Audit log

Every state-changing event for Zabu Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 17:49:51Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,768,931

   sig

   52uadWNmA1DZ…TtCNnGuecopyexplorer ↗

   hash

   ESj6Ji1tWy5T…C7QysZWBcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6322 B) ▸

   {"actor":"system:backfill","investigation_id":"165277a4-bd68-46b8-92c0-11ffcadf8ec3","kind":"publish","page_slug":"zabu-finance","published_at":"2026-05-28T17:49:51.101Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Zabu Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://slowmist.medium.com/brief-analysis-of-zabu-finance-being-hacked-44243919ea29","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-zabu-finance-hack-september-2021","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-zabu-finance-hack-september-2021","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/polyyeldfinancexyeldexploit.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/avalanche-based-zabu-finance-loses-3-2m-to-defi-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/hackfraudscam/zabufinancestakingcalculationbug.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/zabu-finance","type":"other","url":""},{"credibility":3,"name":"https://www.coinbase.com/price/zabu-finance","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""}]}],"sources_used":[{"credibility":1,"name":"Avalanche-Based Zabu Finance Exploited in $3.2M Hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack"},{"credibility":2,"name":"Brief Analysis of Zabu Finance Being Hacked — SlowMist","type":"research","url":"https://slowmist.medium.com/brief-analysis-of-zabu-finance-being-hacked-44243919ea29"},{"credibility":2,"name":"Explained: The Zabu Finance Hack (September 2021) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-zabu-finance-hack-september-2021"},{"credibility":2,"name":"Zabu Finance Exploited on Avalanche For $3.2M — BeInCrypto","type":"news_article","url":"https://beincrypto.com/zabu-finance-exploited-on-avalanche-3-2m/"},{"credibility":2,"name":"Knowsec Blockchain Lab Zabu Finance Flash Loan Analysis — Medium","type":"research","url":"https://medium.com/@Knownsec_Blockchain_Lab/knowsec-blockchain-lab-zabu-finance-flash-loan-security-incident-analysis-5fe10e7f4849"},{"credibility":3,"name":"Sep 2021 Zabu Finance Staking Calculation Bug — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/zabufinancestakingcalculationbug.php"},{"credibility":2,"name":"Avalanche-based Zabu Finance loses $3.2M to DeFi exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/avalanche-based-zabu-finance-loses-3-2m-to-defi-exploit/"},{"credibility":2,"name":"Zabu Finance — DefiLlama Protocol Page","type":"on_chain","url":"https://defillama.com/protocol/zabu-finance"},{"credibility":3,"name":"Jul 2021 PolyYeld Finance xYeld Exploit — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/casestudy/polyyeldfinancexyeldexploit.php"}],"summary":"Zabu Finance was an Avalanche-based yield farming protocol that suffered a $3.2 million flash loan exploit on September 12, 2021, marking what was widely described as the first major DeFi hack on the Avalanche blockchain. The vulnerability — a known deflationary token accounting flaw that had already been exploited on Polygon two months prior — drained the protocol's SPORE staking pool and caused the ZABU token to collapse from approximately $0.004 to near-zero. The protocol attempted a v2 token relaunch but has since gone effectively dormant, with a TVL of approximately $5,000 and a website SSL certificate that expired in August 2022.","timeline":[{"date":"2021-07-01","event":"PolyYeld Finance on Polygon is exploited using the identical deflationary-token accounting flaw; YELD token crashes to zero. The vulnerability is publicly documented but no widespread industry remediation follows.","source":""},{"date":"2021-09-12","event":"Zabu Finance is exploited on Avalanche via flash loan attack targeting SPORE pool's deflationary token accounting flaw. Attacker mints approximately 4.5 billion ZABU tokens and dumps them on Pangolin and Trader Joe DEXes, stealing approximately $3.2 million. ZABU price collapses ~99.5%.","source":""},{"date":"2021-09-13","event":"Zabu Finance team sets all farm rewards to zero and announces a snapshot-based v2 token recovery plan. PeckShield publicly states the bug 'happened many times before.' SlowMist and Knownsec publish technical analyses of the exploit.","source":""},{"date":"2021-09-13","event":"Zabu Finance burns approximately 93.12 million ZABU tokens (valued at ~$360,000 at time of burn) as part of recovery efforts.","source":""},{"date":"2022-08-22","event":"Zabu Finance website SSL certificate expires and is not renewed, indicating active development and maintenance has ceased.","source":""},{"date":"2026-05-01","event":"DefiLlama records Zabu Finance TVL at approximately $5,147. ZABU token is delisted from major exchanges. Protocol is effectively dormant.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b71528d1-76a6-412f-893f-a850e2904442copy
2. #2reviewby reviewerreviewer

   2026-06-15 19:50:05Z
   Score: 18 → 18 (no score change)
   The page's core factual claims about the September 12, 2021 exploit — amount, mechanism, DEXes involved, and 'first Avalanche DeFi hack' characterization — are well-supported by multiple credible sources. Two claims are unverifiable (specific SSL expiry date) and three are partially supported due to a digit transposition in the token burn figure (93.12 vs 93.21 million) and an incorrect date for the PolyYeld exploit (July 1 stated vs July 28 confirmed). No claims are directly disputed by more credible sources. A significant structural issue is that all six section content fields are empty, and the Wikipedia ZachXBT citation has no apparent connection to Zabu Finance. The current trust score of 18 (CRITICAL) is a known miscalibration — the entity suffered a hack rather than committing fraud, placing it in the CAUTIONARY band.
   anchoranchored

   chain

   ●mainnet-betaslot 426,700,979

   sig

   4wSPhi6nGqyj…eRbd58Bicopyexplorer ↗

   hash

   GPiddwpJ4tSo…MaZLq9HMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1184 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-15T19:50:04.967Z","decision":"review","investigation_id":"165277a4-bd68-46b8-92c0-11ffcadf8ec3","new_score":18,"page_slug":"zabu-finance","prev_score":18,"reason":"The page's core factual claims about the September 12, 2021 exploit — amount, mechanism, DEXes involved, and 'first Avalanche DeFi hack' characterization — are well-supported by multiple credible sources. Two claims are unverifiable (specific SSL expiry date) and three are partially supported due to a digit transposition in the token burn figure (93.12 vs 93.21 million) and an incorrect date for the PolyYeld exploit (July 1 stated vs July 28 confirmed). No claims are directly disputed by more credible sources. A significant structural issue is that all six section content fields are empty, and the Wikipedia ZachXBT citation has no apparent connection to Zabu Finance. The current trust score of 18 (CRITICAL) is a known miscalibration — the entity suffered a hack rather than committing fraud, placing it in the CAUTIONARY band.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 86605d05-5bfa-49be-a580-4d84b5358336copy
3. #3review approveby judgejudge

   2026-06-15 19:50:05Z
   Score: 18 → 52 (+34)
   Zero of 19 claims were disputed by a more credible source. The two unverifiable claims (specific SSL expiry date in claim_findings[8] and claim_findings[15]) relate to a minor operational detail that does not affect the core incident record. Three partially-supported claims involve a digit transposition in a token burn figure (claim_findings[14]) and a timeline date offset of 27 days for the PolyYeld precedent event (claim_findings[9]) — neither materially misrepresents the incident. The page's core factual record — the $3.2M flash loan exploit, its mechanism, date, DEXes involved, and the 'first Avalanche DeFi hack' characterization — is confirmed by Tier 1 and Tier 2 sources including CoinDesk, Halborn, and SlowMist. High-priority coverage gaps (empty section content fields, misplaced ZachXBT citation) indicate structural authoring issues that warrant future revision but do not undermine the accuracy of the published claims. The current trust score of 18 (CRITICAL) is a miscalibration: all incidents are classified as suffered (type b), which caps at CAUTIONARY under the scoring rubric, and the reviewer's recommended score of 52 is consistent with the evidence.
   anchoranchored

   chain

   ●mainnet-betaslot 426,700,984

   sig

   2L4WzeBHyV2s…4JFbzhSpcopyexplorer ↗

   hash

   BJhzW1or5ePL…UY5wpL3Ucopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1534 B) ▸

   {"actor":"judge","decided_at":"2026-06-15T19:50:04.967Z","decision":"review_approve","investigation_id":"165277a4-bd68-46b8-92c0-11ffcadf8ec3","new_score":52,"page_slug":"zabu-finance","prev_score":18,"reason":"Zero of 19 claims were disputed by a more credible source. The two unverifiable claims (specific SSL expiry date in claim_findings[8] and claim_findings[15]) relate to a minor operational detail that does not affect the core incident record. Three partially-supported claims involve a digit transposition in a token burn figure (claim_findings[14]) and a timeline date offset of 27 days for the PolyYeld precedent event (claim_findings[9]) — neither materially misrepresents the incident. The page's core factual record — the $3.2M flash loan exploit, its mechanism, date, DEXes involved, and the 'first Avalanche DeFi hack' characterization — is confirmed by Tier 1 and Tier 2 sources including CoinDesk, Halborn, and SlowMist. High-priority coverage gaps (empty section content fields, misplaced ZachXBT citation) indicate structural authoring issues that warrant future revision but do not undermine the accuracy of the published claims. The current trust score of 18 (CRITICAL) is a miscalibration: all incidents are classified as suffered (type b), which caps at CAUTIONARY under the scoring rubric, and the reviewer's recommended score of 52 is consistent with the evidence.","score_delta":34,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6bb366ae-a80f-4a29-ae93-38eb530a99accopy
4. #4rescoreby systemsystem

   2026-10-10 18:49:55Z
   Score: 52 → 50 (-2)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +8; no longer operating, so capped at 50; fact-check adjustments (+34) now shown as page reliability, not in the score.
   anchoranchored

   chain

   ●mainnet-betaslot 455,370,087

   sig

   5aWR67MaDYTj…7SKjNypQcopyexplorer ↗

   hash

   DEjXDcYnWHNH…DGbB9NQFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (759 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:55.808Z","decision":"rescore","investigation_id":"165277a4-bd68-46b8-92c0-11ffcadf8ec3","new_score":50,"page_slug":"zabu-finance","prev_score":52,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +8; no longer operating, so capped at 50; fact-check adjustments (+34) now shown as page reliability, not in the score.","score_delta":-2,"score_model":"v2","sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ddde6341-f691-4407-8fc8-a01913eda68acopy
5. #5reviewby reviewerreviewer

   2026-10-16 23:44:21Z
   Score: 50 → 50 (no score change)
   The core incident narrative — date, dollar amount, attack mechanism (fee-on-transfer SPORE token accounting flaw), the PolyYeld precedent, and the team's snapshot/v2 recovery plan — holds up well against Halborn, CoinDesk, and Quadriga Initiative's technical writeups. Two clear defects were found: the 'ZachXBT flag' section asserts a specific, unsupported fact (that ZachXBT flagged this project) citing only a Wikipedia article that never mentions Zabu Finance, and no independent corroboration could be found; and the token-price-collapse section attributes a quote and a 25% recovery figure to 'Cointelegraph,' when the 25% figure actually traces to AMBCrypto (which the section does cite) and Cointelegraph is not cited anywhere on the page. Several other claims (SSL certificate expiry, current DefiLlama TVL, Coinbase/Binance delisting, exact burn valuation) could not be independently confirmed because the relevant live pages returned 403s and web.archive.org was not reachable from this environment; these are marked unverifiable rather than disputed. The page has no on-chain fund-tracing or law-enforcement-response coverage, which would strengthen a hack-focused investigation.
   anchoranchored

   chain

   ●mainnet-betaslot 457,825,073

   sig

   3iip2yEjKxAM…2Weu1YVrcopyexplorer ↗

   hash

   DXp6Q6qZe8Bq…sT8bGo2Tcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1786 B) ▸

   {"actor":"reviewer","artifact_identity":"21bc5dbecda6c571fe3f03f2ba5e5932","decided_at":"2026-10-16T23:44:21.181Z","decision":"review","disputed_pct":0.5,"findings_hash":"BR4ovtmrjEUPGUDotcsL1xJGpKvH4SY2tq4cmLyjXdWw","investigation_id":"165277a4-bd68-46b8-92c0-11ffcadf8ec3","mode":"findings_only","new_score":50,"page_content_hash":"63912d75e7e516840b6628bcecde93e2960957cb16b8dcd6242b68c01400b994","page_slug":"zabu-finance","prev_score":50,"reason":"The core incident narrative — date, dollar amount, attack mechanism (fee-on-transfer SPORE token accounting flaw), the PolyYeld precedent, and the team's snapshot/v2 recovery plan — holds up well against Halborn, CoinDesk, and Quadriga Initiative's technical writeups. Two clear defects were found: the 'ZachXBT flag' section asserts a specific, unsupported fact (that ZachXBT flagged this project) citing only a Wikipedia article that never mentions Zabu Finance, and no independent corroboration could be found; and the token-price-collapse section attributes a quote and a 25% recovery figure to 'Cointelegraph,' when the 25% figure actually traces to AMBCrypto (which the section does cite) and Cointelegraph is not cited anywhere on the page. Several other claims (SSL certificate expiry, current DefiLlama TVL, Coinbase/Binance delisting, exact burn valuation) could not be independently confirmed because the relevant live pages returned 403s and web.archive.org was not reachable from this environment; these are marked unverifiable rather than disputed. The page has no on-chain fund-tracing or law-enforcement-response coverage, which would strengthen a hack-focused investigation.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6de4a7c9-dcde-4faa-81e6-046afa0ed81dcopy