Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review · JADEPUFFER
- Sequence
- #4
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457747099
- Off-chain at
- 2026-10-16T19:03:38.881Z
- Anchored at
- 2026-10-16T19:03:46.301Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 6QRtMxraP6ZuVH1xZR5Ta2cx7ZqNxtzEkJGixkMEgXUM
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1870 chars)
{"actor":"reviewer","artifact_identity":"f777d355cfe3ed3dd35496f953c9d669","decided_at":"2026-10-16T19:03:38.060Z","decision":"review","disputed_pct":0.3889,"findings_hash":"3yxRqVHoy46Gc7RPZc4fqS6rjdFZcZtaMSzZavFxnXwn","investigation_id":"5ff2d8a2-70bd-433c-84c9-c3bbd2752ac5","mode":"findings_only","new_score":0,"page_content_hash":"c5e850dd6cf8359226a782c9ed79516e7f3e9502a8f7d77eee5341babc3e830b","page_slug":"jadepuffer","prev_score":0,"reason":"The page's core technical narrative is well supported: independent fetches of Sysdig's two original blog posts, CISA's KEV alerts, and several secondary outlets (Security Affairs, CSA Labs, TechTimes, Action1) confirm the CVE details, file hashes, C2 infrastructure, the 1,342 encrypted Nacos records, the Bitcoin address's transaction history, and the ENCFORGE container-escape timing down to the exact figures cited. The significant problems are dating errors clustered around two events: the first Sysdig disclosure is dated July 1, 2026 in the primary source but the page states 'approximately July 2-3, 2026' in three places (and gives two different wrong dates across two timeline entries for what appears to be the same event), and the second Sysdig disclosure (ENCFORGE) is dated July 20, 2026 in the primary source but July 21 on the page. More substantively, the page's claim that the August 2026 KEV addition of CVE-2026-9198 was 'the first time CISA had listed an AI agent platform vulnerability' is contradicted by a source the page itself cites, which attributes that distinction to a third, unmentioned Langflow CVE (CVE-2026-55255) added a month earlier. That CVE is never discussed anywhere on the page, which is both a correctness problem and a coverage gap.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}