← Socket Protocolreviewed 2026-09-06 · 26 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Socket Protocol against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #2[disputed][awaiting moderator]in section: Approval-Based Risk for End Users
“, both previously associated with Biconomy infrastructure development.”
reviewerBoth founders were previously associated with Biconomy infrastructure development.Could not find any credible source connecting either founder to Biconomy; multiple independent aggregators instead trace Chellani to Matic Network and the Movr Network (Socket's predecessor brand), and Khurana to unrelated prior roles. The cited CoinDesk article does not make this claim either. Confidence in this finding is moderate because it rests on secondary aggregators rather than a single definitive biography page.Proposed correction (not yet applied). - #3[disputed][awaiting moderator]in the timeline
“, building on prior Biconomy infrastructure experience.”
reviewerSocket Protocol founded by Vaibhav Chellani and Rishabh Khurana, building on prior Biconomy infrastructure experience.Same underlying error as the Biconomy claim in the Project Background section; repeated here in the timeline.Proposed correction (not yet applied). - #4[disputed][awaiting moderator]in section: Approval-Based Risk for End Users
“enabling interoperability across more than 30 blockchain networks”
reviewerThe protocol positions itself as a chain-abstraction layer enabling interoperability across more than 30 blockchain networks.The specific chain-count figure is not supported by the two sources cited for this section; current official messaging instead describes '20+' or '300+ rollups and chains' depending on the period, none matching '30'. Flagged with moderate confidence since this relies on secondary aggregation rather than a direct fetch of the cited Mirror post.Proposed correction (not yet applied)enabling interoperability across more than 15 blockchain networks - #25[disputed][awaiting moderator]in the timeline
“2024-01-23”
reviewerCompensation portal launched at recovery.socket.tech on January 23, 2024.The compensation-portal announcement (recovery.socket.tech, sign-message requirement, no new approvals) is drawn from the Blockworks compensation-plan article, which multiple independent search results date to January 26, 2024, three days after the date recorded in this timeline entry.Proposed correction (not yet applied)2024-01-26
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #20[partially supported][awaiting moderator]in section: Bungee's Position and Brand Relationship
“CoinTelegraph and CryptoBriefing reported on the recovery and compensation plan.”
reviewerCoinTelegraph and CryptoBriefing reported on the recovery and compensation plan.The two specifically-cited CoinTelegraph and CryptoBriefing articles report on the ETH recovery announcement, not the full compensation-plan details (portal, sign-message mechanic, 232-user total), which are instead covered by the cited Blockworks article. The sentence as written overstates what those two outlets specifically reported. - #24[partially supported][awaiting moderator]in the timeline
“Socket announces recovery of 1,032 ETH (~$2.3M) from the attacker following negotiations, and commits to covering the remaining ~$1.1M shortfall to make all 232 affected users whole.”
reviewerSocket announces recovery of 1,032 ETH from the attacker and commits to covering the remaining ~$1.1M shortfall to make all 232 affected users whole — dated January 23, 2024.This entry conflates two separate announcements under a single date: the Jan 23 ETH-recovery announcement (correctly dated, cited source confirms) and the Jan 26 shortfall-commitment/232-user announcement (incorrectly folded into the Jan 23 entry; its actual cited source for that fact, The Block's Jan 23 piece, explicitly says the distribution plan had not yet been detailed as of that date). Proposed correction removes the mis-dated clause from this entry; see the companion finding on timeline[9] for the correctly-dated placement of the compensation-plan details.
confirmed
20 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Approval-Based Risk for End Users
“Socket Protocol was founded in 2021 by Vaibhav Chellani (CEO) and Rishabh Khurana (Co-founder), both previously associated with Biconomy infrastructure development.”
reviewerSocket Protocol was founded in 2021 by Vaibhav Chellani (CEO) and Rishabh Khurana (Co-founder).Founding year, names and roles are corroborated by multiple independent aggregators and the cited CoinDesk piece. - #5[confirmed][no action needed]in section: Approval-Based Risk for End Users
“Socket raised a $5 million seed round in March 2022 led by Framework Ventures”
reviewerSocket raised a $5 million seed round in March 2022 led by Framework Ventures.Amount, date, and lead investor are independently corroborated by multiple outlets. - #6[confirmed][no action needed]in section: Approval-Based Risk for End Users
“followed by a $5 million strategic round in September 2023 co-led by Coinbase Ventures and Framework Ventures”
reviewerSocket raised a $5 million strategic round in September 2023 co-led by Coinbase Ventures and Framework Ventures.Confirmed by the cited CoinDesk headline and an independent outlet reporting the identical terms. - #7[confirmed][no action needed]in section: Approval-Based Risk for End Users
“Total disclosed funding stands at approximately $10 million across those rounds”
reviewerTotal disclosed funding stands at approximately $10 million across the seed and strategic rounds.Arithmetically correct sum of the two confirmed $5M rounds; page appropriately scopes this to 'those rounds' rather than claiming it is total lifetime funding. - #8[confirmed][no action needed]in section: Approval-Based Risk for End Users
“with an additional $800,000 Arbitrum grant reported by community sources”
reviewerAn additional $800,000 Arbitrum grant is reported by community sources.The page correctly hedges this as 'reported by community sources' rather than asserting it as confirmed fact; no primary-source (Arbitrum Foundation) confirmation was found, but the hedge accurately reflects the evidentiary quality. - #9[confirmed][no action needed]in section: January 2024 Smart Contract Exploit
“On January 16, 2024, at approximately 19:03 UTC, an attacker exploited a critical vulnerability in a newly deployed route module within Socket Protocol's SocketGateway aggregator contract on Ethereum Mainnet.”
reviewerOn January 16, 2024 at approximately 19:03 UTC, an attacker exploited the WrappedTokenSwapperImpl route module, added three days earlier via an admin addRoute transaction, via unvalidated use of .call() with swapExtraData.Directly verified against the primary cited source (CertiK) with an exact match on time, contract name, and mechanism. - #10[confirmed][no action needed]in section: January 2024 Smart Contract Exploit
“The attacker deployed two dedicated exploit contracts: one targeting USDC holdings and a second targeting USDT, WBTC, WETH, MATIC, and DAI.”
reviewerThe attacker deployed two dedicated exploit contracts, one targeting USDC and a second targeting USDT, WBTC, WETH, MATIC, and DAI.Consistent with the token breakdown independently reported by CertiK. - #11[confirmed][no action needed]in section: January 2024 Smart Contract Exploit
“Approximately 230 wallets were affected. The total loss was approximately $3.3 million, with the largest single victim losing approximately 656,000 USDC.”
reviewerApproximately 230 wallets were affected, with total losses of approximately $3.3 million and the largest single victim losing approximately 656,000 USDC.Directly verified against CertiK with an exact numeric match. - #12[confirmed][no action needed]in section: Vulnerability Root Cause and Deployment Process
“An additional flaw in the balance check logic failed to account for scenarios in which 0 WETH was transferred, bypassing what might otherwise have served as a guard.”
reviewerThe vulnerability involved the performAction function passing swapExtraData directly into a .call() instruction, with an additional flaw in balance-check logic for 0 WETH transfers.Technical description matches independently indexed content from Blockworks and CertiK; direct fetch of the Blockworks URL was blocked by the site's bot protection, slightly lowering confidence. - #13[confirmed][no action needed]in section: Vulnerability Root Cause and Deployment Process
“The team later disclosed that the root cause of the deployment included a process failure: a pre-code-review version of the module was pushed to production instead of the reviewed version, meaning the module was live on Ethereum Mainnet for three days before it was exploited.”
reviewerThe root cause included a process failure: a pre-code-review version of the module was pushed to production instead of the reviewed version.Matches Halborn's account closely; could not directly WebFetch the Halborn page due to persistent rate-limiting, so confidence is slightly reduced despite the strong textual match found via search. - #14[confirmed][no action needed]in section: Vulnerability Root Cause and Deployment Process
“Security researchers noted that a thorough smart contract audit of the new module prior to deployment would likely have identified the flaw.”
reviewerA thorough smart contract audit prior to deployment would likely have identified the flaw.Close paraphrase of Halborn's stated conclusion. - #15[confirmed][no action needed]in section: Incident Response and Contract Pause
“Within approximately 14 minutes of the exploit being detected, Socket's team disabled the vulnerable route and deployed corrective code.”
reviewerWithin approximately 14 minutes of the exploit being detected, Socket's team disabled the vulnerable route.The 14-minute figure is specifically attributable to Halborn's technical account of exploit-to-mitigation time; The Block's narrative timeline of public detection and confirmation runs longer, but describes a different clock (external researcher/press timeline, not the on-chain disable transaction). - #16[confirmed][no action needed]in section: Incident Response and Contract Pause
“The Socket admin wallet subsequently broadcast an on-chain message directed at the attacker's address, inviting the attacker to negotiate a bounty and the return of user funds, with a 12-hour response window.”
reviewerSocket's admin wallet broadcast an on-chain message to the attacker inviting negotiation with a 12-hour response window.The 12-hour negotiation window is directly corroborated by reporting reproducing the attacker-directed on-chain message. - #17[confirmed][no action needed]in section: Incident Response and Contract Pause
“CoinDesk and Blockworks reported that Bungee and Socket resumed normal operations the day following the incident, on January 17, 2024.”
reviewerSocket and Bungee Exchange resumed normal operations on January 17, 2024.Direct WebFetch of the CoinDesk URL was persistently rate-limited (429); relied on the article's dateline and corroborating secondary reporting. - #18[confirmed][no action needed]in section: Bungee's Position and Brand Relationship
“Following on-chain outreach, Socket reported that a series of negotiations with the attacker resulted in the return of 1,032 ETH, valued at approximately $2.3 million at prevailing prices.”
reviewerSocket negotiated the return of 1,032 ETH (approximately $2.3 million) from the attacker.Confirmed via two directly-fetched independent sources with matching figures. - #19[confirmed][no action needed]in section: Bungee's Position and Brand Relationship
“The team announced it would cover the remaining shortfall — approximately $1.1 million — from its own resources, ensuring that all 232 affected users would be made whole.”
reviewerSocket covered the remaining approximately $1.1 million shortfall itself, making all 232 affected users whole.The 232-user figure is specific to this Blockworks compensation announcement; note that an earlier CoinTelegraph piece on the same overall incident reported 219 affected users and CertiK's incident-time analysis reported 230 wallets — these are plausibly different counts taken at different stages (initial exploit vs. final compensation reconciliation) rather than a contradiction, but the numeric variance across sources is worth flagging. - #21[confirmed][no action needed]in section: Fund Recovery and User Compensation
“Socket's default approval setting was reported to be finite approvals rather than infinite, but a subset of users had nevertheless granted unlimited approvals, making them vulnerable.”
reviewerSocket's default approval setting was reported to be finite approvals rather than infinite, but a subset of users had granted unlimited approvals.Search-indexed reporting reproduces Socket's own post-mortem statement that it defaults 'to finite approvals within Socket API, Socket Plugin [and] bungee.exchange,' directly corroborating this claim, though not from a page directly fetched in this review. - #22[confirmed][no action needed]in section: Fund Recovery and User Compensation
“Security tools including Revoke.cash published guidance instructing users to audit and revoke outstanding approvals to Socket contracts.”
reviewerRevoke.cash published guidance instructing users to audit and revoke outstanding approvals to Socket contracts.Directly verified against the cited Revoke.cash page. - #23[confirmed][no action needed]in the timeline
“Admin transaction adds the vulnerable WrappedTokenSwapperImpl route to the SocketGateway contract — three days before the exploit.”
reviewerAn admin transaction added the vulnerable WrappedTokenSwapperImpl route to the SocketGateway contract three days before the exploit (January 13, 2024).Exact date match against the directly-fetched primary source. - #26[confirmed][no action needed]in section: Bungee's Position and Brand Relationship
“Recipients were required to sign an on-chain message to confirm wallet ownership but, notably, were not required to grant any new token approvals, avoiding re-exposure of users to approval-based risk.”
reviewerCompensation portal recipients were required to sign an on-chain message but not required to grant new token approvals.Closely matches indexed reporting of the Blockworks compensation article, though direct fetch of the URL itself was blocked by bot protection.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.