Audit log

Every state-changing event for Swan Treasury (STY Token): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-20 17:03:03Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   J9moGqUh6v98…iiqEa9Cacopysha256 → base58

   verifying row…

   canonical bytes (10661 B) ▸

   {"actor":"system:backfill","investigation_id":"c34f3c80-b857-491a-a7d3-690b042fc2ed","kind":"publish","page_slug":"swan-treasury-sty-token","published_at":"2026-08-20T17:03:03.211Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Swan Treasury (STY Token)","sections":[{"content":"Swan Treasury describes itself as a privacy-focused financial infrastructure built for the 'Black Swan era' on BNB Chain. The platform integrates several modules: Swan ID for anonymous identity establishment, Privacy Swap for confidential transactions, Dark Pool for hidden liquidity access, Shielded Vault for on-chain treasury management, and a Node Network for distributed consensus. The STY token serves as the central ecosystem passkey, connecting user participation, transaction flows, vault rights, node contributions, and governance. According to a KuCoin news flash published June 21, 2026 and attributed to MetaEra, the protocol also integrates a liquidity reserve, automated market making, benefit bond vault, and hashrate contract pool. Planned roadmap items include RWA Treasury, an AI Treasury Agent, DePIN Node services, Swan DEX, and Privacy Vault modules. No team members, founders, or organizational details have been publicly disclosed.","heading":"Protocol Overview","severity":"medium","sources":[{"credibility":2,"name":"Swan Treasury Launches Privacy Financial Infrastructure for the Black Swan Era — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/swan-treasury-launches-privacy-financial-infrastructure-for-black-swan-era"}]},{"content":"On July 30, 2026, Swan Treasury suffered an estimated $625,000 loss in a smart contract exploit on BNB Chain. According to reporting by crypto.news and cryptonews.net, both citing analysis by blockchain security firm Defimon Alerts, the root cause was the compromise of an off-chain signer private key that was hardcoded as the _signer address (identified as 0xdEb4…8284) inside the ZhaiquanBuy contract.\n\nThe attacker used the compromised key to generate valid signatures and manipulate the contract's buy() function. The buy() function calculates how many STY tokens a user receives based on a signed discount parameter; by forging a signature with the discount parameter set to 1, the attacker was able to purchase STY at approximately one-hundredth of its intended market price (approximately $2.87 per token at the time of the incident).\n\nThe attacker funded the attack using a PancakeSwap flash loan of approximately 19,700 USDT, with which they acquired approximately 687,000 STY tokens at the deeply discounted rate. The attacker also forged valid signatures for the protocol's claim() and transfer() functions on related contracts, then sold the accumulated tokens into the STY/USDT liquidity pool, realizing a profit of approximately $625,000 USDT.\n\nDefimon Alerts stated that 'every ecrecover operation observed during the exploit resolved to the protocol's hardcoded signer address,' confirming that the private key itself was compromised rather than any flaw in the signature verification logic. Security researchers characterize hardcoding a privileged signer address in a smart contract as a fundamental operational security failure, as any compromise of the associated private key gives an attacker unrestricted ability to forge protocol-level authorization.","heading":"July 2026 Signer Key Exploit","severity":"critical","sources":[{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — crypto.news","type":"news_article","url":"https://crypto.news/swan-treasury-loses-625k-after-signer-key-leak-enables-discounted-sty-purchases/"},{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — cryptonews.net","type":"news_article","url":"https://cryptonews.net/news/security/33229560/"}]},{"content":"The core architectural vulnerability enabling the July 30, 2026 exploit was the use of a single, hardcoded off-chain signer address (_signer) in the ZhaiquanBuy contract to authorize discounted token purchases. This design creates a single point of failure: if the private key associated with that address is ever exposed — through server compromise, poor key management, code repository leaks, or insider access — an attacker gains the ability to forge any signature the contract accepts, with no on-chain mechanism to detect or prevent misuse before funds are drained.\n\nStandard smart contract security practice calls for multi-signature authorization schemes, hardware security modules for key custody, regular key rotation, and on-chain rate limiting or circuit breakers to cap damage in the event of a key compromise. No public information is available regarding what key management practices Swan Treasury employed, or how the attacker obtained the private key. As of August 20, 2026, Swan Treasury has not published a post-mortem, incident report, or any public explanation of the key exposure.","heading":"Operational Security Failure: Hardcoded Signer","severity":"critical","sources":[{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — crypto.news","type":"news_article","url":"https://crypto.news/swan-treasury-loses-625k-after-signer-key-leak-enables-discounted-sty-purchases/"},{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — cryptonews.net","type":"news_article","url":"https://cryptonews.net/news/security/33229560/"}]},{"content":"As of August 20, 2026 — approximately three weeks after the exploit — Swan Treasury has not published a post-mortem, security advisory, or any public statement explaining how the signer key was exposed, what remediation steps have been taken, or whether user funds are at further risk. No team members are publicly identified, making it impossible for users or researchers to seek accountability through conventional channels. The absence of post-incident disclosure is a material transparency concern for any users still interacting with the protocol.","heading":"Transparency and Post-Incident Communication","severity":"high","sources":[{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — crypto.news","type":"news_article","url":"https://crypto.news/swan-treasury-loses-625k-after-signer-key-leak-enables-discounted-sty-purchases/"}]},{"content":"Swan Treasury does not publicly disclose the identities of its founders, developers, or operators. No team page, LinkedIn profiles, or named individuals appear in available reporting or the KuCoin launch announcement attributed to MetaEra. Anonymous teams in DeFi are not inherently disqualifying, but the combination of anonymous operators, a confirmed $625,000 exploit, and the absence of any post-incident communication substantially increases the risk profile for users considering interaction with the protocol.","heading":"Anonymous Team and Disclosure Risks","severity":"medium","sources":[{"credibility":2,"name":"Swan Treasury Launches Privacy Financial Infrastructure for the Black Swan Era — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/swan-treasury-launches-privacy-financial-infrastructure-for-black-swan-era"}]}],"sources_used":[{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — crypto.news","type":"news_article","url":"https://crypto.news/swan-treasury-loses-625k-after-signer-key-leak-enables-discounted-sty-purchases/"},{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — cryptonews.net","type":"news_article","url":"https://cryptonews.net/news/security/33229560/"},{"credibility":2,"name":"Swan Treasury loses $625K after signer key leak enables discounted STY purchases — CoinDesk (coindesk.cc)","type":"news_article","url":"https://coindesk.cc/swan-treasury-loses-625k-after-signer-key-leak-enables-discounted-sty-purchases-94385.html"},{"credibility":2,"name":"Swan Treasury Launches Privacy Financial Infrastructure for the Black Swan Era — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/swan-treasury-launches-privacy-financial-infrastructure-for-black-swan-era"}],"summary":"Swan Treasury is a BNB Chain privacy-finance protocol offering anonymous identity, private transactions, dark pool liquidity, on-chain vaults, and a node network, with the STY token serving as its central ecosystem passkey. On July 30, 2026, the protocol suffered an estimated $625,000 loss after an attacker exploited a compromised off-chain signer private key that was hardcoded as the _signer address in the ZhaiquanBuy smart contract. As of August 20, 2026, Swan Treasury has not published a post-mortem or explained how the signer key was exposed, leaving users without clarity on the protocol's current security posture.","timeline":[{"date":"2026-06-21","event":"Swan Treasury publishes a launch announcement for its privacy-finance infrastructure on BNB Chain, with the STY token described as the central ecosystem passkey. No team members are identified.","source":"KuCoin (MetaEra attribution)","source_url":"https://www.kucoin.com/news/flash/swan-treasury-launches-privacy-financial-infrastructure-for-black-swan-era"},{"date":"2026-07-30","event":"Attacker exploits a compromised off-chain signer private key hardcoded in the ZhaiquanBuy contract. Using a PancakeSwap flash loan of approximately 19,700 USDT, the attacker forges discount signatures and purchases approximately 687,000 STY tokens at roughly 1/100th of intended price, then sells them into the STY/USDT pool for approximately $625,000 USDT profit.","source":"crypto.news, cryptonews.net (citing Defimon Alerts)","source_url":"https://crypto.news/swan-treasury-loses-625k-after-signer-key-leak-enables-discounted-sty-purchases/"},{"date":"2026-07-31","event":"Blockchain security firm Defimon Alerts publicly reports the exploit. crypto.news and cryptonews.net cover the incident. Swan Treasury has made no public statement.","source":"crypto.news","source_url":"https://crypto.news/swan-treasury-loses-625k-after-signer-key-leak-enables-discounted-sty-purchases/"},{"date":"2026-08-20","event":"As of this date, Swan Treasury has not published a post-mortem, explanation of how the signer key was exposed, or any remediation disclosure. The protocol's security posture remains unverified.","source":"Absence of public disclosure — verified via web search","source_url":"https://cryptonews.net/news/security/33229560/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9e426c2e-c7b8-45d8-945e-881d9e254ea5copy