Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
- Sequence
- #4
- Score
- 4 → 4 (0)
- Cluster
- mainnet-beta
- Slot
- 457504941
- Off-chain at
- 2026-10-16T04:32:04.914Z
- Anchored at
- 2026-10-16T04:32:07.634Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 3uXZJbZ75vv1jEZPvikPsztQtg9P5FCQNfxcbmet6iev
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1825 chars)
{"actor":"reviewer","artifact_identity":"d6d5a1e4cc8a7ecd43c06ad24fc8a9d8","decided_at":"2026-10-16T04:32:04.677Z","decision":"review","disputed_pct":0,"findings_hash":"BqgULs1zJt1repVtxUtV9qehkRjgBw2dvHgv4nVBk8Uv","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","mode":"findings_only","new_score":4,"page_content_hash":"f66a9927caab24bf37b52d386a68da89123b98e947f3e4e37a72fc32ce741149","page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"This page is unusually well supported: nearly every checked claim — the CVE/CVSS details, the five affected wallet apps and their patch states, the entropy-collapse math, the exploitation wave dates and dollar figures (May 27 sweep, May 30-July 13 second wave, the $2.18M Tron USDT loss, the 2,114-address count, the $12.56M 2022 peak, the ferrumnet/bip39 propagation vector, the Chinese-mnemonic July 20-21 drains, and the Randstorm comparison) — was independently corroborated against the cited primary and secondary sources, often to the exact dollar and date. The one defect found is not a factual error but a citation-attribution problem: the SlowMist-monitoring claim is true, but the source cited for it (Cryptonomist, in both the section's inline sources and the matching timeline entry) does not mention SlowMist and instead names different firms (CertiK, PeckShield); the actual supporting article (TechTimes) is in the page's sources_used list but not cited for this specific claim. No accepted community submissions exist to cross-check. Coverage gaps include the absence of law-enforcement/attribution angles and direct primary-source links (GHSA/NVD) for the CVE details.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}