Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review_approve · CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)
- Sequence
- #7
- Score
- 3 → 3 (0)
- Cluster
- mainnet-beta
- Slot
- 463281140
- Off-chain at
- 2026-10-30T12:13:59.840Z
- Anchored at
- 2026-10-30T12:14:02.000Z
- Block time
- 2026-10-30T12:14:02.000Z
Independent verification
- 1. Database (off-chain)
- 9pPXvGz2CsBHWAzAHStvCr2Sb2gr4S1WpRJKv2rexWH4
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1488 chars)
{"actor":"judge","artifact_identity":"faad91f08feb447772954a8919bdc177","band_override":null,"decided_at":"2026-10-30T12:13:59.443Z","decision":"review_approve","delist_requested":false,"disputed_pct":0.0769,"investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":3,"reason":"Of 12 claims checked, none were disputed and 1 could not be verified (claim_findings[11], that new vulnerable wallets were still being created in 2026, which none of the fetched sources state), giving about 8% disputed or unverifiable. The core figures hold up against The Hacker News, CVEReports and illbloom.org: the $5.69M lower bound, 2,114 addresses, the May 27 and second-wave drains, and the five wallets with their patch status. The one real discrepancy is the crypto-js 4.0.0 release date (claim_findings[3] and [4]): the page says May 2020 and credits The Hacker News, which says February 2020, while CVEReports says May 1, 2020. The only omission found is minor (the Unlukey checker launch), the subject status does not contradict the page, and no high-priority coverage gap is open.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":7,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}