Audit log

Every state-changing event for ZRX (0x Protocol): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-27 12:14:06Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   FzTofeiBRhzT…dwMAWGbjcopysha256 → base58

   verifying row…

   canonical bytes (20519 B) ▸

   {"actor":"system:backfill","investigation_id":"69488b83-ebdf-40f0-8308-e1d2007a0d7b","kind":"publish","page_slug":"zrx-0x-protocol","published_at":"2026-07-27T12:14:06.733Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ZRX (0x Protocol)","sections":[{"content":"0x Protocol was conceived in 2016 and formally launched in August 2017 by Will Warren (CEO) and Amir Bandeali (CTO). Warren holds a background in applied physics, mechanical engineering, and robotics, and previously contributed to projects including Basic Attention Token and Brave. Bandeali holds a BSc in Finance from the University of Illinois and worked in quantitative trading and financial software before co-founding 0x. The protocol was designed to allow off-chain order relay with on-chain settlement, enabling Ethereum-based token trading without reliance on centralized intermediaries. The governing corporate entity is ZeroEx, Inc., a Delaware company headquartered in California. Notable advisors at launch included Coinbase co-founder Fred Ehrsam, Augur co-founder Joey Krug, and Scalar Capital co-founder Linda Xie.","heading":"Background and Founding","severity":"low","sources":[{"credibility":2,"name":"OKX: What is ZRX (0x)?","type":"other","url":"https://www.okx.com/en-us/learn/what-is-zrx-0x"},{"credibility":2,"name":"Kraken: What is 0x (ZRX)?","type":"other","url":"https://www.kraken.com/learn/what-is-0x-zrx"}]},{"content":"In August 2017, ZeroEx, Inc. conducted a public token sale raising approximately $24 million in ETH in exchange for ZRX tokens. The total token supply is one billion ZRX, distributed as follows: 50% sold to the public in the ICO; 15% reserved for the 0x core development team; 15% allocated to an external project development fund; 10% allocated to the founding team under a four-year vesting schedule with a one-year cliff; and 10% reserved for early backers and advisors. The ICO distributed tokens across more than 13,000 distinct Ethereum addresses. Major venture investors included Polychain Capital, Pantera Capital, and Blockchain Capital. Token holders subsequently gained governance rights over 0x Improvement Proposals (ZEIPs).","heading":"Token Sale and Distribution","severity":"low","sources":[{"credibility":2,"name":"ICO Drops: 0x (ZRX) Token Sale Details","type":"other","url":"https://icodrops.com/0x/"},{"credibility":2,"name":"Gate Wiki: 0x Protocol (ZRX) Overview","type":"other","url":"https://www.gate.com/crypto-wiki/article/0x-protocol-zrx-overview-token-utility-and-price-prediction-for-2025-2030"},{"credibility":2,"name":"CotiNews: What is 0x (ZRX) Protocol?","type":"other","url":"https://www.coti.news/news/what-is-0x-zrx-protocol-everything-you-need-to-know"}]},{"content":"On September 7, 2023, the U.S. Commodity Futures Trading Commission (CFTC) issued a settlement order against ZeroEx, Inc. alongside two other DeFi protocol operators (Opyn, Inc. and Deridex, Inc.). The CFTC charged ZeroEx with unlawfully offering leveraged and margined retail commodity transactions in digital assets without being registered as a designated contract market, swap execution facility, or futures commission merchant. Specifically, the 0x Protocol and its Matcha front-end application facilitated trading of leveraged tokens that provided approximately 2:1 leveraged exposure to assets such as ether and bitcoin, which the CFTC classified as leveraged retail commodity transactions subject to the Commodity Exchange Act. ZeroEx neither admitted nor denied the allegations and agreed to pay a $200,000 civil monetary penalty. The CFTC acknowledged ZeroEx's substantial cooperation with the investigation as a mitigating factor that reduced the penalty. ZeroEx also agreed to cease and desist from further violations. This action is considered a landmark enforcement signal by regulators claiming jurisdiction over DeFi protocol developers, even when those developers do not directly operate the trading front-ends.","heading":"CFTC Regulatory Enforcement Action (2023)","severity":"high","sources":[{"credibility":1,"name":"CFTC Press Release 8774-23: Orders Against Operators of Three DeFi Protocols","type":"regulatory","url":"https://www.cftc.gov/PressRoom/PressReleases/8774-23"},{"credibility":2,"name":"CryptoSlate: CFTC settles charges against companies behind 0x (ZRX)","type":"news_article","url":"https://cryptoslate.com/cftc-settles-charges-against-companies-behind-0x-zrx-two-other-defi-protocols/"},{"credibility":1,"name":"CoinDesk: CFTC Goes After Opyn, Other DeFi Operations in Enforcement Sweep","type":"news_article","url":"https://www.coindesk.com/policy/2023/09/07/cftc-goes-after-opyn-other-defi-operations-in-enforcement-sweep"},{"credibility":1,"name":"Skadden: CFTC Charges DeFi Developers With Facilitating Off-Exchange Trading","type":"other","url":"https://www.skadden.com/insights/publications/2023/09/cftc-charges-defi-developers-with-facilitating-off-exchange-trading"},{"credibility":2,"name":"Blockworks: DeFi projects charged by CFTC over crypto derivatives","type":"news_article","url":"https://blockworks.co/news/defi-cftc-crypto-derivatives"}]},{"content":"On July 12, 2019, security researcher samczsun disclosed a critical vulnerability in the 0x v2.0 Exchange smart contract. The flaw resided in the signature verification routine: a flaw in an assembly-level implementation caused a signature value of 0x04 to be treated as valid for all non-smart-contract accounts, meaning an attacker could fill orders without a legitimate counterparty signature. Upon verification of the vulnerability, the 0x core team triggered an emergency shutdown mechanism built into the protocol's smart contract architecture, halting trading within hours of disclosure. Historical trade logs confirmed that the vulnerability had not been exploited prior to discovery. No user funds were lost. A patched version (0x v2.1) was deployed to Ethereum mainnet shortly thereafter. The incident is generally cited as an example of responsible disclosure and an effective emergency response, though it highlighted the inherent risks in complex smart contract systems. The ZRX token contract itself was not affected.","heading":"Security Incident: 0x v2.0 Smart Contract Vulnerability (2019)","severity":"medium","sources":[{"credibility":2,"name":"0x Core Team: Post-mortem — 0x v2.0 Exchange Vulnerability (Medium)","type":"official","url":"https://medium.com/@0xcoreteam/post-mortem-0x-v2-0-exchange-vulnerability-763015399578"},{"credibility":2,"name":"samczsun: The 0x vulnerability, explained","type":"research","url":"https://samczsun.com/the-0x-vulnerability-explained/"},{"credibility":2,"name":"CoinTelegraph: 0x DEX Protocol Suspended Because of Vulnerability, Funds Safe","type":"news_article","url":"https://cointelegraph.com/news/0x-dex-protocol-suspended-because-of-vulnerability-funds-safe"},{"credibility":2,"name":"BeInCrypto: 0x Team Stops Trading to Patch Critical Vulnerability","type":"news_article","url":"https://beincrypto.com/0x-team-stops-trading-to-patch-critical-vulnerability/"}]},{"content":"On January 25, 2026, approximately $13.4–13.5 million was drained from 20 Matcha Meta users via an exploit targeting a third-party integration called SwapNet. The SwapNet contract was closed-source and lacked sufficient validation of user-supplied parameters, allowing an attacker to redirect funds that users had previously approved for trading. The attack specifically affected users who had manually disabled Matcha Meta's default One-Time Approval security setting. The 0x core protocol contracts and the broader Matcha platform were not affected. The impacted SwapNet contract was disabled within hours of discovery. A post-incident analysis by Verichains security team attributed the exploit to an arbitrary-call vulnerability in SwapNet's closed-source smart contracts. The incident raises questions about due diligence standards for third-party integrations within DeFi aggregator platforms, though it is relevant to note the vulnerability was external to 0x's own audited codebase.","heading":"Security Incident: Matcha Meta SwapNet Exploit (January 2026)","severity":"high","sources":[{"credibility":1,"name":"The Block: Matcha Meta users hit in $13.4 million SwapNet contract exploit","type":"news_article","url":"https://www.theblock.co/post/386986/matcha-meta-swapnet-incident"},{"credibility":2,"name":"DL News: Hacker swipes $13.5m from Matcha Meta users","type":"news_article","url":"https://www.dlnews.com/articles/defi/matcha-meta-users-lose-millions-after-security-breach-at-integrated-protocol/"},{"credibility":2,"name":"Yahoo Finance: Hacker swipes $13.5m from Matcha Meta users","type":"news_article","url":"https://finance.yahoo.com/news/hacker-swipes-17m-matcha-meta-124100544.html"}]},{"content":"0x Protocol operates as open, permissionless infrastructure for tokenized asset exchange. Its core design uses off-chain order books with on-chain settlement, reducing gas costs relative to fully on-chain DEXs. The protocol has undergone multiple versions (v1 through v4), with v4 approved by community governance in January 2023. The 0x Swap API powers integrations for major wallets and apps including MetaMask, Coinbase Wallet, and Robinhood. The team launched Matcha, a DEX aggregator front-end, in June 2020; as of 2026 Matcha aggregates over 130 on-chain and off-chain liquidity sources across 16 chains and is reported to be among the top three DEX aggregators by volume. The protocol has expanded to Solana, one of the first DEX aggregators to support both SVM and EVM chains simultaneously. Cumulative trading volume across all 0x integrations is reported to exceed $200 billion since inception.","heading":"Protocol Architecture and Ecosystem","severity":"low","sources":[{"credibility":2,"name":"Matcha: About Matcha DEX aggregator","type":"official","url":"https://matcha.xyz/about-matcha-dex-aggregator"},{"credibility":2,"name":"DEXTools: What Is Matcha? The 0x-Powered DEX Aggregator Explained (2026 Guide)","type":"other","url":"https://www.dextools.io/tutorials/what-is-matcha-dex-aggregator-0x-trading-guide-2026"},{"credibility":2,"name":"Messari: Matcha Q2 2024 Brief","type":"research","url":"https://messari.io/report/matcha-q2-2024-brief"}]},{"content":"ZRX serves two primary roles within the 0x ecosystem: governance over protocol upgrades via 0x Improvement Proposals (ZEIPs), and liquidity provider incentives via staking. In 2017, ZRX was initially used to pay trading fees and vote on governance proposals. In 2019, staking functionality was introduced, allowing market makers to earn ZRX rewards by providing liquidity. Following the 2023 CFTC settlement, the leveraged tokens that had triggered the regulatory action were removed from Matcha. As of mid-2025, ZRX traded in the $0.21–$0.25 range, significantly below its all-time highs of approximately $2.50 (January 2018) and $2.40 (April 2021), and has declined substantially in market cap ranking from a top-30 position in 2018 to well outside the top 200 by 2025–2026.","heading":"Token Utility and Governance","severity":"medium","sources":[{"credibility":2,"name":"Gate Wiki: 0x Protocol (ZRX) Overview","type":"other","url":"https://www.gate.com/crypto-wiki/article/0x-protocol-zrx-overview-token-utility-and-price-prediction-for-2025-2030"},{"credibility":2,"name":"CoinMarketCap: 0x Protocol (ZRX)","type":"other","url":"https://coinmarketcap.com/currencies/0x/"}]},{"content":"A thread posted to the official 0x governance forum with the title 'ZRX Ended Up Being a Scam' represents a community grievance, though the post is no longer accessible and the specific claims cannot be independently verified. Broader community criticism focuses on ZRX's persistent price underperformance relative to earlier expectations, the loss of market cap rank, and questions about whether the ZRX token captures sufficient protocol value given that 0x's core API business generates revenue through integrations rather than direct on-chain fees accruing to token holders. A fake ZRX ICO scam was flagged by the official 0x team in April 2020, warning users not to send funds to the impersonation campaign. No verified reports exist of the official 0x project team engaging in fraud, misappropriation of funds, or deceptive practices.","heading":"Community Concerns and Criticism","severity":"medium","sources":[{"credibility":3,"name":"0x Official Twitter: Scam Alert — Fake ZRX ICO","type":"social_media","url":"https://twitter.com/0xProject/status/1252978937258377216"},{"credibility":3,"name":"0x Governance Forum: ZRX Ended Up Being a Scam (thread, now inaccessible)","type":"community_report","url":"https://forum.0xprotocol.org/t/zrx-ended-up-being-a-scam/4073"}]}],"sources_used":[{"credibility":1,"name":"CFTC Press Release 8774-23","type":"regulatory","url":"https://www.cftc.gov/PressRoom/PressReleases/8774-23"},{"credibility":1,"name":"CoinDesk: CFTC Goes After Opyn, Other DeFi Operations in Enforcement Sweep","type":"news_article","url":"https://www.coindesk.com/policy/2023/09/07/cftc-goes-after-opyn-other-defi-operations-in-enforcement-sweep"},{"credibility":1,"name":"The Block: Matcha Meta users hit in $13.4 million SwapNet contract exploit","type":"news_article","url":"https://www.theblock.co/post/386986/matcha-meta-swapnet-incident"},{"credibility":1,"name":"Skadden: CFTC Charges DeFi Developers With Facilitating Off-Exchange Trading","type":"other","url":"https://www.skadden.com/insights/publications/2023/09/cftc-charges-defi-developers-with-facilitating-off-exchange-trading"},{"credibility":2,"name":"samczsun: The 0x vulnerability, explained","type":"research","url":"https://samczsun.com/the-0x-vulnerability-explained/"},{"credibility":2,"name":"0x Core Team: Post-mortem — 0x v2.0 Exchange Vulnerability","type":"official","url":"https://medium.com/@0xcoreteam/post-mortem-0x-v2-0-exchange-vulnerability-763015399578"},{"credibility":2,"name":"CryptoSlate: CFTC settles charges against companies behind 0x (ZRX)","type":"news_article","url":"https://cryptoslate.com/cftc-settles-charges-against-companies-behind-0x-zrx-two-other-defi-protocols/"},{"credibility":2,"name":"Blockworks: DeFi projects charged by CFTC over crypto derivatives","type":"news_article","url":"https://blockworks.co/news/defi-cftc-crypto-derivatives"},{"credibility":2,"name":"DL News: Hacker swipes $13.5m from Matcha Meta users","type":"news_article","url":"https://www.dlnews.com/articles/defi/matcha-meta-users-lose-millions-after-security-breach-at-integrated-protocol/"},{"credibility":2,"name":"CoinTelegraph: 0x DEX Protocol Suspended Because of Vulnerability, Funds Safe","type":"news_article","url":"https://cointelegraph.com/news/0x-dex-protocol-suspended-because-of-vulnerability-funds-safe"},{"credibility":2,"name":"Messari: Matcha Q2 2024 Brief","type":"research","url":"https://messari.io/report/matcha-q2-2024-brief"},{"credibility":2,"name":"Matcha: About Matcha DEX aggregator","type":"official","url":"https://matcha.xyz/about-matcha-dex-aggregator"},{"credibility":2,"name":"ICO Drops: 0x (ZRX) Token Sale","type":"other","url":"https://icodrops.com/0x/"},{"credibility":2,"name":"Gate Wiki: 0x Protocol (ZRX) Overview","type":"other","url":"https://www.gate.com/crypto-wiki/article/0x-protocol-zrx-overview-token-utility-and-price-prediction-for-2025-2030"},{"credibility":2,"name":"CoinMarketCap: 0x Protocol (ZRX)","type":"other","url":"https://coinmarketcap.com/currencies/0x/"},{"credibility":2,"name":"OKX: What is ZRX (0x)?","type":"other","url":"https://www.okx.com/en-us/learn/what-is-zrx-0x"},{"credibility":2,"name":"Kraken: What is 0x (ZRX)?","type":"other","url":"https://www.kraken.com/learn/what-is-0x-zrx"},{"credibility":2,"name":"DEXTools: What Is Matcha? The 0x-Powered DEX Aggregator Explained (2026 Guide)","type":"other","url":"https://www.dextools.io/tutorials/what-is-matcha-dex-aggregator-0x-trading-guide-2026"},{"credibility":2,"name":"Yahoo Finance: Hacker swipes $13.5m from Matcha Meta users","type":"news_article","url":"https://finance.yahoo.com/news/hacker-swipes-17m-matcha-meta-124100544.html"},{"credibility":3,"name":"0x Official Twitter: Scam Alert","type":"social_media","url":"https://twitter.com/0xProject/status/1252978937258377216"},{"credibility":3,"name":"0x Governance Forum: ZRX Ended Up Being a Scam (thread)","type":"community_report","url":"https://forum.0xprotocol.org/t/zrx-ended-up-being-a-scam/4073"}],"summary":"0x Protocol (ticker: ZRX) is a decentralized exchange infrastructure protocol founded in 2016 by Will Warren and Amir Bandeali, enabling peer-to-peer token trading on Ethereum and multiple other chains. The project conducted a $24 million ICO in August 2017, has processed over $200 billion in cumulative trading volume, and operates the Matcha DEX aggregator. In September 2023, the U.S. CFTC settled charges against ZeroEx, Inc.—the corporate entity behind 0x—for $200,000 related to the unlicensed offering of leveraged token trading; and in January 2026 a third-party integration (SwapNet) used in Matcha Meta suffered a $13.4 million exploit, though 0x's core protocol contracts were not compromised.","timeline":[{"date":"2016-01-01","event":"Will Warren and Amir Bandeali begin developing 0x Protocol concept.","source":"OKX Learn","source_url":"https://www.okx.com/en-us/learn/what-is-zrx-0x"},{"date":"2017-08-01","event":"ZeroEx, Inc. conducts a public ICO raising approximately $24 million in ETH, selling 50% of total ZRX supply. Investors include Polychain Capital, Pantera Capital, and Blockchain Capital.","source":"ICO Drops: 0x Token Sale","source_url":"https://icodrops.com/0x/"},{"date":"2018-01-01","event":"ZRX reaches an all-time high of approximately $2.50, ranking among the top 30 cryptocurrencies by market capitalization.","source":"Gate Wiki: 0x Protocol (ZRX) Overview","source_url":"https://www.gate.com/crypto-wiki/article/0x-protocol-zrx-overview-token-utility-and-price-prediction-for-2025-2030"},{"date":"2019-07-12","event":"Security researcher samczsun discloses a critical signature-verification vulnerability in the 0x v2.0 Exchange contract. The 0x team triggers an emergency shutdown; no funds are lost. A patched v2.1 contract is deployed.","source":"0x Core Team Medium Post-mortem","source_url":"https://medium.com/@0xcoreteam/post-mortem-0x-v2-0-exchange-vulnerability-763015399578"},{"date":"2019-01-01","event":"0x introduces ZRX staking, allowing market makers to earn token rewards for providing liquidity.","source":"Gate Wiki: 0x Protocol (ZRX) Overview","source_url":"https://www.gate.com/crypto-wiki/article/0x-protocol-zrx-overview-token-utility-and-price-prediction-for-2025-2030"},{"date":"2020-06-01","event":"0x launches Matcha, a DEX aggregator front-end powered by the 0x Swap API.","source":"Matcha: About Matcha DEX aggregator","source_url":"https://matcha.xyz/about-matcha-dex-aggregator"},{"date":"2020-04-20","event":"Official 0x team issues a public scam alert warning of a fake ZRX ICO impersonation campaign.","source":"0x Official Twitter","source_url":"https://twitter.com/0xProject/status/1252978937258377216"},{"date":"2021-04-01","event":"ZRX reaches approximately $2.40 during the 2021 bull market, approaching its 2018 all-time high.","source":"Gate Wiki: 0x Protocol (ZRX) Overview","source_url":"https://www.gate.com/crypto-wiki/article/0x-protocol-zrx-overview-token-utility-and-price-prediction-for-2025-2030"},{"date":"2023-01-01","event":"0x Protocol v4 is approved via community governance vote by over 2,300 ZRX holders.","source":"Gate Wiki: 0x Protocol (ZRX) Overview","source_url":"https://www.gate.com/crypto-wiki/article/0x-protocol-zrx-overview-token-utility-and-price-prediction-for-2025-2030"},{"date":"2023-09-07","event":"U.S. CFTC issues a settlement order against ZeroEx, Inc., charging the company with unlawfully offering leveraged retail commodity transactions. ZeroEx pays a $200,000 civil monetary penalty and agrees to cease and desist.","source":"CFTC Press Release 8774-23","source_url":"https://www.cftc.gov/PressRoom/PressReleases/8774-23"},{"date":"2026-01-25","event":"A $13.4 million exploit drains funds from 20 Matcha Meta users via a vulnerability in a third-party SwapNet integration. 0x's core protocol contracts are not affected. The impacted contract is disabled within hours.","source":"The Block: Matcha Meta SwapNet Incident","source_url":"https://www.theblock.co/post/386986/matcha-meta-swapnet-incident"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0a10c94f-038c-446b-8dd7-006a9ae3e20ecopy