Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review · TraderTraitor / UNC4899
- Sequence
- #4
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457581629
- Off-chain at
- 2026-10-16T09:07:26.275Z
- Anchored at
- 2026-10-16T09:07:41.670Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- FF4LrpHAioos7234DBjbrCkoudqJWErmtyUjjq2jmL2p
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2138 chars)
{"actor":"reviewer","artifact_identity":"a890cf93445a322a85eebfb93cdded5f","decided_at":"2026-10-16T09:07:26.067Z","decision":"review","disputed_pct":0.3333,"findings_hash":"3y8KaUbABRHVtr2tnXtCWpR9hmD6WwPqZQKzQGLPv2UN","investigation_id":"24036015-c6dd-4ee3-8c4b-5adc4f09d7fd","mode":"findings_only","new_score":0,"page_content_hash":"129098b0564ce495381dda0ff224c01d3903054463ce4e3ea92f7ee86fdb09d9","page_slug":"tradertraitor-unc4899","prev_score":0,"reason":"The page is substantially well-sourced: its core attribution claims (AA22-108A, the Bybit and DMM Bitcoin theft attributions, the JumpCloud/UNC4899 compromise, the WazirX and KelpDAO incidents, the Chainalysis and TRM Labs aggregate figures, the Roman Storm conviction, and the Knoot/Fortune IT-worker reporting) all check out against primary or credible secondary sources that were fetched directly. However, the review surfaced a cluster of real defects: the Ronin Network theft is both misdated (the summary says April 2022; the correct date, which the page's own timeline and another section get right, is March 2022) and under-stated by $5 million across four separate occurrences on the page (the page says $620 million; its own cited CoinDesk source, and the broader contemporaneous record, say $625 million). The page also cites a DOJ initiative, 'Operation DPRK Reload,' that does not appear to exist under that name — the real program is the 'DPRK RevGen: Domestic Enabler Initiative' — and asserts a specific '28 separate deposits into Tornado Cash' detail for the Bybit laundering trail that is not supported by either of its two cited sources (one of which actually says mixers were largely bypassed given the theft's scale). Two further items (the UNC4736/Drift Protocol attribution and the March 2026 UNC4899 cloud breach) are accurately described in substance but stated with more certainty than their own sources claim, which were explicitly hedged as 'medium-high confidence' and 'moderate confidence' respectively.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}