Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review_revise · UNK_DeadDrop
- Sequence
- #3
- Score
- 0 → 0 (-8)
- Cluster
- mainnet-beta
- Slot
- 426522762
- Off-chain at
- 2026-06-15T00:11:57.796Z
- Anchored at
- —
- Block time
- —
Independent verification
- 1. Database (off-chain)
- C2h99RyykMFyeRre4CU7BkbLPe1XijsAP1tro75n1VGN
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1445 chars)
{"actor":"judge","decided_at":"2026-06-15T00:11:57.583Z","decision":"review_revise","investigation_id":"fc05647c-8e8f-4369-815f-eb4ea6b5fbba","new_score":0,"page_slug":"unk-deaddrop","prev_score":0,"reason":"The review found no outright disputed claims across 26 verified findings, but identified three partially-supported claims that require correction. claim_findings[7] adds 'entertainment and media' and 'telecommunications' as targeted sectors that do not appear in the Proofpoint primary source or any independently verified secondary source — these two sectors should be removed or clearly flagged as unconfirmed. claim_findings[19] correctly states the $37.5 million figure but misattributes it to 'Proofpoint's broader tracking' when the figure originates from Elliptic research; the attribution should be corrected to Elliptic. claim_findings[15] describes the Windows payload mechanism imprecisely ('platform-specific launchers decoding embedded payloads') where sources specify Node.js agents running in VS Code's Electron runtime. All other claims across the summary, lure techniques, attack chain, malware tooling, company impersonation list, and regulatory status sections are confirmed by Tier 1 sources. Reviewer confidence is high (0.87) and no link rot or stale citations were found.","score_delta":-8,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}