Audit log

Every state-changing event for Stake DAO: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 02:35:00Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,848,455

   sig

   4a1ap9jQn4yj…NEq8mQfdcopyexplorer ↗

   hash

   ESZXryXwjtoC…J9SKGajdcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6713 B) ▸

   {"actor":"system:backfill","investigation_id":"22690c77-993d-44f5-aa47-0b2304ade6c1","kind":"publish","page_slug":"stake-dao","published_at":"2026-05-29T02:34:59.971Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Stake DAO","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.stakedao.org/","type":"other","url":""},{"credibility":3,"name":"https://docs.stakedao.org/sdt","type":"other","url":""},{"credibility":3,"name":"https://iq.wiki/wiki/stake-dao","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/stake-dao","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/stake-dao","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptoslate.com/people/julien-bouteloup/","type":"other","url":""},{"credibility":3,"name":"https://iq.wiki/wiki/julien-bouteloup","type":"other","url":""},{"credibility":3,"name":"https://www.quicknode.com/builders-guide/tools/stake-dao-julien-bouteloup?category=defi-tools","type":"other","url":""},{"credibility":3,"name":"https://members.delphidigital.io/reports/building-defi-disneyland-julien-bouteloup-covering-stakedao-blackpool-rekt-and-curve/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptotimes.io/2026/05/27/stake-dao-exploited-as-hacker-mints-5-4-trillion-fake-vsdcrv/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/stake-dao-exploit-vsdcrv-arbitrum/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/stake-dao-exploit-deployer-key-vsdcrv/","type":"other","url":""},{"credibility":3,"name":"https://invezz.com/news/2026/05/27/arbitrum-based-stakedao-contract-hit-by-5-4t-vsdcrv-exploit/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/defi-exploit-hits-stake-dao-as-attacker-swaps-vsdcrv-for-eth/","type":"other","url":""},{"credibility":3,"name":"https://protos.com/stake-dao-hit-by-hack-as-defi-security-confidence-hits-new-low/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/05/28/stake-dao-assures-users-after-vsdcrv-exploit-and-bridge-shutdown/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/StakeDAOHQ/status/2032489716629578004","type":"other","url":""},{"credibility":3,"name":"https://gov.stakedao.org/t/sdgp-65-allow-the-refund-of-affected-users-from-the-march-12-2026-incident-from-the-treasury/1117","type":"other","url":""},{"credibility":3,"name":"https://gov.stakedao.org/t/stake-dao-association-march-2026-report/1124","type":"other","url":""},{"credibility":3,"name":"https://protos.com/stake-dao-hit-by-hack-as-defi-security-confidence-hits-new-low/","type":"other","url":""},{"credibility":3,"name":"https://smartcontractshacking.com/hacks/stake-dao-hack-2026","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://github.com/stake-dao/stake-dao-security/blob/main/disclosures/29-11-2023.md","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://github.com/stake-dao/audits","type":"other","url":""},{"credibility":3,"name":"https://docs.stakedao.org/audits","type":"other","url":""},{"credibility":3,"name":"https://www.chainsecurity.com/security-audit/stakedao-liquidlockers","type":"other","url":""},{"credibility":3,"name":"https://skynet.certik.com/projects/stake-dao","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/stake-dao-exploit-deployer-key-vsdcrv/","type":"other","url":""},{"credibility":3,"name":"https://protos.com/stake-dao-hit-by-hack-as-defi-security-confidence-hits-new-low/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.stakedao.org/sdt","type":"other","url":""},{"credibility":3,"name":"https://docs.stakedao.org/vesdt_governance","type":"other","url":""},{"credibility":3,"name":"https://etherscan.io/token/0x73968b9a57c6e53d41345fd57a6e6ae27d6cdb2f","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/en-GB/price/stake-dao/info","type":"other","url":""}]}],"sources_used":[],"summary":"Stake DAO is a non-custodial DeFi protocol built around liquid staking, yield aggregation, and governance participation via veToken mechanics. The protocol has suffered three documented security incidents since 2023, the most severe of which — a May 2026 deployer private key compromise — enabled the minting of 5.4 trillion fraudulent vsdCRV tokens on Arbitrum, resulting in roughly $91,000 in realized losses despite a nominally catastrophic exposure. Repeated operational security failures across a two-year span, including a March 2026 oracle exploit draining $176,000 from its Votemarket product, indicate a pattern of infrastructure risk that audited smart contracts alone have not resolved.","timeline":[{"date":"2021-01-20","event":"Stake DAO and SDT token launched on Ethereum mainnet; initial airdrop distributed.","source":""},{"date":"2021-02-04","event":"SDT reaches all-time high price of $16.63.","source":""},{"date":"2022-01-01","event":"Stake DAO adopts veTokenomic model; SDT lockable for veSDT governance rights.","source":""},{"date":"2022-06-15","event":"SDT reaches all-time low of $0.1750 amid broader crypto bear market.","source":""},{"date":"2023-01-01","event":"Two-year linear vesting for initial contributors and angel investors concludes.","source":""},{"date":"2023-11-29","event":"Stake DAO discloses LiquidityGauge deployment error on BNB Chain; approximately $4,011 in CAKE tokens stolen; affected users compensated via airdrop.","source":""},{"date":"2026-03-12","event":"Votemarket oracle contract exploited on Arbitrum and Base; approximately $176,000 drained across 54 reward campaigns. Governance proposal SDGP-65 introduced to reimburse affected users from treasury.","source":""},{"date":"2026-05-27","event":"Deployer private key compromised; attacker mints 5.4 trillion vsdCRV on Arbitrum via forged LayerZero v2 cross-chain message. Attacker realizes approximately $91,000 before DEX liquidity exhausted. Stake DAO shuts down vsdCRV bridge and urges users not to interact with vsdCRV.","source":""},{"date":"2026-05-28","event":"Stake DAO publishes follow-up statement assuring users that core products (Liquid Lockers, Boosted Yields, Votemarket, Morpho lending) are unaffected; vsdCRV backing on Ethereum mainnet confirmed secured.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 182e407b-59af-41f7-b6db-03405c288101copy
2. #2reviewby reviewerreviewer

   2026-08-27 10:41:31Z
   Score: 46 → 46 (no score change)
   This is a thin page: with section body text absent from the reviewed snapshot, only 11 checkable atomic claims exist, all drawn from the summary and timeline. The three security incidents (Nov 2023 CAKE bug, March 2026 Votemarket oracle exploit, May 2026 vsdCRV deployer-key exploit) are all confirmed with figures, dates, and mechanisms matching primary and independent sources closely. The two weakest points are the SDT all-time-high and all-time-low price claims, which do not match the page's own cited CoinGecko source and, in the all-time-low case, are also stale given a new lower low set after the 2026 exploits. Two timeline dates (2022-01-01, 2023-01-01) bear the hallmarks of rounded placeholders rather than sourced exact dates, though the underlying year/quarter is directionally correct.
   anchoranchored

   chain

   ●mainnet-betaslot 443,525,330

   sig

   25AimPZakjVW…WkyWKH9Kcopyexplorer ↗

   hash

   EGB73CfsXnPg…cuoK1Uyxcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1147 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-27T10:41:30.520Z","decision":"review","investigation_id":"22690c77-993d-44f5-aa47-0b2304ade6c1","new_score":46,"page_slug":"stake-dao","prev_score":46,"reason":"This is a thin page: with section body text absent from the reviewed snapshot, only 11 checkable atomic claims exist, all drawn from the summary and timeline. The three security incidents (Nov 2023 CAKE bug, March 2026 Votemarket oracle exploit, May 2026 vsdCRV deployer-key exploit) are all confirmed with figures, dates, and mechanisms matching primary and independent sources closely. The two weakest points are the SDT all-time-high and all-time-low price claims, which do not match the page's own cited CoinGecko source and, in the all-time-low case, are also stale given a new lower low set after the 2026 exploits. Two timeline dates (2022-01-01, 2023-01-01) bear the hallmarks of rounded placeholders rather than sourced exact dates, though the underlying year/quarter is directionally correct.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 13f4bea5-4dd1-400d-a994-ea01d1d5dcfccopy
3. #3review reviseby judgejudge

   2026-08-27 10:41:31Z
   Score: 46 → 36 (-10)
   The math on disputed claims alone is favorable: 1 of 11 checkable claims (9.1%) was disputed, and the page's core risk content -- three security incidents (claim_findings[1], [2], [3]) -- was independently confirmed in precise detail against primary sources. However, two factors keep this out of a clean approve. First, claim_findings[8] shows the page's stated SDT all-time-low price and date directly contradict the page's own cited CoinGecko source, and that figure is also outdated following a new low set after the 2026 exploits; claim_findings[7] shows a similar mismatch on the all-time-high figure. Second, coverage_gaps[0] found that all seven of the page's content sections were empty in the reviewed state, meaning the vast majority of the page's substantive prose was never actually checkable -- a high-priority gap that limits how much confidence an 'approve' can carry. Together these push the page into a light revision cycle rather than a pass or a serious denial.
   anchoranchored

   chain

   ●mainnet-betaslot 443,525,333

   sig

   3J4wRpCW2SJR…TADiFDuJcopyexplorer ↗

   hash

   AhUSnz9tiFkW…PxUh4WNCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1332 B) ▸

   {"actor":"judge","decided_at":"2026-08-27T10:41:30.520Z","decision":"review_revise","investigation_id":"22690c77-993d-44f5-aa47-0b2304ade6c1","new_score":36,"page_slug":"stake-dao","prev_score":46,"reason":"The math on disputed claims alone is favorable: 1 of 11 checkable claims (9.1%) was disputed, and the page's core risk content -- three security incidents (claim_findings[1], [2], [3]) -- was independently confirmed in precise detail against primary sources. However, two factors keep this out of a clean approve. First, claim_findings[8] shows the page's stated SDT all-time-low price and date directly contradict the page's own cited CoinGecko source, and that figure is also outdated following a new low set after the 2026 exploits; claim_findings[7] shows a similar mismatch on the all-time-high figure. Second, coverage_gaps[0] found that all seven of the page's content sections were empty in the reviewed state, meaning the vast majority of the page's substantive prose was never actually checkable -- a high-priority gap that limits how much confidence an 'approve' can carry. Together these push the page into a light revision cycle rather than a pass or a serious denial.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 90d8ee1e-de26-49b3-80be-00798784bb9dcopy
4. #4rescoreby systemsystem

   2026-10-10 18:44:40Z
   Score: 36 → 57 (+21)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 36 → 57. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +10; fact-check adjustments (−10) now shown as page reliability, not in the score.
   anchoranchored

   chain

   ●mainnet-betaslot 455,364,435

   sig

   4KWeKAqwixKq…Nc6hnZRqcopyexplorer ↗

   hash

   CmpdR8XpPi6i…4VCsjUqccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (719 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:44:40.631Z","decision":"rescore","investigation_id":"22690c77-993d-44f5-aa47-0b2304ade6c1","new_score":57,"page_slug":"stake-dao","prev_score":36,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 36 → 57. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +10; fact-check adjustments (−10) now shown as page reliability, not in the score.","score_delta":21,"score_model":"v2","sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 482a8f37-6fa0-4b58-bda0-83413109452acopy
5. #5reviewby reviewerreviewer

   2026-10-16 13:33:45Z
   Score: 57 → 57 (no score change)
   The page's core factual backbone is solid: the three security incidents (Nov 2023 BNB Chain LiquidityGauge/CAKE theft, March 2026 Votemarket oracle exploit, May 2026 vsdCRV deployer-key exploit) are all independently corroborated by primary sources (Stake DAO's own GitHub disclosure and governance forum) and multiple reputable outlets (The Block, The Defiant, Cointelegraph, Protos), with dollar figures, token amounts, and mechanisms matching closely. Founder biography and tokenomics figures are also well supported by primary docs and third-party profiles. Two defects stand out: a timeline entry's SDT all-time-low figure ($0.1750 on June 15, 2022) is contradicted by independently-checked trackers, which place the actual all-time low at $0.01523 on October 28, 2022; and the claim that OpenZeppelin co-founder Manuel Aráoz 'cited this incident' is not supported by the sources — his 'all of DeFi is unsafe' remarks predate the exploit and never mention Stake DAO. A handful of lesser claims (SDT's $3.90 launch price, $0.73 January 2024 price, Blockchain Africa speaking engagement, the 'second attempt blocked' detail) could not be verified either way.
   anchoranchored

   chain

   ●mainnet-betaslot 457,655,770

   sig

   5eBTCBy8en39…nex75jEFcopyexplorer ↗

   hash

   FgKUV8D5ZCMw…pyWAHMo8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1756 B) ▸

   {"actor":"reviewer","artifact_identity":"f22b891e58062f7b93f838c65331ed27","decided_at":"2026-10-16T13:33:44.916Z","decision":"review","disputed_pct":0.4615,"findings_hash":"2rSDw424z9v7147E3PBDBfsqrsS5xnYqhFbBM64hiyis","investigation_id":"22690c77-993d-44f5-aa47-0b2304ade6c1","mode":"findings_only","new_score":57,"page_content_hash":"7dfcbacf077cb2a4709d291564e2bf839bd224f0e25019b298758d3138f9ed8f","page_slug":"stake-dao","prev_score":57,"reason":"The page's core factual backbone is solid: the three security incidents (Nov 2023 BNB Chain LiquidityGauge/CAKE theft, March 2026 Votemarket oracle exploit, May 2026 vsdCRV deployer-key exploit) are all independently corroborated by primary sources (Stake DAO's own GitHub disclosure and governance forum) and multiple reputable outlets (The Block, The Defiant, Cointelegraph, Protos), with dollar figures, token amounts, and mechanisms matching closely. Founder biography and tokenomics figures are also well supported by primary docs and third-party profiles. Two defects stand out: a timeline entry's SDT all-time-low figure ($0.1750 on June 15, 2022) is contradicted by independently-checked trackers, which place the actual all-time low at $0.01523 on October 28, 2022; and the claim that OpenZeppelin co-founder Manuel Aráoz 'cited this incident' is not supported by the sources — his 'all of DeFi is unsafe' remarks predate the exploit and never mention Stake DAO. A handful of lesser claims (SDT's $3.90 launch price, $0.73 January 2024 price, Blockchain Africa speaking engagement, the 'second attempt blocked' detail) could not be verified either way.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 03e49424-4444-4fa0-98df-a99e199ecb20copy
6. #6reviewby reviewerreviewer

   2026-10-16 13:41:31Z
   Score: 57 → 57 (no score change)
   The page's central narrative — three security incidents (Nov 2023 CAKE/BNB Chain, March 2026 Votemarket oracle, May 2026 vsdCRV deployer-key exploit) — is well supported by primary disclosures (GitHub security repo, gov.stakedao.org proposals/reports) and corroborated by multiple independent news outlets, and the tokenomics and audit-history sections match primary documentation precisely. The weakest area is historical SDT price data: the page's cited source (CoinGecko) actually shows a different all-time-high ($17.38 vs. claimed $16.63) and a much lower all-time-low ($0.01523 on Oct 28, 2022 vs. claimed $0.1750 on June 15, 2022), and the January 2024 price figure appears to conflate a December 2024 price level. A quote attributed to Manuel Aráoz is framed as reacting to the May 2026 exploit when reporting shows he posted it beforehand as a general statement. Two specific sub-claims in the March 2026 incident writeup (veCRV Round 234, a blocked second attempt) and the inclusion of Kelp DAO in a 'compromised operational keys' pattern could not be fully verified or were only partially supported. No accepted community submissions were present to independently evaluate.
   anchoranchored

   chain

   ●mainnet-betaslot 457,657,867

   sig

   3isB5GUYkMBK…CdMisGjDcopyexplorer ↗

   hash

   BrWAmnb1SSig…ciJVEpJdcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1777 B) ▸

   {"actor":"reviewer","artifact_identity":"b370d01ac8777d8f3bd9269bf0e3e3c8","decided_at":"2026-10-16T13:41:30.987Z","decision":"review","disputed_pct":0.35,"findings_hash":"DRZq3kF6HXWdC2ePZHzgUeTuuLuiBJvazJ3VXh67YSWH","investigation_id":"22690c77-993d-44f5-aa47-0b2304ade6c1","mode":"findings_only","new_score":57,"page_content_hash":"7dfcbacf077cb2a4709d291564e2bf839bd224f0e25019b298758d3138f9ed8f","page_slug":"stake-dao","prev_score":57,"reason":"The page's central narrative — three security incidents (Nov 2023 CAKE/BNB Chain, March 2026 Votemarket oracle, May 2026 vsdCRV deployer-key exploit) — is well supported by primary disclosures (GitHub security repo, gov.stakedao.org proposals/reports) and corroborated by multiple independent news outlets, and the tokenomics and audit-history sections match primary documentation precisely. The weakest area is historical SDT price data: the page's cited source (CoinGecko) actually shows a different all-time-high ($17.38 vs. claimed $16.63) and a much lower all-time-low ($0.01523 on Oct 28, 2022 vs. claimed $0.1750 on June 15, 2022), and the January 2024 price figure appears to conflate a December 2024 price level. A quote attributed to Manuel Aráoz is framed as reacting to the May 2026 exploit when reporting shows he posted it beforehand as a general statement. Two specific sub-claims in the March 2026 incident writeup (veCRV Round 234, a blocked second attempt) and the inclusion of Kelp DAO in a 'compromised operational keys' pattern could not be fully verified or were only partially supported. No accepted community submissions were present to independently evaluate.","score_delta":0,"sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3ea7545e-17e3-4a6a-8f03-706ce9364aa9copy