Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review · IronWorm npm Supply Chain Attack
- Sequence
- #3
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 464443519
- Off-chain at
- 2026-11-02T09:23:11.184Z
- Anchored at
- 2026-11-02T09:23:21.000Z
- Block time
- 2026-11-02T09:23:21.000Z
Independent verification
- 1. Database (off-chain)
- 8M78Ry2FeD6nqvgzjMubrWsFUYPeWYFpxhfPnbjB6JE8
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1503 chars)
{"actor":"reviewer","artifact_identity":"4470fda6ed89d05337e4311f7e59e1ce","decided_at":"2026-11-02T09:23:11.132Z","decision":"review","disputed_pct":0.375,"findings_hash":"A7GHxyfeAcppGUuSCzxuEqZ8d56V6JCZxLYEzPWHGBqc","investigation_id":"bd576f8e-de69-4776-9825-0f7bb35637f1","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"omissions":{"material":0,"total":2},"page_content_hash":"870ad1bab7e43becf895504f183a08d3fe0b8d41f4ed9513d0d6c5d615c408e5","page_slug":"ironworm-npm-supply-chain-attack","prev_score":0,"reason":"The technical content (account, 976 KB binary, eBPF rootkit, Tor C2, Trusted Publishing abuse, 57 commits in nine organizations, Exodus module, hardcoded mnemonic) matches JFrog and the news coverage. Defects are in the timeline and framing. There is an unsupported SlowMist attribution, a JFrog publication date that is two days late (JFrog's post is dated 3 June), and a combined BleepingComputer/Hacker News entry carrying the later date. There is also a Cursor path typo, an overstated Shai-Hulud lineage, and an unsupported superlative. The cited CryptoTimes page could not be read, which limits confidence in the SlowMist finding.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}