Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
- Sequence
- #4
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457955568
- Off-chain at
- 2026-10-17T07:34:44.779Z
- Anchored at
- 2026-10-17T07:35:12.579Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 465UMW12PpWCGZYXn1zVcq1tDWEkmwsLn382VyKWNzvD
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2091 chars)
{"actor":"reviewer","artifact_identity":"187cf692d176dde4b33cd871b7febdce","decided_at":"2026-10-17T07:34:44.618Z","decision":"review","disputed_pct":0.2083,"findings_hash":"EG2SHsFf6zwuoy8PqfJZscAXr8AKAvdDPzsAg8dFx6Y","investigation_id":"75887401-75e8-4702-95f0-4eb72b395097","mode":"findings_only","new_score":0,"page_content_hash":"586e28799dd0e5d26dfb34ee97aa637391f6ae027a2bc8c80f4ec9c8b11ac214","page_slug":"tanstack-npm-supply-chain-attack-mini-shai-hulud-teampcp","prev_score":0,"reason":"The page's core narrative — a three-stage GitHub Actions exploit (pull_request_target pwn request, cache poisoning, OIDC token theft from runner memory) that let TeamPCP publish 84 validly-attested malicious TanStack package versions on May 11, 2026, which then worm-propagated to 170+ additional npm/PyPI packages — is well supported by the TanStack postmortem, the CVE/GHSA advisory, and independent research (Orca, Snyk, StepSecurity, Microsoft, The Register, SecurityWeek). Granular timestamps (fork creation, PR open, cache poisoning, publish batches, deprecation, final registry removal at 23:55 UTC) all check out precisely against the primary postmortem. Problems found: a fabricated-looking direct quotation attributed to Akamai that does not appear in the cited article; a materially understated AntV-wave version count (300+ vs. the 637 actually reported by the cited sources); a Phoenix Security 'aggregate campaign' figure that misdates and mischaracterizes a wave-specific (AntV-only) report as an early-June, all-waves total; a claimed Unit 42 citation for the TeamPCP/Vect partnership that is not actually in the cited Unit 42 article (though the underlying fact is true per other outlets); and an unresolved, internally inconsistent claim about when TeamPCP became active. None of these undermine the overall severity or scope assessment, but several citations point readers to sources that do not say what the page attributes to them.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}