMUmuLsPC…PjT77iFmcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5150 B) ▸

   {"actor":"system:backfill","investigation_id":"833401a1-ffcb-4c74-95d6-404dedd094a9","kind":"publish","page_slug":"sharwafinance","published_at":"2026-05-29T16:12:59.826Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Sharwa.Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/sharwa.finance","type":"other","url":""},{"credibility":3,"name":"https://sharwa.finance/app.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.verichains.io/p/vulnerability-analysis-deconstructing","type":"other","url":""},{"credibility":3,"name":"https://getfailsafe.com/sharwafinance-exploit-analysis/","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","type":"other","url":""},{"credibility":3,"name":"https://blockthreat.com/blockthreat-week-43-2025/","type":"other","url":""},{"credibility":3,"name":"https://de.fi/blog/defi-rekt-report-october-2025-38-6-million-lost-across-9-exploits","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://github.com/pashov/audits/blob/master/team/md/SharwaFinance-security-review.md","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/vulnerability-analysis-deconstructing","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/sharwa.finance","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blockthreat.com/blockthreat-week-43-2025/","type":"other","url":""},{"credibility":3,"name":"https://de.fi/blog/defi-rekt-report-october-2025-38-6-million-lost-across-9-exploits","type":"other","url":""},{"credibility":3,"name":"https://x.com/SharwaFinance","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/sharwa.finance","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/vulnerability-analysis-deconstructing","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","type":"other","url":""}]}],"sources_used":[],"summary":"Sharwa.Finance is an on-chain portfolio margin trading protocol deployed on Arbitrum, enabling leveraged spot and options trading with cross-margin collateral. The protocol suffered a $147,000 exploit in October 2025 via a flash loan price-oracle manipulation attack, a vulnerability class that had been explicitly identified and reported by the Pashov Audit Group over one year prior to the incident. The protocol was flagged by on-chain security researchers including ZachXBT-adjacent monitoring networks, and a second oracle manipulation incident resulting in approximately $32,850 in losses was recorded in May 2026.","timeline":[{"date":"2024-06-17","event":"Pashov Audit Group publishes security review of SharwaFinance/MarginTrading, identifying four critical-severity findings including C-01 Uniswap Spot Price Manipulation, explicitly warning that reliance on Uniswap V3 spot prices enables flash loan exploitation.","source":""},{"date":"2025-10-02","event":"Sharwa.Finance deploys a new version of the FacadeTradeRouter contract (18 days before the exploit), reportedly without re-applying the oracle fix recommended in the Pashov audit.","source":""},{"date":"2025-10-20","event":"Sharwa.Finance exploited on Arbitrum via flash loan price oracle manipulation. Attackers use a large USDC flash loan from Morpho to manipulate a Uniswap V3 pool and withdraw excess value through the FacadeTradeRouter contract. Total losses approximately $147,000.","source":""},{"date":"2025-10-23","event":"FailSafe publishes exploit analysis identifying two separate attackers, attributing approximately $61,000 and $85,000 in profits respectively to an absence of insolvency checks in the MarginTrading swap function.","source":""},{"date":"2025-10-27","event":"Sharwa.Finance team posts attack post-mortem on X, commits to 100% reimbursement of affected users, and implements Reduce-Only mode blocking new positions.","source":""},{"date":"2025-10-27","event":"Additional exploit transactions documented on Arbitrum network; $40,000 of stolen funds recovered.","source":""},{"date":"2025-10-27","event":"Verichains publishes vulnerability analysis of the Sharwa Finance exploit, confirming the oracle manipulation vector and noting the prior Pashov audit finding.","source":""},{"date":"2026-05-01","event":"Sharwa.Finance suffers a second security incident attributed to oracle price manipulation on Arbitrum, resulting in approximately $32,850 in losses according to DefiLlama protocol data.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 198b1d04-6350-4d14-8b1f-491101e0376fcopy
2. #2reviewby reviewerreviewer

   2026-11-02 04:19:19Z
   Score: 38 → 38 (no score change)
   The core October 2025 exploit facts hold up: date, amount, pools, attacker addresses, Morpho flash loan, the 18-day-old deployment, the FailSafe attacker split and the Pashov findings. Weak points are the unsourced ZachXBT-associated flag (summary and sections[4]), the unsourced $40,000 recovery, an overstated claim that the fix was dropped (Verichains says the finding was marked resolved), and a stale DefiLlama rank and TVL. I could not read DefiLlama directly, so the May 2026 incident and current status rest on a search summary.
   anchoranchored

   chain

   ●mainnet-betaslot 464,358,376

   sig

   2Q7DeuDrA4Fm…GPJS5Gcrcopyexplorer ↗

   hash

   8VNaQVwmTy6v…QdYCWGoGcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1389 B) ▸

   {"actor":"reviewer","artifact_identity":"cf129dd8c5a8f32ccf00d82416ceddd4","decided_at":"2026-11-02T04:19:19.606Z","decision":"review","disputed_pct":0.3636,"findings_hash":"8zrHRm25E2zupvR9d5YLRSBSy9SXsE5ytCsSYN6m9pLw","investigation_id":"833401a1-ffcb-4c74-95d6-404dedd094a9","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":38,"omissions":{"material":0,"total":1},"page_content_hash":"719a3ad23a9e718dadb0817e1da6f2c02b95808962de899b4824758a65f466f7","page_slug":"sharwafinance","prev_score":38,"reason":"The core October 2025 exploit facts hold up: date, amount, pools, attacker addresses, Morpho flash loan, the 18-day-old deployment, the FailSafe attacker split and the Pashov findings. Weak points are the unsourced ZachXBT-associated flag (summary and sections[4]), the unsourced $40,000 recovery, an overstated claim that the fix was dropped (Verichains says the finding was marked resolved), and a stale DefiLlama rank and TVL. I could not read DefiLlama directly, so the May 2026 incident and current status rest on a search summary.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":2,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 57ce1ef7-fac5-49cb-9ecb-9eb55d2152b3copy
3. #3review reviseby judgejudge

   2026-11-02 04:19:19Z
   Score: 38 → 22 (-16)
   The core October 2025 exploit facts (date, amount, pools, attacker addresses, flash loan route, Pashov audit findings) were confirmed against Tier 1 and Tier 2 sources. Four of 11 claims (about 36%) could not be verified: the $40,000 recovery (claim_findings[2]), the ZachXBT-associated flag in the body and the summary (claim_findings[5], [6]), and the Verichains publication date (claim_findings[10]). The claim that the fix was dropped from the new deployment is stated more strongly than the sources allow (claim_findings[4]), and the TVL and rank figures are out of date (claim_findings[8]). The unverified items are mostly secondary to the core exploit narrative, so the penalty sits at the low end of the significant band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,358,382

   sig

   4XBjm5ZbbKrf…SLYsQ27hcopyexplorer ↗

   hash

   BRVXPBHJ2XH2…wWL8CZsicopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1483 B) ▸

   {"actor":"judge","artifact_identity":"cf129dd8c5a8f32ccf00d82416ceddd4","band_override":null,"decided_at":"2026-11-02T04:19:19.606Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3636,"investigation_id":"833401a1-ffcb-4c74-95d6-404dedd094a9","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":22,"page_slug":"sharwafinance","prev_score":38,"reason":"The core October 2025 exploit facts (date, amount, pools, attacker addresses, flash loan route, Pashov audit findings) were confirmed against Tier 1 and Tier 2 sources. Four of 11 claims (about 36%) could not be verified: the $40,000 recovery (claim_findings[2]), the ZachXBT-associated flag in the body and the summary (claim_findings[5], [6]), and the Verichains publication date (claim_findings[10]). The claim that the fix was dropped from the new deployment is stated more strongly than the sources allow (claim_findings[4]), and the TVL and rank figures are out of date (claim_findings[8]). The unverified items are mostly secondary to the core exploit narrative, so the penalty sits at the low end of the significant band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-16,"score_limit":{"applied":-16,"limited":false,"proposed":-16,"rule":"second_opinion_agreed","second":-18},"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4e4e6102-e8b4-4be6-9db0-2c63384f2b56copy