Audit log

Every state-changing event for Sirio Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 02:26:59Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,629,078

   sig

   32iKGuijhXQB…WHbg9GLpcopyexplorer ↗

   hash

   BU5T2uaxrNJo…rxTocfmTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4997 B) ▸

   {"actor":"system:backfill","investigation_id":"387ed05b-91c6-4dc9-9195-af8cc69d4052","kind":"publish","page_slug":"sirio-finance","published_at":"2026-05-28T02:26:59.795Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Sirio Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://genfinity.io/2025/01/27/sirio-finance-mainnet-launch/","type":"other","url":""},{"credibility":3,"name":"https://hedera.com/blog/leveraging-hederas-architecture-sirios-oracle-free-price-feed-approach","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://dappradar.com/dapp/sirio-finance","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1886000535628825027","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1886066175177888071","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.quillaudits.com/leaderboard/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1887577062682337425","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/SirioFinance/status/1887577062682337425","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1886000535628825027","type":"other","url":""},{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://dappradar.com/dapp/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/sirio/","type":"other","url":""},{"credibility":3,"name":"https://www.coinbase.com/price/sirio","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/leaderboard/sirio-finance","type":"other","url":""}]}],"sources_used":[],"summary":"Sirio Finance is a DeFAI lending and borrowing protocol built on the Hedera blockchain that launched on January 27, 2025 and suffered a flashloan exploit on February 1, 2025, resulting in an estimated $2–3 million in stolen funds. The exploit occurred within five days of mainnet launch, with post-incident analysis indicating the vulnerability was introduced when the team followed an audit directive from QuillAudits to remove a reentrancy guard from the protocol's smart contracts. The protocol's TVL collapsed to near zero following the hack, and no confirmed recovery of stolen funds or full user compensation has been publicly documented.","timeline":[{"date":"2025-01-27","event":"Sirio Finance launches its mainnet DeFAI lending and borrowing protocol on the Hedera blockchain, becoming the first lending protocol on the network.","source":""},{"date":"2025-01-29","event":"Sirio Finance reports reaching a $1.5 million TVL milestone, citing strong early user adoption.","source":""},{"date":"2025-02-01","event":"Sirio Finance is exploited via three flashloan attacks executed through Bonzo Finance. The HSUITE pool is specifically compromised. Estimated $2–3 million is stolen. Smart contracts are immediately frozen.","source":""},{"date":"2025-02-03","event":"Sirio Finance team states it is collaborating with the Hedera Foundation, using Elliptic and TRM Labs to track stolen funds, and has attempted to contact the attacker via multiple addresses with a whitehat recovery offer.","source":""},{"date":"2025-02-04","event":"Sirio Finance team provides community update on three key areas: Stolen Funds Tracking, Withdrawal of Left Funds, and the Recovery Program. Reports submission of complaint to CSIRT and contact established with Binance via Seal911 ticket.","source":""},{"date":"2025-02-04","event":"Post-incident analysis indicates the critical vulnerability was introduced when the protocol followed a QuillAudits audit directive to remove a reentrancy guard. Sirio Finance team publicly disassociates from QuillAudits.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9cadab55-79fb-467f-b854-e10b04b9f852copy
2. #2rescoreby systemsystem

   2026-10-10 18:45:06Z
   Score: 28 → 53 (+25)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 53. Problems weighed by who is responsible: concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −2.4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,364,845

   sig

   AUuqt75ERxNG…cLaJo9yYcopyexplorer ↗

   hash

   H4xj1Dz19Kt9…SDiWnFfQcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (609 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:45:06.060Z","decision":"rescore","investigation_id":"387ed05b-91c6-4dc9-9195-af8cc69d4052","new_score":53,"page_slug":"sirio-finance","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 53. Problems weighed by who is responsible: concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −2.4.","score_delta":25,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b65a705f-d228-4ea6-a9bc-d726240cbcdfcopy
3. #3reviewby reviewerreviewer

   2026-10-30 12:23:14Z
   Score: 53 → 53 (no score change)
   The exploit date, flashloan technique, roughly $2m loss, launch date and TVL figure are supported. The QuillAudits reentrancy-guard causation is presented as an analysis finding but rests on anonymous reviews and team posts, and a few details (first lending protocol, 20 features, active website) were not found. The page omits DefiLlama's deprecated status. Many sources were unreadable, so the review is limited.
   anchoranchored

   chain

   ●mainnet-betaslot 463,283,724

   sig

   2je1NLJdpWAj…qJEkHDHhcopyexplorer ↗

   hash

   6HP23fcy3byF…Wky2PZSncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1267 B) ▸

   {"actor":"reviewer","artifact_identity":"1a2026c7bc9cc71e521ca23f53d0a17f","decided_at":"2026-10-30T12:23:14.514Z","decision":"review","disputed_pct":0.4286,"findings_hash":"A7MRUppEqHoj9YFt8aqBjhACpqQa3oa2RwVKhGQ15sJb","investigation_id":"387ed05b-91c6-4dc9-9195-af8cc69d4052","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"omissions":{"material":1,"total":1},"page_content_hash":"53f3735c36152805996cc9de8d478280c20198ab5930f302a393dd03839199c8","page_slug":"sirio-finance","prev_score":53,"reason":"The exploit date, flashloan technique, roughly $2m loss, launch date and TVL figure are supported. The QuillAudits reentrancy-guard causation is presented as an analysis finding but rests on anonymous reviews and team posts, and a few details (first lending protocol, 20 features, active website) were not found. The page omits DefiLlama's deprecated status. Many sources were unreadable, so the review is limited.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ece3037d-5595-4c59-9637-d35875f4b5afcopy
4. #4review reviseby judgejudge

   2026-10-30 12:23:14Z
   Score: 53 → 53 (no score change)
   Of 7 checked claims, 3 could not be verified (claim_findings[3], [4], [6]), giving about 43% unverified and placing the page in the significant-issues band. The core exploit date, flashloan technique, launch date and TVL figure were supported, but the QuillAudits reentrancy-guard cause (claim_findings[1]) is stated as an analysis finding while resting only on anonymous reviews and team posts, and the $2-3 million range was only partly matched ($2 million per DefiLlama). The page also omits DefiLlama's deprecated status while claiming the website and social media remain active. The reviewer's confidence is low (0.4) because many sources were unreadable, so the penalty is kept in the lower half of the band and the page is not denied.
   anchoranchored

   chain

   ●mainnet-betaslot 463,283,729

   sig

   4ysUGDJw1Aic…dy88KN35copyexplorer ↗

   hash

   6tt6W8uiUxGG…fHpHzVpTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1770 B) ▸

   {"actor":"judge","artifact_identity":"1a2026c7bc9cc71e521ca23f53d0a17f","band_override":null,"decided_at":"2026-10-30T12:23:14.514Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4286,"investigation_id":"387ed05b-91c6-4dc9-9195-af8cc69d4052","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"page_slug":"sirio-finance","prev_score":53,"reason":"Of 7 checked claims, 3 could not be verified (claim_findings[3], [4], [6]), giving about 43% unverified and placing the page in the significant-issues band. The core exploit date, flashloan technique, launch date and TVL figure were supported, but the QuillAudits reentrancy-guard cause (claim_findings[1]) is stated as an analysis finding while resting only on anonymous reviews and team posts, and the $2-3 million range was only partly matched ($2 million per DefiLlama). The page also omits DefiLlama's deprecated status while claiming the website and social media remain active. The reviewer's confidence is low (0.4) because many sources were unreadable, so the penalty is kept in the lower half of the band and the page is not denied.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"The review reports a material omission: DefiLlama lists the protocol as deprecated, yet the page says the website and social media remain active (claim_findings[6], omission_findings[0]). The percentage already falls in the significant band, so the band is confirmed rather than raised."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8070db93-ce3f-4d77-aa89-1d6ecfb5521dcopy