Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
- Sequence
- #5
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457988642
- Off-chain at
- 2026-10-17T09:34:36.183Z
- Anchored at
- 2026-10-17T09:34:53.968Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 32CycwmvpsEi9sUTf1dkEzQRWQ7vQtB7SeJijve6kEu5
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2625 chars)
{"actor":"reviewer","artifact_identity":"d6df112f815d60e2ad192d5b7569347c","decided_at":"2026-10-17T09:34:36.016Z","decision":"review","disputed_pct":0.4583,"findings_hash":"9JjnpZYxvBZe8JCTyqMmDvZ83LyQ84UEovjRXWNQoEm3","investigation_id":"013a0a09-ae20-4647-a35a-080a0a5e1fd1","mode":"findings_only","new_score":0,"page_content_hash":"feff4a8376b7381239cfbbe05b4de200ca3557cc2c32c12794a85e9d60582190","page_slug":"mach-o-man-lazarus-chollima-macos-malware","prev_score":0,"reason":"The core narrative is well-supported: the Mach-O Man disclosure date, authorship (Mauro Eldritch/BCA LTD/Bitso Quetzal Team/ANY.RUN), the four-stage technical attack chain, the ClickFix delivery vector, the Drift Protocol and KelpDAO exploit details, and the September 2019 and March 2020 OFAC designations all check out against primary and reputable secondary sources. However, the review surfaced one serious sourcing error that recurs four times: the page's own cited URL for a 'Tornado Cash' sanctions action (jy0768, May 6, 2022) is actually OFAC's Blender.io press release — Tornado Cash was sanctioned separately on August 8, 2022, a different action the page never actually covers. A second cluster of errors involves the 'Scale of Lazarus Group Cryptocurrency Theft' section, which misattributes a TRM Labs analyst's quote to Bybit's CEO and invents an 'institutional' characterization not present in the cited CyberScoop article. There is also an internal date inconsistency (the cumulative-theft start year is given as both 2017 and 2019 in different parts of the page, with the cited source specifying neither), a stale superlative (Drift is called 'the largest DeFi hack of 2026,' a claim the page's own later KelpDAO section, larger in dollar terms, supersedes), one timeline date off by two days (the Arbitrum freeze, dated April 22 on the page vs. April 20 in the cited source), a minor UN Panel of Experts span error (five years stated vs. six years, 2017-2023, actually reported), a mismatched source headline for the SpotedCrypto citation, and an unresolved nomenclature dispute over whether 'Chollima'/'Famous Chollima' is a Lazarus sub-cluster or a distinct DPRK group. None of these undermine the page's central claim that Mach-O Man is a real, Lazarus-attributed macOS malware campaign, but the Tornado Cash/Blender.io conflation and the fabricated Zhou quote are the kind of errors that should be corrected before the page is relied upon for regulatory or compliance purposes.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}