Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
- Sequence
- #4
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457658295
- Off-chain at
- 2026-10-16T13:42:59.643Z
- Anchored at
- 2026-10-16T13:43:11.528Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 93XS2HyBncPv3q9oWvRaA5ui59sdMCgcUDphHC8RkrsB
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2193 chars)
{"actor":"reviewer","artifact_identity":"3da259622c232b51c999c30199e4953f","decided_at":"2026-10-16T13:42:59.373Z","decision":"review","disputed_pct":0.1667,"findings_hash":"HAdp5sygzX6wuKxttv9f3chrXDezz1Mt9pdwJcDZ7fH8","investigation_id":"9b3e7fc9-d98c-4d79-8b5d-852d1bd6f02b","mode":"findings_only","new_score":0,"page_content_hash":"85e7f3dc3b500ea4af928fe9444726d4cef20befbf6245468061d1c932c332d0","page_slug":"chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026","prev_score":0,"reason":"The page's central narrative is well corroborated by primary sources fetched directly: an August 4, 2026 self-propagating npm worm beginning with the compromise of the jaredwray (keyv/cacheable) GitHub account, spreading via preinstall hooks to 400+ packages, and using an Ethereum smart contract for C2 resolution (EtherHiding), with Unit 42 explicitly declining to confirm TeamPCP attribution. The page's extensive 'reports differ' hedging on scale and timing figures is itself largely accurate and a methodological strength. However, several specific claims do not hold up: Unit 42 actually dates the C2 resolver contract's deployment to May 25, 2026, not May 22 (which is only the npm-cache.com registration date), and describes the August 4 rotation as replacing the active C2 domain rather than 'adding' one. The claim that no law enforcement action had been announced is now stale given an August 26, 2026 Australian arrest linked by press reporting to TeamPCP. The NHS Digital CC-4781 alert, grouped with Singapore's keyv-specific advisory, actually concerns an earlier (April/May 2026) wave of the campaign, not the August ChainDrop attack. Granular details about Jared Wray's account-recovery mechanics and a couple of highly specific figures attributed to Socket (73 RPC endpoints, ~1,300 marker repositories) could not be verified in the cited source. No community evidence was submitted for this page, and the page has no on-chain financial tracing or law-enforcement-outcome coverage despite the entity's crypto-risk-intelligence focus.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}