Verify a decision

{"actor":"reviewer","decided_at":"2026-06-14T23:16:19.307Z","decision":"review","investigation_id":"ae4c060a-cd45-41d5-8a93-fd8e8e6ac8d9","new_score":42,"page_slug":"layerzero-protocol","prev_score":42,"reason":"Blue-chip calibration review (Prompt A). Verdict: over-penalized. Page content is treated as accurate; the trust_score band is miscalibrated. LayerZero Protocol is a legitimate, institutionally-backed cross-chain messaging infrastructure operator (Sequoia, a16z, Citadel Securities, DTCC collaboration) that suffered the $292M KelpDAO exploit in April 2026 due to a combination of Lazarus Group/TraderTraitor social engineering of its infrastructure and its own acknowledged negligence in permitting a 1-of-1 DVN configuration for high-value assets. The entity is not fraudulent: it issued a public apology admitting the mistake, upgraded security defaults to 5-of-5 DVN, published a formal incident report co-authored with Mandiant and CrowdStrike attribution, and remains operationally active with significant institutional partnerships including the Zero blockchain initiative with DTCC and ICE. The current score of 42 (WARNING band) over-penalizes by treating a hack-victim-plus-negligence scenario as equivalent to elevated fraud risk. Under the band semantics, WARNING (20-49) is reserved for 'unresolved severe incident' — the incident is ongoing in its reputational consequences but is substantively resolved operationally (fixes deployed, report published, apology issued). The airdrop controversy (proof-of-donation mechanics) was a community relations misstep, not misconduct. A score of 55 in CAUTIONARY is appropriate: the protocol is legitimate with a material caveat — significant post-exploit client exodus, demonstrated single-point-of-failure in its off-chain infrastructure model, and ZRO token approximately 89% below its December 2024 peak. Minor factual inaccuracies on the page (ATH stated as $7.47 vs. actual $7.53; ZRO ATL stated as $1.10 May 29 vs. actual ~$0.80 June 2026; 1-of-1 DVN described as 'social engineering' root cause when the formal report clarifies it was a combined RPC poisoning + social engineering attack) do not change the overall entity characterization.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}