Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review_revise · ClickFix BNB Chain EtherHiding Malware Campaign
- Sequence
- #3
- Score
- 0 → 0 (-10)
- Cluster
- mainnet-beta
- Slot
- 443506394
- Off-chain at
- 2026-08-10T13:14:52.570Z
- Anchored at
- —
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 9gfDvhiR6skMXg9W2TGeCKhv8xC1njsiMH4HxxSqLmCv
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1731 chars)
{"actor":"judge","decided_at":"2026-08-10T13:14:52.354Z","decision":"review_revise","investigation_id":"c58c51ae-60d6-4f15-a903-2b8b38f90a55","new_score":0,"page_slug":"clickfix-bnb-chain-etherhiding-malware-campaign","prev_score":0,"reason":"The page's core reporting on the Microsoft-disclosed ClickFix/EtherHiding/BNB Chain campaign is strongly corroborated, with the reviewer disputing only 9% of claims and confirming the technical intrusion chain, IOCs, and detection details against primary sources (claim_findings[24], claim_findings[9], claim_findings[11]). However, two issues warrant revision rather than a clean pass. First, the page's summary and CryptoBandits section (claim_findings[1], claim_findings[18]) frame CryptoBandits as a payload delivered through this specific campaign's on-chain mechanism, but the review found no source establishing that link -- CryptoBandits is a separately disclosed malware family with a distinct .lnk/USB distribution method. This is flagged as a high-priority coverage gap (\"campaign relationship clarity\") because it overstates the connection in the page's most-read section. Second, the page twice misattributes EtherHiding's original 2023 documentation to \"Guardz\" when the cited primary source credits Guardio Labs (claim_findings[26], claim_findings[30]), and it mischaracterizes a macOS stealer's theft mechanism as clipboard interception rather than direct partial wallet draining (claim_findings[16]). These are correctable sourcing and attribution errors rather than fabrications, so the page is revised rather than denied.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}