Skip to main content
AVOID.NET
← avoid.net

Verify a decision

Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.

How verification works

  1. We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction.
  2. We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
  3. You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>

Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.

Decision
review · Supra Oracle — Bonzo Lend Attack Vector
View on Solana ↗
Sequence
#5
Score
12 → 12 (0)
Cluster
mainnet-beta
Slot
457558841
Off-chain at
2026-10-16T07:45:29.632Z
Anchored at
2026-10-16T07:45:50.045Z
Block time
—

Independent verification

1. Database (off-chain)
6G82pLxiRbomA9qS1sgSQwcQRtXjKC6mpqevgUCA1D1b
2. Recomputed (your browser)
computing…
3. On-chain (Solana memo)
fetching…
Canonical bytes hashed (2075 chars)
{"actor":"reviewer","artifact_identity":"fd8cf22ca8ca468c8c0dfd5fc76ad41c","decided_at":"2026-10-16T07:45:29.396Z","decision":"review","disputed_pct":0.2632,"findings_hash":"68rvdZTrNmZJZyy7FHRbqDu2j22E7Ke7z7UB8pch7u5P","investigation_id":"c728ec71-a5d0-4641-9fd6-93840cd32777","mode":"findings_only","new_score":12,"page_content_hash":"90d463892293a830ddb9f2cbe7006dd1656d1a293ca2cb1220f4136eb7fa4515","page_slug":"supra-oracle-bonzo-lend-attack-vector","prev_score":12,"reason":"The page's core narrative — a zeroed-BLS-signature flaw in Supra's oracle verifier, the selective 11-chain patch rollout that left Hedera exposed, the attack mechanics and timestamps, the financial and TVL impact, and the audit/bug-bounty scoping gap — is well supported by the cited primary and secondary sources, and I was able to independently confirm nearly all of it by fetching the official Bonzo incident report, Rekt News, Protos, CoinDesk, and the Solido/Analytics Insight report directly. Two defects stand out. First, the 'Oracle Dependency Transition on Hedera' section and its corresponding timeline entry assert that Bonzo 'migrated' from Chainlink to Supra in March 2024; the cited source doesn't mention this at all, and independent reporting instead indicates Bonzo launched using Supra (and Pyth) because Chainlink wasn't yet on Hedera, later adding Chainlink for some assets — the opposite direction of travel from what the page implies. Second, several quotation-marked statements attributed to CEO Joshua Tobkin could not be verified word-for-word in any source I could reach, including the section's own cited sources, which raises a sourcing-transparency concern even though no contradicting source was found. Minor unverifiable details remain around the exact founder roster (Jon Jones/Victor Ermolaev) and investor count (30), and two sources (Tracxn, CryptoRank) blocked automated fetching so could only be checked indirectly.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}