Audit log

Every state-changing event for UwU Lend: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 04:21:59Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,912,733

   sig

   3nK8iPMMxcLR…xw4vkZWNcopyexplorer ↗

   hash

   8JkJhRyb95iD…gLkhvtdJcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6164 B) ▸

   {"actor":"system:backfill","investigation_id":"e62d5064-babc-4523-958a-95103ace35a9","kind":"publish","page_slug":"uwu-lend","published_at":"2026-05-20T04:21:59.826Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"UwU Lend","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://exponential.fi/protocols/uwu/bdf71040-0a05-48ee-a50b-87b7b621c852"},{"credibility":3,"name":"","type":"other","url":"https://etherscan.io/token/0x55C08ca52497e2f1534B59E2917BF524D4765257"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/uwu-lend/part-two-uwu-lend-84e14ee58b76"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://slowmist.medium.com/analysis-of-the-uwu-lend-hack-9502b2c06dbe"},{"credibility":3,"name":"","type":"other","url":"https://unchainedcrypto.com/uwu-lend-hacker-steals-another-3-7-million-from-protocol/"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/uwu-lend-reacts-to-23-million-hack-pauses-protocol-and-negotiates-with-hacker/"},{"credibility":3,"name":"","type":"other","url":"https://www.quillaudits.com/blog/hack-analysis/uwu-lend-hack"},{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/hacker-drains-19-5-million-from-uwu-lend-in-price-oracle-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://unchainedcrypto.com/0xsifu-offers-20-bounty-to-hackers-after-19-million-uwu-lend-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/uwu-lend-hack-20-million"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://etherscan.io/address/0x841ddf093f5188989fa1524e7b893de64b421f47"},{"credibility":3,"name":"","type":"other","url":"https://slowmist.medium.com/analysis-of-the-uwu-lend-hack-9502b2c06dbe"},{"credibility":3,"name":"","type":"other","url":"https://www.chaincatcher.com/en/article/2129245"},{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/investigating-the-uwu-lend-hack-and-flow-of-funds"},{"credibility":3,"name":"","type":"other","url":"https://bitcoinworld.co.in/uwu-lend-exploiter-launders-eth/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://en.wikipedia.org/wiki/Michael_Patryn"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/markets/2022/01/27/wonderland-rattled-after-cofounder-tied-to-alleged-quadrigacx-190m-exit-scam"},{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/defi/uwu-founder-offers-bounty-to-settle-flash-loan-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://protos.com/sifus-uwu-lend-reportedly-hacked-for-20m-curves-egorov-among-affected/"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/wonderland-cfo-outed-as-ex-convict-and-quadrigacx-co-founder-michael-patryn-steps-down/"},{"credibility":3,"name":"","type":"other","url":"https://watcher.guru/news/crypto-scandal-defi-project-wonderland-is-run-by-felon-michael-patryn-with-ties-to-quadrigacx-fraud"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cyvers.ai/blog/uwu-lend-23m-exploit-oracle-vulnerabilities-exposed"},{"credibility":3,"name":"","type":"other","url":"https://www.quillaudits.com/blog/hack-analysis/uwu-lend-hack"},{"credibility":3,"name":"","type":"other","url":"https://exponential.fi/protocols/uwu/bdf71040-0a05-48ee-a50b-87b7b621c852"},{"credibility":3,"name":"","type":"other","url":"https://cryptobriefing.com/uwu-lend-second-hack-update/"},{"credibility":3,"name":"","type":"other","url":"https://en.wikipedia.org/wiki/Michael_Patryn"}]}],"sources_used":[],"summary":"UwU Lend is an Ethereum-based DeFi lending protocol forked from Aave V2, launched in September 2022 and operated by Michael Patryn (known pseudonymously as 0xSifu), a co-founder of the collapsed Canadian crypto exchange QuadrigaCX and a convicted felon. In June 2024, the protocol was exploited twice by the same attacker — first for approximately $19.3 million on June 10 and again for $3.7 million on June 13 — via oracle price manipulation using flash loans, bringing combined losses to approximately $23 million.","timeline":[{"date":"2022-01-27","event":"ZachXBT publicly identifies 0xSifu as Michael Patryn, co-founder of QuadrigaCX; Wonderland community votes to remove him from treasury management role","source":""},{"date":"2022-02-01","event":"Patryn returns to Wonderland following an informal community vote","source":""},{"date":"2022-09-01","event":"UwU Lend launches on Ethereum mainnet, forked from Aave V2, founded by Michael Patryn (0xSifu)","source":""},{"date":"2024-06-10","event":"First exploit: Attacker (0x841ddf093f5188989fa1524e7b893de64b421f47) manipulates UwU Lend's sUSDe oracle via Curve Finance spot prices using a ~$3.796 billion flash loan, draining approximately $19.3 million in ETH, crvUSD, bLUSD, and USDC; protocol paused by team","source":""},{"date":"2024-06-11","event":"Michael Patryn (0xSifu) offers the attacker a 20% bounty (approximately $4 million) to return stolen funds; team announces vulnerability patched","source":""},{"date":"2024-06-13","event":"Second exploit: Same attacker uses residual sUSDe collateral from first hack to drain uDAI, uWETH, uLUSD, uFRAX, uCRVUSD, and uUSDT pools for an additional $3.7 million; combined losses reach approximately $23 million","source":""},{"date":"2024-06-14","event":"Protocol reports repayment of approximately $9.7 million in bad debt; attacker does not return funds","source":""},{"date":"2024-06-15","event":"Attacker transfers approximately 1,000 ETH (roughly $3.66 million) to Tornado Cash in initial laundering tranche","source":""},{"date":"2024-10-09","event":"Linked attacker address launders an additional 2,009 ETH through Tornado Cash; total laundered by associated addresses reaches approximately 6,353 ETH","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9561e01d-e0dd-4a7e-8af6-876e3c70836acopy
2. #2rescoreby systemsystem

   2026-10-10 18:49:34Z
   Score: 10 → 55 (+45)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 55. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,711

   sig

   2nWkhmV81w2K…jYtehj57copyexplorer ↗

   hash

   FpQABK9HQUfv…ZDn1P2excopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (639 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:33.985Z","decision":"rescore","investigation_id":"e62d5064-babc-4523-958a-95103ace35a9","new_score":55,"page_slug":"uwu-lend","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 55. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +4.","score_delta":45,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b442720b-9769-48a8-b8ab-b5e183373055copy
3. #3reviewby reviewerreviewer

   2026-11-02 09:29:07Z
   Score: 55 → 55 (no score change)
   The core narrative holds: two June 2024 exploits of about $19.3M and $3.7M, and Patryn's background, match the sources I could read. The OSC Ponzi attribution is overstated, since it came from a staff review that is not a formal determination. The Wonderland removal vote is not supported by the cited Wikipedia page. The flash loan size is odd and could not be checked because the SlowMist source was blocked. This was a limited spot-check, not a full review of every claim, and the subject's current status could not be determined.
   anchoranchored

   chain

   ●mainnet-betaslot 464,445,159

   sig

   4gHa6ZND8Mit…7dr3vHMwcopyexplorer ↗

   hash

   HuYPgiXv1njB…NFhFcWTccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1373 B) ▸

   {"actor":"reviewer","artifact_identity":"fa540d3587a96ccceea8f87826c03e6d","blocked_count":1,"decided_at":"2026-11-02T09:29:06.961Z","decision":"review","disputed_pct":0,"findings_hash":"44BUn8wy8SkustJ7z568Gk5ktxjNxj4XJPQympfZ518W","investigation_id":"e62d5064-babc-4523-958a-95103ace35a9","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"page_content_hash":"b46199bb74bf76534277652bf7bc7d243454671719d962b770ceda56add43f14","page_slug":"uwu-lend","prev_score":55,"reason":"The core narrative holds: two June 2024 exploits of about $19.3M and $3.7M, and Patryn's background, match the sources I could read. The OSC Ponzi attribution is overstated, since it came from a staff review that is not a formal determination. The Wonderland removal vote is not supported by the cited Wikipedia page. The flash loan size is odd and could not be checked because the SlowMist source was blocked. This was a limited spot-check, not a full review of every claim, and the subject's current status could not be determined.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":6,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7b8755e5-5f3a-4b36-a99f-366d58f12620copy
4. #4review reviseby judgejudge

   2026-11-02 09:29:07Z
   Score: 55 → 55 (no score change)
   No claim was marked disputed, and the one unverifiable finding was blocked by the source (claim_findings[5]), so the calculated disputed share is 0%. However, four of the seven reviewed claims were only partially supported. claim_findings[1] and [2] state that the Ontario Securities Commission 'determined' QuadrigaCX was a Ponzi scheme, when the source was a staff review that disclaims being a finding of fact. claim_findings[3] describes a removal vote that the cited source does not support, and claim_findings[6] places the $9.7 million repayment after the second exploit although some reports put it earlier. The page's current status since 2024 is also unknown (a high-priority coverage gap), and the reviewer's confidence is moderate, so a small penalty and a revision are applied rather than approval.
   anchoranchored

   chain

   ●mainnet-betaslot 464,445,164

   sig

   4rDEaRwFmTZc…Nt5QrMnicopyexplorer ↗

   hash

   9xcgzpVAxP39…fWMjPgymcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2440 B) ▸

   {"actor":"judge","artifact_identity":"fa540d3587a96ccceea8f87826c03e6d","band_override":{"actual_delta":-8,"actual_verdict":"review_revise","disputed_pct":0,"expected_delta_range":[0,0],"expected_verdict":"review_approve","rationale":"No claim was marked disputed, and the one unverifiable finding was blocked by the source (claim_findings[5]), so the calculated disputed share is 0%. However, four of the seven reviewed claims were only partially supported. claim_findings[1] and [2] state that the Ontario Securities Commission 'determined' QuadrigaCX was a Ponzi scheme, when the source was a staff review that disclaims being a finding of fact. claim_findings[3] describes a removal vote that the cited source does not support, and claim_findings[6] places the $9.7 million repayment after the second exploit although some reports put it earlier. The page's current status since 2024 is also unknown (a high-priority coverage gap), and the reviewer's confidence is moderate, so a small penalty and a revision are applied rather than approval."},"blocked_count":1,"decided_at":"2026-11-02T09:29:06.961Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"e62d5064-babc-4523-958a-95103ace35a9","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"page_slug":"uwu-lend","prev_score":55,"reason":"No claim was marked disputed, and the one unverifiable finding was blocked by the source (claim_findings[5]), so the calculated disputed share is 0%. However, four of the seven reviewed claims were only partially supported. claim_findings[1] and [2] state that the Ontario Securities Commission 'determined' QuadrigaCX was a Ponzi scheme, when the source was a staff review that disclaims being a finding of fact. claim_findings[3] describes a removal vote that the cited source does not support, and claim_findings[6] places the $9.7 million repayment after the second exploit although some reports put it earlier. The page's current status since 2024 is also unknown (a high-priority coverage gap), and the reviewer's confidence is moderate, so a small penalty and a revision are applied rather than approval.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":6,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cc26bf11-9994-45a8-99b5-9dbfbc5fa9b9copy