Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
- Sequence
- #4
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457930382
- Off-chain at
- 2026-10-17T06:04:29.547Z
- Anchored at
- 2026-10-17T06:04:35.583Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 5mXNx8i4YNZ1JXzazoHYwHUuvytEx2hqDsyvw6HXLVRC
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2265 chars)
{"actor":"reviewer","artifact_identity":"38a00dce456cc43d358bfa808402111f","decided_at":"2026-10-17T06:04:29.362Z","decision":"review","disputed_pct":0.28,"findings_hash":"CSafpdaAcr473tag1CQWEd7A8P4khGv2oMEuTuwPqPNN","investigation_id":"5fa545d1-320b-4b85-9850-7ff1ca773a30","mode":"findings_only","new_score":0,"page_content_hash":"f5e1c1064be35c8c5bd2d705736b4a173157e704677793c7cdb50f44ef98df86","page_slug":"jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys","prev_score":0,"reason":"The page is well-sourced against its two primary Sysdig blog posts and a wide set of credible secondary security-press coverage; the large majority of technical claims (CVE details, payload counts, encryption mechanics, ENCFORGE binary specifics, IOCs, and the broader Anthropic/PromptLock context) were independently verified and confirmed accurate, including several highly specific figures (SHA-256 hashes, UTC timestamps, 361 GreyNoise IPs with country list) that checked out exactly. Two clusters of defects were found: (1) a one-day factual error in the Langflow 1.3.0 patch date, appearing in both prose and the timeline's date field; and (2) a figure-misattribution where a 7,000-exposed-servers statistic — actually describing two unrelated, later Langflow CVEs from a linked VentureBeat article — is incorrectly presented as something 'the Sysdig report itself cited' about CVE-2025-3248, again duplicated in both a section and the timeline. A further unresolved issue is that Sysdig's own two posts are internally inconsistent about whether the initial report published on July 1 or July 3, 2026, which undermines the page's confident framing of the ENCFORGE return date; and the page's precise 'late June 2026' attack date is not supported by the cited primary source, which discloses no intrusion date at all. No accepted community submissions existed to review. Coverage gaps include the omission of Sysdig's own on-chain detail about the ransom Bitcoin address's transaction history, and a possible separate Microsoft-reported Azure-focused JadePuffer incident that the page does not address.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}