Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
- Sequence
- #4
- Score
- 62 → 62 (0)
- Cluster
- mainnet-beta
- Slot
- 459459814
- Off-chain at
- 2026-10-21T02:19:02.817Z
- Anchored at
- 2026-10-21T02:19:06.701Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 2PUtXTjhREkKA83Y4d3ieR6wXgo8Jot7wmw9kwMdVpRX
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2131 chars)
{"actor":"reviewer","artifact_identity":"dbce8e9f842ef10017326eb1acc7bf13","decided_at":"2026-10-21T02:19:02.622Z","decision":"review","disputed_pct":0.0455,"findings_hash":"2wNMzQ3pctVSEtqzqCeZd86KSGFh6tDu98v8ZipPJD5o","investigation_id":"7fcf4c4e-798e-4496-9187-53a8ab811cf1","mode":"findings_only","new_score":62,"page_content_hash":"a38737691bb2f822ef52a1e6001f2fa085e4315626b02c42773a3abb05eba0b5","page_slug":"injective-npm-sdk-supply-chain-attack","prev_score":62,"reason":"The page's core narrative is well supported: a compromised maintainer GitHub account ('thomasRalee') pushed a wallet-key-stealing payload disguised as telemetry into @injectivelabs/sdk-ts on July 8, 2026, which propagated to 18 pinned npm packages for roughly a 49-minute window before being reverted and replaced with a clean 1.20.23 release. Every checked timestamp, function name, exfiltration mechanism, download figure (50,000 weekly / 310 malicious downloads / 87 dependents / 112,000 cumulative weekly downloads), and the CEO's 'no funds at risk' quote matches StepSecurity's primary technical reconstruction and is corroborated by The Hacker News, BleepingComputer, Socket, Sourcetrail and CryptoBriefing, and a live npm registry query independently confirmed the deprecation of 1.20.21 and existence of 1.20.23. One factual error was found: the page states the compromised version was downloaded 'before removal,' but the package was only deprecated (flagged with a warning), never removed from the registry — multiple sources and a live registry check confirm it remains listed today. One attribution overstatement was found: the two-second exfiltration-batching detail is attributed to 'Bleeping Computer and Socket' but Socket's own article does not mention it and BleepingComputer sources it to StepSecurity. No accepted community submissions existed to review. The page is missing discussion of the account-compromise root cause and lacks any primary-source citation from Injective Labs itself.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}