Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
- Sequence
- #5
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 464263453
- Off-chain at
- 2026-11-01T22:40:25.464Z
- Anchored at
- 2026-11-01T22:40:34.000Z
- Block time
- 2026-11-01T22:40:34.000Z
Independent verification
- 1. Database (off-chain)
- 9cS4vaxhNZtJ4SjnVLPWNMLALXzjkGoWifvZDz3okHrM
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1408 chars)
{"actor":"reviewer","artifact_identity":"543006dbd5aba276e103bb6463b06282","decided_at":"2026-11-01T22:40:25.345Z","decision":"review","disputed_pct":0.3,"findings_hash":"CBNUs351XTZ8Pb38WWF2qhdbMNRmWAqqz6ZdMBFk7wiK","investigation_id":"e46c6ad3-be50-48db-a6a5-50ede5b6a7ef","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"omissions":{"material":2,"total":3},"page_content_hash":"dfc489edf997087fa039bf7b29401ef62e8a76132981667c2a77fa53bec54b75","page_slug":"mastra-ai-npm-supply-chain-attack-june-2026","prev_score":0,"reason":"Core technical facts (timeline, package counts, account takeover, payload, response) match StepSecurity, Snyk, Microsoft and Mastra's official issue. The main defect is stale attribution: Microsoft assessed with high confidence on June 19, 2026 that the attack is Sapphire Sleet activity, yet the page says attribution is unconfirmed and that no threat-intelligence firm has attributed it. One timing claim (26 minutes) contradicts the page's own 01:01 and 01:12 UTC times. Some IOC directory paths differ from Microsoft's report.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}