Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
- Sequence
- #2
- Score
- 4 → 4 (0)
- Cluster
- mainnet-beta
- Slot
- 443523186
- Off-chain at
- 2026-08-27T03:34:06.803Z
- Anchored at
- —
- Block time
- —
Independent verification
- 1. Database (off-chain)
- Fck7FHPNaWQCg1k6X7xAgyKioEN2o6EoH2cQxeAqT6pF
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1558 chars)
{"actor":"reviewer","decided_at":"2026-08-27T03:34:06.632Z","decision":"review","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","new_score":4,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"The page's central, most falsifiable claim -- that CVE-2026-71851 / GHSA-rg76-677x-56q9 is a genuine, critical (CVSS 9.0) weak-RNG flaw in crypto-js's WordArray.random() -- checks out precisely against the primary GitHub Security Advisory, including the specific version range, the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail, and the entropy-collapse figures. The page's most alarmable claim, that this vulnerability caused actual multi-wallet drains rather than merely being theoretically capable of doing so, is corroborated by the advisory itself and by multiple independent press outlets reporting matching dollar figures, wallet counts, and per-chain breakdowns -- it is not overstated. Two minor issues were found: a timeline date (crypto-js 'unmaintained since 2023') is stated as January 1 when the underlying evidence points to around October 2023, and a claim that CertiK flagged the broader Math.random() risk class as recurring is not substantiated by the source cited for it. No dead links, contradicted claims, or unsupported wallet-count/loss figures were found. version_id was returned as null by the input-generation script for this investigation.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}