Audit log

Every state-changing event for Tropykus RSK: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-30 12:11:53Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,153,895

   sig

   3nJEy6nnzCRf…wpi3CS2Bcopyexplorer ↗

   hash

   jNUK6hWptxHS…abg9cFa3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (9791 B) ▸

   {"actor":"system:backfill","investigation_id":"db07f732-3a6a-48a9-9450-a59c52c3e302","kind":"publish","page_slug":"tropykus-rsk","published_at":"2026-05-30T12:11:53.236Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Tropykus RSK","sections":[{"content":"","heading":"","severity":"low","sources":[{"credibility":2,"name":"Tropykus RSK — DefiLlama Protocol Page","type":"research","url":"https://defillama.com/protocol/tropykus-rsk"},{"credibility":2,"name":"Rootstock Helpdesk: Tropykus","type":"official","url":"https://helpdesk.rootstock.io/solutions/tropykus.html"},{"credibility":2,"name":"Tropykus Finance — GitHub Repository","type":"official","url":"https://github.com/Tropykus/protocol-rsk"},{"credibility":2,"name":"Becoming a Bitcoiner in the DeFi World — Rootstock Blog","type":"official","url":"https://rootstock.io/blog/becoming-a-bitcoiner-in-the-defi-world/"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":2,"name":"La Plataforma DeFi Tropykus Sufre Un Exploit De 150.000 Dolares — Criptotendencias","type":"news_article","url":"https://www.criptotendencias.com/defi/tropykus-defi-exploit-hackers/"},{"credibility":2,"name":"Tropykus Finance sufre exploit por $150,000 — BeinCrypto ES","type":"news_article","url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/"},{"credibility":3,"name":"Tropikus Report: Aftermath of the Exploit — Medium","type":"community_report","url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa"},{"credibility":2,"name":"DeFi Hacks Database — DefiLlama","type":"research","url":"https://defillama.com/hacks"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"Tropikus Report: Aftermath of the Exploit — Medium","type":"community_report","url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa"},{"credibility":2,"name":"Tropykus Finance sufre exploit por $150,000 — BeinCrypto ES","type":"news_article","url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/"},{"credibility":2,"name":"HackenProof: Tropykus Bug Bounty Program","type":"official","url":"https://hackenproof.com/public-bug-bounty-list/tropykus-bug-bounty-program"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":2,"name":"Tropykus to Launch on Polygon zkEVM Using API3 Data Feeds — API3 Medium","type":"news_article","url":"https://medium.com/api3/tropykus-to-launch-on-polygon-zkevm-using-api3s-data-feeds-710fdc29b1c8"},{"credibility":2,"name":"Rounding Errors: Minor but Major Hacks — Extropy.IO Medium","type":"research","url":"https://extropy-io.medium.com/rounding-errors-minor-but-major-hacks-445dc9996ecc"},{"credibility":2,"name":"Tropykus Finance Protocol Whitepaper (Firebase PDF)","type":"official","url":"https://firebasestorage.googleapis.com/v0/b/tropycofinance.appspot.com/o/Tropykus_Protocol%20V4.pdf?alt=media&token=8667d3a7-cdc2-46f2-b35f-5e82bb407b02"},{"credibility":2,"name":"Market Risk Assessment of Tropykus Financial Protocol (HubSpot PDF)","type":"research","url":"https://f.hubspotusercontent30.net/hubfs/21211885/Documentos%20PDF/Tropykus%20Finance%20-%20Quant%20Assesment%20version%202.pdf"}]},{"content":"","heading":"","severity":"low","sources":[{"credibility":2,"name":"Tropykus Finance — Crunchbase Company Profile","type":"other","url":"https://www.crunchbase.com/organization/tropykus-finance"},{"credibility":2,"name":"Tropykus — Outlier Ventures Portfolio","type":"official","url":"https://outlierventures.io/portfolio/tropykus/"},{"credibility":2,"name":"Tropykus Finance — RootstockLabs Blog","type":"news_article","url":"https://www.rootstocklabs.com/blog/tropykus-finance-defi-en-bitcoin-con-impacto-social/"},{"credibility":2,"name":"Tropykus Finance — Tracxn Funding Profile","type":"other","url":"https://tracxn.com/d/companies/tropykus/__d45iyYN5-yD6ugvnyVJ2tq-kCj38Thbr4TDzewjsKqs/funding-and-investors"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT — Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/ZachXBT"}]}],"sources_used":[{"credibility":2,"name":"Tropykus RSK — DefiLlama","type":"research","url":"https://defillama.com/protocol/tropykus-rsk"},{"credibility":2,"name":"Tropykus Finance — DefiLlama","type":"research","url":"https://defillama.com/protocol/tropykus-finance"},{"credibility":2,"name":"Tropykus Finance sufre exploit por $150,000 — BeinCrypto ES","type":"news_article","url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/"},{"credibility":2,"name":"La Plataforma DeFi Tropykus Sufre Un Exploit De 150.000 Dolares — Criptotendencias","type":"news_article","url":"https://www.criptotendencias.com/defi/tropykus-defi-exploit-hackers/"},{"credibility":3,"name":"Tropikus Report: Aftermath of the Exploit — Medium","type":"community_report","url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa"},{"credibility":2,"name":"Tropykus Finance — GitHub","type":"official","url":"https://github.com/Tropykus/protocol-rsk"},{"credibility":2,"name":"Tropykus — Outlier Ventures Portfolio","type":"official","url":"https://outlierventures.io/portfolio/tropykus/"},{"credibility":2,"name":"Tropykus Finance — Crunchbase","type":"other","url":"https://www.crunchbase.com/organization/tropykus-finance"},{"credibility":2,"name":"Tropykus to Launch on Polygon zkEVM Using API3 Data Feeds — API3 Medium","type":"news_article","url":"https://medium.com/api3/tropykus-to-launch-on-polygon-zkevm-using-api3s-data-feeds-710fdc29b1c8"},{"credibility":2,"name":"RootstockLabs Blog: Tropykus Finance DeFi en Bitcoin con Impacto Social","type":"news_article","url":"https://www.rootstocklabs.com/blog/tropykus-finance-defi-en-bitcoin-con-impacto-social/"},{"credibility":2,"name":"Rootstock Helpdesk: Tropykus","type":"official","url":"https://helpdesk.rootstock.io/solutions/tropykus.html"},{"credibility":2,"name":"HackenProof: Tropykus Bug Bounty Program","type":"official","url":"https://hackenproof.com/public-bug-bounty-list/tropykus-bug-bounty-program"},{"credibility":2,"name":"Tropykus Finance — Tracxn Funding Profile","type":"other","url":"https://tracxn.com/d/companies/tropykus/__d45iyYN5-yD6ugvnyVJ2tq-kCj38Thbr4TDzewjsKqs/funding-and-investors"},{"credibility":3,"name":"Tropykus — Altcoin Buzz DeFi Overview","type":"news_article","url":"https://www.altcoinbuzz.io/defi/tropykus-and-emerging-economies/"},{"credibility":2,"name":"Rounding Errors: Minor but Major Hacks — Extropy.IO Medium","type":"research","url":"https://extropy-io.medium.com/rounding-errors-minor-but-major-hacks-445dc9996ecc"}],"summary":"Tropykus is a DeFi lending and borrowing protocol deployed on the Rootstock (RSK) Bitcoin sidechain, founded in 2021 by a Colombian team targeting Latin American underbanked communities. On June 14, 2023, the protocol suffered an exploit in its rBTC micro-market due to a redeem rounding error and exchange rate manipulation, resulting in losses of approximately $150,000 — roughly 10% of total value locked at the time. The team committed to full reimbursement of affected users and subsequently reverted to Compound Finance's original codebase, but the incident highlighted unresolved smart contract risks in a customized fork.","timeline":[{"date":"2021-04-01","event":"Tropykus launches on Rootstock (RSK) testnet.","source":"RootstockLabs Blog","source_url":"https://www.rootstocklabs.com/blog/tropykus-finance-defi-en-bitcoin-con-impacto-social/"},{"date":"2021-05-01","event":"Tropykus mainnet deployment on Rootstock goes live, supporting RBTC, DOC, RIF, and USDT markets.","source":"Rootstock Blog","source_url":"https://rootstock.io/blog/becoming-a-bitcoiner-in-the-defi-world/"},{"date":"2023-05-24","event":"Tropykus deploys experimental version on Polygon zkEVM, integrating API3 self-funded dAPIs for price oracles.","source":"API3 Medium / Cointelegraph ES","source_url":"https://medium.com/api3/tropykus-to-launch-on-polygon-zkevm-using-api3s-data-feeds-710fdc29b1c8"},{"date":"2023-06-14","event":"Tropykus RSK suffers a $150,000 exploit targeting the rBTC micro-market via a redeem rounding error and exchange rate manipulation. Approximately 10% of total deposits are drained.","source":"BeinCrypto ES / Criptotendencias","source_url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/"},{"date":"2023-06-14","event":"Tropykus temporarily disables the platform and identifies two attacker wallet addresses, flagging them across chains.","source":"Criptotendencias","source_url":"https://www.criptotendencias.com/defi/tropykus-defi-exploit-hackers/"},{"date":"2023-06-16","event":"Tropykus sets a 23:59 GMT-5 deadline for the attacker to contact them before pursuing legal action, referencing the $50,000 Immunefi bug bounty as an alternative.","source":"BeinCrypto ES","source_url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/"},{"date":"2023-07-01","event":"Tropykus publicly commits to full reimbursement of all user losses; removes the rBTC micro-market and reverts protocol to Compound Finance's original codebase.","source":"Medium — Tropikus Exploit Aftermath Report","source_url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa"},{"date":"2023-09-18","event":"Tropykus Finance closes a venture funding round, raising $700,000 total from Outlier Ventures, Pomp Investments, and RootstockLabs.","source":"Crunchbase / Tracxn","source_url":"https://www.crunchbase.com/organization/tropykus-finance/company_financials"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7c592e00-f783-4d28-8d99-6270cad0d992copy
2. #2reviewby reviewerreviewer

   2026-08-27 12:07:23Z
   Score: 44 → 44 (no score change)
   The page's factual core -- the June 14, 2023 rBTC micro-market rounding-error exploit, its ~$150,000 / ~10%-of-TVL scale, the team's reimbursement pledge, and the revert to Compound's codebase -- is well supported, including by an independent pull of DefiLlama's raw hacks/TVL data that corroborates the page's own cited source. However, three dated timeline entries (the two RSK launch dates and the reimbursement-commitment date) use likely first-of-month placeholder dates that don't match the actual reported dates, and a fourth (the funding-round date) is confirmed by most aggregators but conflicts with one Messari data point. More importantly, all six sections are structurally present with sources and severity ratings but contain zero narrative content, one section's sole source (ZachXBT/Wikipedia) has no discoverable connection to Tropykus, one cited bug-bounty source (HackenProof) now appears to be link rot / a mismatched citation given reporting points to an Immunefi bounty instead, and the page nowhere mentions that Tropykus announced a full protocol wind-down in 2026, which is now the most materially relevant fact about the entity's current status.
   anchoranchored

   chain

   ●mainnet-betaslot 443,525,947

   sig

   43WXGyLv16CR…k2rpbbRtcopyexplorer ↗

   hash

   7VJXMQsSpqgH…XAsfxJbqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1519 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-27T12:07:23.196Z","decision":"review","investigation_id":"db07f732-3a6a-48a9-9450-a59c52c3e302","new_score":44,"page_slug":"tropykus-rsk","prev_score":44,"reason":"The page's factual core -- the June 14, 2023 rBTC micro-market rounding-error exploit, its ~$150,000 / ~10%-of-TVL scale, the team's reimbursement pledge, and the revert to Compound's codebase -- is well supported, including by an independent pull of DefiLlama's raw hacks/TVL data that corroborates the page's own cited source. However, three dated timeline entries (the two RSK launch dates and the reimbursement-commitment date) use likely first-of-month placeholder dates that don't match the actual reported dates, and a fourth (the funding-round date) is confirmed by most aggregators but conflicts with one Messari data point. More importantly, all six sections are structurally present with sources and severity ratings but contain zero narrative content, one section's sole source (ZachXBT/Wikipedia) has no discoverable connection to Tropykus, one cited bug-bounty source (HackenProof) now appears to be link rot / a mismatched citation given reporting points to an Immunefi bounty instead, and the page nowhere mentions that Tropykus announced a full protocol wind-down in 2026, which is now the most materially relevant fact about the entity's current status.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b3a65580-de63-4b40-84db-44d63b689d66copy
3. #3review reviseby judgejudge

   2026-08-27 12:07:23Z
   Score: 44 → 32 (-12)
   None of the page's 15 checked claims came back false or unverifiable -- the account of the June 2023 rBTC micro-market exploit, its roughly $150,000 / 10%-of-deposits scale, the reimbursement pledge, and the revert to Compound's codebase are all confirmed, including by an independent pull of DefiLlama's raw TVL and hacks data. However, the review surfaced two high-priority gaps that a 0% disputed rate does not capture: the page's six sections carry sources and severity ratings but contain no written analysis at all, and the page never mentions that Tropykus announced a full wind-down of the protocol in April 2026, shut its web interface on 27 July 2026, and ends technical support on 1 September 2026 -- the single most important fact a reader would need right now. Because a page can omit its subject's current shutdown while still having zero factually disputed claims, and because this platform's purpose is to warn users about risk, that omission is treated as disqualifying for outright approval even though it does not move the disputed-claim math. The page is sent back for revision rather than denied outright, since its existing factual content holds up well and the reviewer's confidence (0.72) was moderate, not low. Also flagged: three timeline dates that follow an unverified first-of-month placeholder pattern rather than sourced dates, and two mismatched or rotted citations (a HackenProof bug-bounty link that no longer lists Tropykus, and an unexplained ZachXBT Wikipedia citation with no discoverable link to the protocol).
   anchoranchored

   chain

   ●mainnet-betaslot 443,525,965

   sig

   4MjcRXP5myC1…DpyjRetacopyexplorer ↗

   hash

   2u1jeMWZoXiH…spMtdwVzcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1903 B) ▸

   {"actor":"judge","decided_at":"2026-08-27T12:07:23.196Z","decision":"review_revise","investigation_id":"db07f732-3a6a-48a9-9450-a59c52c3e302","new_score":32,"page_slug":"tropykus-rsk","prev_score":44,"reason":"None of the page's 15 checked claims came back false or unverifiable -- the account of the June 2023 rBTC micro-market exploit, its roughly $150,000 / 10%-of-deposits scale, the reimbursement pledge, and the revert to Compound's codebase are all confirmed, including by an independent pull of DefiLlama's raw TVL and hacks data. However, the review surfaced two high-priority gaps that a 0% disputed rate does not capture: the page's six sections carry sources and severity ratings but contain no written analysis at all, and the page never mentions that Tropykus announced a full wind-down of the protocol in April 2026, shut its web interface on 27 July 2026, and ends technical support on 1 September 2026 -- the single most important fact a reader would need right now. Because a page can omit its subject's current shutdown while still having zero factually disputed claims, and because this platform's purpose is to warn users about risk, that omission is treated as disqualifying for outright approval even though it does not move the disputed-claim math. The page is sent back for revision rather than denied outright, since its existing factual content holds up well and the reviewer's confidence (0.72) was moderate, not low. Also flagged: three timeline dates that follow an unverified first-of-month placeholder pattern rather than sourced dates, and two mismatched or rotted citations (a HackenProof bug-bounty link that no longer lists Tropykus, and an unexplained ZachXBT Wikipedia citation with no discoverable link to the protocol).","score_delta":-12,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 40f30e3c-9d6f-4a12-aeb0-84fc7a903c59copy