Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review_revise · Supra Oracle — Bonzo Lend Attack Vector
- Sequence
- #3
- Score
- 22 → 12 (-10)
- Cluster
- mainnet-beta
- Slot
- 443516948
- Off-chain at
- 2026-08-25T19:40:31.053Z
- Anchored at
- —
- Block time
- —
Independent verification
- 1. Database (off-chain)
- AubKCWPFdHjdtrKYR1s6mW9NzwzW9teEL9Nqbk1CG6yH
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2077 chars)
{"actor":"judge","decided_at":"2026-08-25T19:40:30.860Z","decision":"review_revise","investigation_id":"c728ec71-a5d0-4641-9fd6-93840cd32777","new_score":12,"page_slug":"supra-oracle-bonzo-lend-attack-vector","prev_score":22,"reason":"The review examined 23 distinct claims (the summary block's stated total of 24 does not match the claim_findings array and was disregarded in favor of a direct count). Applying the reviewer's own formula -- disputed_pct = (disputed + unverifiable) / total -- yields 4/23, or about 17.4%, which places this page in the minor-issues band rather than the approve band the reviewer's summary implied. The page's core, highest-stakes claims hold up well: the finding that the exploit stemmed from a flaw in Supra's oracle verifier rather than any fault in Bonzo Lend's own contracts, the technical mechanism of the zeroed-signature bypass, the detailed attack timeline, and the pattern of patching 11 other chains before Hedera are all confirmed against Tier 1 or Tier 2 sources fetched directly (claim_findings[0], [1], [3], [6], [7]). The two disputed claims are both confined to a lower-stakes 'Entity Background' section describing Supra as a company -- its founding year and headquarters (claim_findings[19]) and its total funding and investor count (claim_findings[21]) -- where other public sources give materially different figures (2018/Berkeley vs. 2020/Miami; roughly $32 million vs. the $47.9 million cited). Two further claims are unverifiable rather than contradicted, including an internal inconsistency where the page describes the same $1 million from a second wallet as both 'recovered' and merely 'pledged to be returned' (claim_findings[10], [12]). No link rot or staleness was found on any critical citation, and none of the five coverage gaps identified were marked high priority, so the issues found call for correction rather than removal or a formal investigation status change.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}