Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
- Sequence
- #5
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457787237
- Off-chain at
- 2026-10-16T21:27:49.710Z
- Anchored at
- 2026-10-16T21:28:25.545Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- He2WPcWVvvJ9FEcYNAbzENa1TYBKpfP7ngNaeNR831d5
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1787 chars)
{"actor":"reviewer","artifact_identity":"12c72b65ab597ccfe78c1ff524cb587e","decided_at":"2026-10-16T21:27:49.521Z","decision":"review","disputed_pct":0.35,"findings_hash":"4nyLe5Pxu7eRtuHqmSJWwjheRFUNTUzSaWTCXW82SMzT","investigation_id":"c58c51ae-60d6-4f15-a903-2b8b38f90a55","mode":"findings_only","new_score":0,"page_content_hash":"9ec36471e9e9c7625bf317773103fa87e6b1c428467f0c41faa5ae616050c4e0","page_slug":"clickfix-bnb-chain-etherhiding-malware-campaign","prev_score":0,"reason":"The page's core technical narrative (EtherHiding mechanics, the ClickFix/TerminalFix lure variants, the CryptoBandits clipboard hijacker, the Sicuranext intrusion chain and its IoCs, the DPRK/UNC5342 GTIG attribution, and the Omnistealer/Huntress macOS findings) is well-supported by direct verification of primary and credible secondary sources. However, the page gets Microsoft's actual disclosure date wrong by one day in three places (summary, Campaign Overview section, timeline), attributes a quotation to Microsoft that none of the three fetched sources render as a direct quote, cites a dead Hacker News URL in three places for the '250+ ClickFix domains' story and also misdates that story by three days, and records a Wayback archive URL for a U.Today source that resolves to an unrelated article. There is also an internal inconsistency between the timeline's August 2023 date for ClearFake/EtherHiding's emergence and the page's own tier-1 Google GTIG source, which says September 2023. None of these are fabrications of the underlying facts, but they are the kind of date and citation drift that should be corrected before the page is finalized.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}