Skip to main content
AVOID.NET
← avoid.net

Verify a decision

Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.

How verification works

  1. We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction.
  2. We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
  3. You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>

Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.

Decision
review · Shai-Hulud / TeamPCP Supply Chain Attack
View on Solana ↗
Sequence
#4
Score
0 → 0 (0)
Cluster
mainnet-beta
Slot
457541372
Off-chain at
2026-10-16T06:42:49.967Z
Anchored at
2026-10-16T06:43:01.890Z
Block time
—

Independent verification

1. Database (off-chain)
Gxfu3o417VfgHNmDnnsLoMxF5yefAJvpHR9TuYV27MnD
2. Recomputed (your browser)
computing…
3. On-chain (Solana memo)
fetching…
Canonical bytes hashed (1906 chars)
{"actor":"reviewer","artifact_identity":"f3b9d9d76c68f4f80f44f422d476e825","decided_at":"2026-10-16T06:42:49.777Z","decision":"review","disputed_pct":0.3333,"findings_hash":"GfDZrAoAnRyPpS7hz94YMR8M4UMHAXNQZ4a6X2FgDJkp","investigation_id":"e1075e99-3a81-4c83-a3ee-8104ee20a1dc","mode":"findings_only","new_score":0,"page_content_hash":"0bc8a1fd82e8f5e65ac98c970caf4d2a972b9436c0726506a21f754195645349","page_slug":"shai-hulud-teampcp-supply-chain-attack","prev_score":0,"reason":"The page is a detailed, mostly well-sourced timeline of the Shai-Hulud/TeamPCP campaign family, and its highest-stakes financial claims -- the $8.5M/2,520-wallet Trust Wallet theft, the TanStack CVE-2026-45321 compromise, the Bitwarden CLI incident, and the Mastra/Sapphire Sleet attribution -- all check out closely against primary sources fetched directly. The page is also commendably transparent about cross-source disagreements (e.g., CoinDesk's $7M vs. later $8.5M figure, differing package counts across waves), which is good practice. However, it contains a clear factual conflation: the 25,000+ GitHub repository figure, which actually belongs to the November 2025 'Shai-Hulud 2.0' wave (confirmed correct in its own section), is also wrongly attributed to the original September 2025 wave in both prose and the timeline, where contemporaneous Wiz reporting shows repo/account counts only in the dozens. The page also stretches a single-incident Phoenix Security report (the May 19, 2026 atool compromise) into a 'cumulative scale through June 2026' claim the source does not make. One named attribution (Charlie Eriksen as discoverer of Shai-Hulud 3.0) could not be verified against the page's own cited sources. No accepted community evidence exists to independently check.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}