019b3836-225f-71fa-9a22-3ba4f0a44b83
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 275 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 276 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 43715 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 43716 | capability.graph | complete | 1 / 3 | 1 week ago |
| 43717 | detector.run | complete | 1 / 3 | 1 week ago |
| 43718 | validation.fork | complete | 1 / 3 | 1 week ago |
| 99770 | report.consolidate | complete | 1 / 6 | 1 week ago |
No slither job recorded yet.
{"no_findings":false,"summary":"Bytecode-only review found a confirmed public timeout/destruction path and multiple unchecked ETH-transfer callsites. The strongest issue is that payout loops ignore CALL success and then mark entries as processed, which can strand funds; the timeout path also exposes a plausible reentrancy window and ends in SELFDESTRUCT to a hardcoded beneficiary.","findings":[{"severity":"high","category":"other","title":"Unchecked ETH payouts can mark participants paid even when the transfer fails","exploit_scenario":"A participant can join from a contract wallet whose fallback reverts or needs more than the hardcoded 0x1388 gas. During either payout loop, the contract sends ETH with CALL, ignores the return value, and then clears the participant record anyway. The participant is treated as paid, but the ETH stays in the contract and can later be swept by the timeout teardown path.","recommendation":"Do not ignore CALL results. Apply checks-effects-interactions, mark state only after a successful transfer, and prefer a pull-withdraw pattern over pushing ETH with a fixed gas amount.","evidence":"At pc 0x288 and pc 0x480 the contract executes CALL with gas 0x1388 to an address/value loaded from per-entry storage, and immediately POPs the success flag. The surrounding code then clears entry storage at pc 0x36e and pc 0x48e respectively. This is strong bytecode evidence of silent transfer failure followed by state mutation. Selector inference is best-effort, but these callsites sit inside the 0x4f3739bc and 0xcbc1cfd2 entrypaths.","locations":["pc:0x288","pc:0x36e","pc:0x480","pc:0x48e","selector:0x4f3739bc","selector:0xcbc1cfd2"]},{"severity":"medium","category":"reentrancy","title":"Timeout payout loop calls out before clearing the current entry","exploit_scenario":"After the timeout gate is reached, a participant implemented as a contract can receive a payout and attempt to reenter the same timeout function before its record is zeroed. If the fallback can fit a nested call inside the provided gas, the same entry may be observed as still active and paid again, or iteration may be disrupted.","recommendation":"Clear or lock the entry before the external call, or add an explicit reentrancy guard. A pull-claim model avoids this class of issue entirely.","evidence":"The timeout path for selector 0xcbc1cfd2 checks only a timestamp condition at pc 0x411 and then enters a payout loop. Inside that loop, pc 0x480 performs CALL, while the record-clearing SSTORE does not happen until pc 0x48e. There is no heuristic reentrancy guard detected on this path. Exploitability is somewhat uncertain because the call forwards only 0x1388 gas, so severity is kept at medium.","locations":["selector:0xcbc1cfd2","pc:0x411","pc:0x480","pc:0x48e"]},{"severity":"medium","category":"access_control","title":"Public timeout path can selfdestruct the contract and sweep leftovers to a hardcoded address","exploit_scenario":"Once the stored deadline expires, any caller can invoke the timeout entrypath, trigger the payout loop, and then destroy the contract. Any ETH left behind, including funds stranded by failed payouts, is forcibly sent to the hardcoded beneficiary 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae.","recommendation":"Remove SELFDESTRUCT from the runtime path, or strictly gate teardown and use an auditable, configurable beneficiary. Ensure all owed payouts succeed before any terminal sweep.","evidence":"The bytecode compares selector 0xcbc1cfd2, checks a timestamp/deadline condition at pc 0x411, and reaches SELFDESTRUCT at pc 0x49e. The beneficiary is hardcoded by PUSH20 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae immediately before SELFDESTRUCT. Unlike the owner-only paths guarded around pc 0xff/0x154, this timeout/destruction path shows no msg.sender equality guard.","locations":["selector:0xcbc1cfd2","pc:0x411","pc:0x49e"]}]}
OpenAI Codex v0.118.0 (research preview)
--------
workdir: /tmp/codex-q9mrotit
model: gpt-5.4
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: none
session id: 019d5b25-a0d3-7a20-8e16-9ad37e883d9c
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.
Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.
Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".
Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
warning: Codex could not find system bubblewrap on PATH. Please install bubblewrap with your package manager. Codex will use the vendored bubblewrap in the meantime.
exec
/bin/bash -lc pwd in /tmp/codex-q9mrotit
succeeded in 0ms:
/tmp/codex-q9mrotit
exec
/bin/bash -lc 'rg --files' in /tmp/codex-q9mrotit
succeeded in 0ms:
codex-output-schema.json
BYTECODE_BUNDLE.json
exec
/bin/bash -lc "sed -n '1,220p' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"analysis_artifact": {
"address": "0xdc00a9f92e9ea5cba399b026775e64596215861f",
"artifact_hash": "0x1f6f2175bb713075a752c60af99d9166aae32c6a38a647122bce9ea37e45d15c",
"artifact_json": {
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"basic_blocks": [
{
"end_pc": 68,
"hash": "0x892df700f0dfafe8d6865b9014c56dc8aa9cc419e7fb3c779c8d91e71af93f98",
"opcodes": [
"PUSH1",
"PUSH2",
"MSTORE8",
"PUSH29",
"PUSH1",
"CALLDATALOAD",
"DIV",
"PUSH13",
"PUSH1",
"MSTORE",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 0
},
{
"end_pc": 79,
"hash": "0x3534f5cb0441e47ec8b65cddcafc4d26bc10b2d0637e6e2f3a93a9a8b246d412",
"opcodes": [
"PUSH1",
"SLOAD",
"PUSH1",
"MSTORE",
"PUSH1",
"PUSH1",
"RETURN"
],
"start_pc": 69
},
{
"end_pc": 92,
"hash": "0xa08e143a54f189c48ec69f6b618b656ad9f69baa6dcba41d4b11ba3929c428c3",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 80
},
{
"end_pc": 118,
"hash": "0xad446c0b5bd8d19397dcf2486623d2be6d0394c6b9b4b6262077ce3638b02100",
"opcodes": [
"PUSH13",
"SLOAD",
"ADDRESS",
"BALANCE",
"SUB",
"PUSH1",
"MSTORE",
"PUSH1",
"PUSH1",
"RETURN"
],
"start_pc": 93
},
{
"end_pc": 131,
"hash": "0x3cf71391c210e9a6033b308d520d6d468261c3be59996fbdf5bb772ed795c4f3",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 119
},
{
"end_pc": 155,
"hash": "0x0d7048d27bf11f0383206c7e828ab77b8fc3378a456aabc32b3699aca1834df3",
"opcodes": [
"PUSH1",
"MLOAD",
"PUSH13",
"SLOAD",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 132
},
{
"end_pc": 168,
"hash": "0x460a153a8530cfae78575202041416a2911bff6ec159d332ef84b6fcdbffb398",
"opcodes": [
"PUSH1",
"PUSH1",
"SUB",
"PUSH1",
"MSTORE",
"PUSH1",
"PUSH1",
"RETURN"
],
"start_pc": 156
},
{
"end_pc": 172,
"hash": "0x91b5bebf66d29b8005e00729065a917af5ebfa0b5dce5329f07541aa261447c0",
"opcodes": [
"PUSH2",
"JUMP"
],
"start_pc": 169
},
{
"end_pc": 195,
"hash": "0x1db96f5a7b821e657af2c56432747166fdf391014b583ebf78cd194a5c2a2318",
"opcodes": [
"JUMPDEST",
"NUMBER",
"PUSH13",
"SLOAD",
"SGT",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 173
},
{
"end_pc": 220,
"hash": "0x41cbec1691ac9e7a582ef3cff9a336b2401ca632ba57fefb811801e48c6a70cd",
"opcodes": [
"NUMBER",
"PUSH13",
"SLOAD",
"SUB",
"PUSH1",
"MSTORE",
"PUSH1",
"PUSH1",
"RETURN"
],
"start_pc": 196
},
{
"end_pc": 224,
"hash": "0x5afb2ad23360ebe588b1ad9ab313e74d91891b03cb2e81624f581eeaa368fe32",
"opcodes": [
"PUSH2",
"JUMP"
],
"start_pc": 221
},
{
"end_pc": 235,
"hash": "0xcd52c1260a2385c8ee9255ae97cb4d2629d1cf38d185b0909d096629312dc970",
"opcodes": [
"JUMPDEST",
"PUSH1",
"PUSH1",
"MSTORE",
"PUSH1",
"PUSH1",
"RETURN"
],
"start_pc": 225
},
{
"end_pc": 236,
"hash": "0x5967451cf2cfdd7e5502a13872ab46b77c698b1244ab5aa9fb81b04364dcfe30",
"opcodes": [
"JUMPDEST"
],
"start_pc": 236
},
{
"end_pc": 237,
"hash": "0x5c9cb1940b70a4b2524a6223fa319799ad63d600798cb97ec93bda2ec20dce4d",
"opcodes": [
"JUMPDEST"
],
"start_pc": 237
},
{
"end_pc": 250,
"hash": "0x52206599173960b4619b7dde9c43b71098fde1d6b0b308aace3eea1060619205",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
exec
/bin/bash -lc "sed -n '1,220p' codex-output-schema.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{"type": "object", "additionalProperties": false, "required": ["no_findings", "summary", "findings"], "properties": {"no_findings": {"type": "boolean"}, "summary": {"type": "string"}, "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["severity", "category", "title", "evidence", "locations", "exploit_scenario", "recommendation"], "properties": {"severity": {"type": "string", "enum": ["info", "low", "medium", "high", "critical"]}, "category": {"type": "string", "enum": ["access_control", "reentrancy", "math", "oracle", "upgradeability", "auth", "other"]}, "title": {"type": "string"}, "exploit_scenario": {"type": "string"}, "recommendation": {"type": "string"}, "evidence": {"type": "string"}, "locations": {"type": "array", "items": {"type": "string"}}}}}}}
exec
/bin/bash -lc "jq 'keys' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
"analysis_artifact",
"analysis_run",
"artifact",
"capability_graph",
"detector_findings",
"heuristics_summary"
]
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json | keys' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
"auth",
"basic_blocks",
"callsites",
"cfg_edges",
"cfg_hash",
"dispatcher_type",
"function_entries",
"functions",
"selectors",
"sinks",
"storage",
"version"
]
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.detector_findings' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
null
exec
/bin/bash -lc "jq '.detector_findings' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
{
"confidence": 45,
"evidence_json": {
"guards_detected": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
],
"selfdestruct_count": 1
},
"normalized_json": {
"sink": "SELFDESTRUCT"
},
"severity": "medium",
"title": "SELFDESTRUCT reachable",
"validated": true,
"validation_json": {
"attempts": 11,
"call_targets": null,
"classification": "sink_reached",
"confirmed": true,
"errors": 0,
"matched_probe": null,
"sink": "SELFDESTRUCT",
"status": "confirmed",
"target_varies": null,
"trace_id": "0x4d60b13d740085d4f3d1f5abbb5624690f6943903fc4ed7a3fe1afeb30a3025e",
"trace_mode": "structLogs"
}
},
{
"confidence": 40,
"evidence_json": {
"call_count": 5
},
"normalized_json": {
"sink": "CALL"
},
"severity": "low",
"title": "External CALL present",
"validated": false,
"validation_json": {
"attempts": 1,
"call_targets": [
"0xdc00a9f92e9ea5cba399b026775e64596215861f"
],
"classification": "constant_target",
"confirmed": false,
"errors": 0,
"matched_probe": null,
"sink": "CALL",
"status": "sink_reached",
"target_varies": false,
"trace_id": "0xdd6b14328c674135ffd95c2220ccbafd5df4af363695c8ef400042e654252b07",
"trace_mode": "callTracer"
}
}
]
exec
/bin/bash -lc "jq '.heuristics_summary' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"create2_count": 0,
"delegatecall_count": 0,
"flags": [
"selfdestruct_present"
],
"selfdestruct_count": 1
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.selectors' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
"0xf7fc250f",
"0xe0c516ec",
"0x7dbda4fb",
"0x81d1d3a6",
"0x4f3739bc",
"0xcbc1cfd2",
"0x3ccfd60b",
"0x990e9591",
"0xaadcfc8c"
]
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.function_entries' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
{
"entry_pc": null,
"selector": "0xf7fc250f"
},
{
"entry_pc": null,
"selector": "0xe0c516ec"
},
{
"entry_pc": null,
"selector": "0x7dbda4fb"
},
{
"entry_pc": null,
"selector": "0x81d1d3a6"
},
{
"entry_pc": null,
"selector": "0x4f3739bc"
},
{
"entry_pc": null,
"selector": "0xcbc1cfd2"
},
{
"entry_pc": null,
"selector": "0x3ccfd60b"
},
{
"entry_pc": null,
"selector": "0x990e9591"
},
{
"entry_pc": null,
"selector": "0xaadcfc8c"
}
]
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.callsites' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
{
"opcode": "CALL",
"pc": 648,
"returndata_checked": null,
"target_expression_category": "constant",
"value_expression_category": "constant_zero"
},
{
"opcode": "CALL",
"pc": 1152,
"returndata_checked": null,
"target_expression_category": "constant",
"value_expression_category": "constant_zero"
},
{
"opcode": "CALL",
"pc": 1283,
"returndata_checked": null,
"target_expression_category": "constant",
"value_expression_category": "constant_zero"
},
{
"opcode": "CALL",
"pc": 1356,
"returndata_checked": null,
"target_expression_category": "constant",
"value_expression_category": "constant_zero"
},
{
"opcode": "CALL",
"pc": 1635,
"returndata_checked": null,
"target_expression_category": "constant",
"value_expression_category": "constant_zero"
}
]
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.sinks' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"call": 5,
"create": 0,
"create2": 0,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0,
"upgrade_slot_write_suspected": false
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.storage' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"keccak_count": 2,
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.functions' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0xf7fc250f",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0xe0c516ec",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0x7dbda4fb",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0x81d1d3a6",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0x4f3739bc",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0xcbc1cfd2",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0x3ccfd60b",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0x990e9591",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
},
{
"auth": {
"guards": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
]
},
"entry_pc": null,
"selector": "0xaadcfc8c",
"sinks": {
"call": 5,
"delegatecall": 0,
"selfdestruct": 1,
"staticcall": 0
},
"storage": {
"reads": 36,
"slots": [
{
"op": "SLOAD",
"pc": 71,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 107,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 149,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 189,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 211,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 253,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 338,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 375,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000005"
},
{
"op": "SLOAD",
"pc": 397,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 423,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000001"
},
{
"op": "SLOAD",
"pc": 472,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 878,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 911,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 918,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000160"
},
{
"op": "SSTORE",
"pc": 944,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SSTORE",
"pc": 962,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000020"
},
{
"op": "SLOAD",
"pc": 1041,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000002"
},
{
"op": "SLOAD",
"pc": 1083,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1166,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1262,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SLOAD",
"pc": 1333,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1392,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1423,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
},
{
"op": "SSTORE",
"pc": 1454,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000320"
},
{
"op": "SSTORE",
"pc": 1469,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000380"
},
{
"op": "SSTORE",
"pc": 1484,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000340"
},
{
"op": "SLOAD",
"pc": 1625,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000004"
},
{
"op": "SLOAD",
"pc": 1631,
"slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
},
{
"op": "SLOAD",
"pc": 1664,
"slot": "0x0000000000000000000000000000000000000040000000000000000000000003"
}
],
"writes": 14
}
}
]
exec
/bin/bash -lc "jq '.capability_graph' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"address": "0xdc00a9f92e9ea5cba399b026775e64596215861f",
"block_number": null,
"chain_id": 1,
"codehash": "0x73eac4fcdff0980bf8b760531ebf17fc623926ec16089c78062957150e32e523",
"created_at": "2026-04-04T19:45:48.000000Z",
"graph_hash": "0x8e868cfc6b007b5074a068bf321216c57595bbd50c947dfcef2b2a0cef943a01",
"graph_json": {
"edges": [
{
"from": "bb:0",
"to": "bb:80",
"type": "control_flow"
},
{
"from": "bb:0",
"to": "bb:69",
"type": "control_flow_fallthrough"
},
{
"from": "bb:80",
"to": "bb:119",
"type": "control_flow"
},
{
"from": "bb:80",
"to": "bb:93",
"type": "control_flow_fallthrough"
},
{
"from": "bb:119",
"to": "bb:238",
"type": "control_flow"
},
{
"from": "bb:119",
"to": "bb:132",
"type": "control_flow_fallthrough"
},
{
"from": "bb:132",
"to": "bb:173",
"type": "control_flow"
},
{
"from": "bb:132",
"to": "bb:156",
"type": "control_flow_fallthrough"
},
{
"from": "bb:169",
"to": "bb:237",
"type": "control_flow"
},
{
"from": "bb:173",
"to": "bb:225",
"type": "control_flow"
},
{
"from": "bb:173",
"to": "bb:196",
"type": "control_flow_fallthrough"
},
{
"from": "bb:221",
"to": "bb:236",
"type": "control_flow"
},
{
"from": "bb:236",
"to": "bb:237",
"type": "control_flow_fallthrough"
},
{
"from": "bb:237",
"to": "bb:238",
"type": "control_flow_fallthrough"
},
{
"from": "bb:238",
"to": "bb:294",
"type": "control_flow"
},
{
"from": "bb:238",
"to": "bb:251",
"type": "control_flow_fallthrough"
},
{
"from": "bb:251",
"to": "bb:274",
"type": "control_flow"
},
{
"from": "bb:251",
"to": "bb:262",
"type": "control_flow_fallthrough"
},
{
"from": "bb:274",
"to": "bb:294",
"type": "control_flow_fallthrough"
},
{
"from": "bb:294",
"to": "bb:1026",
"type": "control_flow"
},
{
"from": "bb:294",
"to": "bb:307",
"type": "control_flow_fallthrough"
},
{
"from": "bb:307",
"to": "bb:359",
"type": "control_flow"
},
{
"from": "bb:307",
"to": "bb:347",
"type": "control_flow_fallthrough"
},
{
"from": "bb:359",
"to": "bb:394",
"type": "control_flow"
},
{
"from": "bb:359",
"to": "bb:382",
"type": "control_flow_fallthrough"
},
{
"from": "bb:394",
"to": "bb:430",
"type": "control_flow"
},
{
"from": "bb:394",
"to": "bb:419",
"type": "control_flow_fallthrough"
},
{
"from": "bb:419",
"to": "bb:433",
"type": "control_flow"
},
{
"from": "bb:430",
"to": "bb:433",
"type": "control_flow_fallthrough"
},
{
"from": "bb:433",
"to": "bb:451",
"type": "control_flow"
},
{
"from": "bb:433",
"to": "bb:439",
"type": "control_flow_fallthrough"
},
{
"from": "bb:451",
"to": "bb:513",
"type": "control_flow_fallthrough"
},
{
"from": "bb:513",
"to": "bb:894",
"type": "control_flow"
},
{
"from": "bb:513",
"to": "bb:528",
"type": "control_flow_fallthrough"
},
{
"from": "bb:528",
"to": "bb:759",
"type": "control_flow"
},
{
"from": "bb:528",
"to": "bb:615",
"type": "control_flow_fallthrough"
},
{
"from": "bb:615",
"to": "bb:865",
"type": "control_flow"
},
{
"from": "bb:759",
"to": "bb:865",
"type": "control_flow_fallthrough"
},
{
"from": "bb:865",
"to": "bb:513",
"type": "control_flow"
},
{
"from": "bb:1026",
"to": "bb:1205",
"type": "control_flow"
},
{
"from": "bb:1026",
"to": "bb:1039",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1039",
"to": "bb:1062",
"type": "control_flow"
},
{
"from": "bb:1039",
"to": "bb:1050",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1062",
"to": "bb:1088",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1088",
"to": "bb:1182",
"type": "control_flow"
},
{
"from": "bb:1088",
"to": "bb:1103",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1103",
"to": "bb:1088",
"type": "control_flow"
},
{
"from": "bb:1205",
"to": "bb:1590",
"type": "control_flow"
},
{
"from": "bb:1205",
"to": "bb:1217",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1217",
"to": "bb:1300",
"type": "control_flow"
},
{
"from": "bb:1217",
"to": "bb:1270",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1300",
"to": "bb:1373",
"type": "control_flow"
},
{
"from": "bb:1300",
"to": "bb:1343",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1590",
"to": "bb:1637",
"type": "control_flow"
},
{
"from": "bb:1590",
"to": "bb:1603",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1603",
"to": "bb:1637",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1637",
"to": "bb:1675",
"type": "control_flow"
},
{
"from": "bb:1637",
"to": "bb:1650",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1675",
"to": "bb:1787",
"type": "control_flow"
},
{
"from": "bb:1675",
"to": "bb:1688",
"type": "control_flow_fallthrough"
},
{
"from": "bb:1786",
"to": "bb:1787",
"type": "control_flow_fallthrough"
},
{
"from": "bb:615",
"to": "call:648",
"type": "contains"
},
{
"from": "call:648",
"to": "sink:call",
"type": "capability"
},
{
"from": "bb:1103",
"to": "call:1152",
"type": "contains"
},
{
"from": "call:1152",
"to": "sink:call",
"type": "capability"
},
{
"from": "bb:1270",
"to": "call:1283",
"type": "contains"
},
{
"from": "call:1283",
"to": "sink:call",
"type": "capability"
},
{
"from": "bb:1343",
"to": "call:1356",
"type": "contains"
},
{
"from": "call:1356",
"to": "sink:call",
"type": "capability"
},
{
"from": "bb:1603",
"to": "call:1635",
"type": "contains"
},
{
"from": "call:1635",
"to": "sink:call",
"type": "capability"
}
],
"nodes": [
{
"end_pc": 68,
"hash": "0x892df700f0dfafe8d6865b9014c56dc8aa9cc419e7fb3c779c8d91e71af93f98",
"id": "bb:0",
"start_pc": 0,
"type": "basic_block"
},
{
"end_pc": 79,
"hash": "0x3534f5cb0441e47ec8b65cddcafc4d26bc10b2d0637e6e2f3a93a9a8b246d412",
"id": "bb:69",
"start_pc": 69,
"type": "basic_block"
},
{
"end_pc": 92,
"hash": "0xa08e143a54f189c48ec69f6b618b656ad9f69baa6dcba41d4b11ba3929c428c3",
"id": "bb:80",
"start_pc": 80,
"type": "basic_block"
},
{
"end_pc": 118,
"hash": "0xad446c0b5bd8d19397dcf2486623d2be6d0394c6b9b4b6262077ce3638b02100",
"id": "bb:93",
"start_pc": 93,
"type": "basic_block"
},
{
"end_pc": 131,
"hash": "0x3cf71391c210e9a6033b308d520d6d468261c3be59996fbdf5bb772ed795c4f3",
"id": "bb:119",
"start_pc": 119,
"type": "basic_block"
},
{
"end_pc": 155,
"hash": "0x0d7048d27bf11f0383206c7e828ab77b8fc3378a456aabc32b3699aca1834df3",
"id": "bb:132",
"start_pc": 132,
"type": "basic_block"
},
{
"end_pc": 168,
"hash": "0x460a153a8530cfae78575202041416a2911bff6ec159d332ef84b6fcdbffb398",
"id": "bb:156",
"start_pc": 156,
"type": "basic_block"
},
{
"end_pc": 172,
"hash": "0x91b5bebf66d29b8005e00729065a917af5ebfa0b5dce5329f07541aa261447c0",
"id": "bb:169",
"start_pc": 169,
"type": "basic_block"
},
{
"end_pc": 195,
"hash": "0x1db96f5a7b821e657af2c56432747166fdf391014b583ebf78cd194a5c2a2318",
"id": "bb:173",
"start_pc": 173,
"type": "basic_block"
},
{
"end_pc": 220,
"hash": "0x41cbec1691ac9e7a582ef3cff9a336b2401ca632ba57fefb811801e48c6a70cd",
"id": "bb:196",
"start_pc": 196,
"type": "basic_block"
},
{
"end_pc": 224,
"hash": "0x5afb2ad23360ebe588b1ad9ab313e74d91891b03cb2e81624f581eeaa368fe32",
"id": "bb:221",
"start_pc": 221,
"type": "basic_block"
},
{
"end_pc": 235,
"hash": "0xcd52c1260a2385c8ee9255ae97cb4d2629d1cf38d185b0909d096629312dc970",
"id": "bb:225",
"start_pc": 225,
"type": "basic_block"
},
{
"end_pc": 236,
"hash": "0x5967451cf2cfdd7e5502a13872ab46b77c698b1244ab5aa9fb81b04364dcfe30",
"id": "bb:236",
"start_pc": 236,
"type": "basic_block"
},
{
"end_pc": 237,
"hash": "0x5c9cb1940b70a4b2524a6223fa319799ad63d600798cb97ec93bda2ec20dce4d",
"id": "bb:237",
"start_pc": 237,
"type": "basic_block"
},
{
"end_pc": 250,
"hash": "0x52206599173960b4619b7dde9c43b71098fde1d6b0b308aace3eea1060619205",
"id": "bb:238",
"start_pc": 238,
"type": "basic_block"
},
{
"end_pc": 261,
"hash": "0x42cf5e86b271d1c8f911f0ff9b60c2a2cc154355351f3b93fa123f5966a49461",
"id": "bb:251",
"start_pc": 251,
"type": "basic_block"
},
{
"end_pc": 273,
"hash": "0x76fc5f324604fb1b7779c876e183220063c9a52938df6201763324ef651edbbf",
"id": "bb:262",
"start_pc": 262,
"type": "basic_block"
},
{
"end_pc": 293,
"hash": "0xce7d03bd62f52b9f8f7dfa86f730b42fce1a0e9dd870a879ae771bfeec5f13f1",
"id": "bb:274",
"start_pc": 274,
"type": "basic_block"
},
{
"end_pc": 306,
"hash": "0xb0ffd41e6c710557377b5a76168cf71382f82256cecb2f92e78afd6d2c41047b",
"id": "bb:294",
"start_pc": 294,
"type": "basic_block"
},
{
"end_pc": 346,
"hash": "0x44e119f6c4ac756f505116731250c6056be7c97d1162ed012274d2d8b0f8c0c2",
"id": "bb:307",
"start_pc": 307,
"type": "basic_block"
},
{
"end_pc": 358,
"hash": "0xb5fed0c5ad84e5e5f88376a0a94ed231476a76ab5e6878c0f4ccd5d8febda68c",
"id": "bb:347",
"start_pc": 347,
"type": "basic_block"
},
{
"end_pc": 381,
"hash": "0xc8da3cc4a6c2c23b9fb47bafcc393506d11bb128acf5ba11a78d25837a878495",
"id": "bb:359",
"start_pc": 359,
"type": "basic_block"
},
{
"end_pc": 393,
"hash": "0x6fe0ba83733c68cb87b870009e3e4411896183b429d90d65d282d64e56e53c62",
"id": "bb:382",
"start_pc": 382,
"type": "basic_block"
},
{
"end_pc": 418,
"hash": "0xba9ce3fde6bb0a71befa9b4fc84ca03f28f12e585bfee64a73aa745c0029d313",
"id": "bb:394",
"start_pc": 394,
"type": "basic_block"
},
{
"end_pc": 429,
"hash": "0xaf4ea132ebcb8454f351f8251530d2ff4701246ba232bbc624b13f838d1abe64",
"id": "bb:419",
"start_pc": 419,
"type": "basic_block"
},
{
"end_pc": 431,
"hash": "0xb94b7d0cff9dd437d4743ffda5e29a0e3260dc6d855858ad6e90b2238ab68f94",
"id": "bb:430",
"start_pc": 430,
"type": "basic_block"
},
{
"end_pc": 438,
"hash": "0x2031410f9f25b073e186c45cbb2233381a76c4db09f0279d11449ddb93e23c1f",
"id": "bb:433",
"start_pc": 433,
"type": "basic_block"
},
{
"end_pc": 450,
"hash": "0x2aa0ff76b4255f2a69cb0250dc388d5fb92fefea93de9818f15e95a4c01ca6e3",
"id": "bb:439",
"start_pc": 439,
"type": "basic_block"
},
{
"end_pc": 512,
"hash": "0xaca70030f273f0626df8e24698774e07ac7aaa399013217034c92ac54f4342dc",
"id": "bb:451",
"start_pc": 451,
"type": "basic_block"
},
{
"end_pc": 527,
"hash": "0xecc8b5c3ad37b8f019fce39ab60fc62c0552e3a272f05b20abb723370887d020",
"id": "bb:513",
"start_pc": 513,
"type": "basic_block"
},
{
"end_pc": 614,
"hash": "0x8bfc41849491057a3d1abb24b966d562627648b7b3c5d6baa6c95021d5021d70",
"id": "bb:528",
"start_pc": 528,
"type": "basic_block"
},
{
"end_pc": 758,
"hash": "0x1b73b1e5e9f5676923a0e7b791fc30db233ac921e1da0efb9d180137e95c8593",
"id": "bb:615",
"start_pc": 615,
"type": "basic_block"
},
{
"end_pc": 864,
"hash": "0x749a23c7cfbccd86a11b7d3454828bfb0bcb89a72a9c7ace52d498dc36245e59",
"id": "bb:759",
"start_pc": 759,
"type": "basic_block"
},
{
"end_pc": 893,
"hash": "0x07fa76727ad473f8de597fdf08475cd87246b5d27cc5e66cea8e5b090e41e21f",
"id": "bb:865",
"start_pc": 865,
"type": "basic_block"
},
{
"end_pc": 1025,
"hash": "0xd368052c7f1e5c48cce65da3c03444acde68a9c9e1710fa8e465c56df29877c4",
"id": "bb:894",
"start_pc": 894,
"type": "basic_block"
},
{
"end_pc": 1038,
"hash": "0x5a98314b7d65f3f61d443ff6393cca83f69985a8360dcd76a8e25b3ffdd27cb0",
"id": "bb:1026",
"start_pc": 1026,
"type": "basic_block"
},
{
"end_pc": 1049,
"hash": "0x3f43743928186e3c289b8e2723e66d4db7f478b18e0b176c0efe04a1a0b43136",
"id": "bb:1039",
"start_pc": 1039,
"type": "basic_block"
},
{
"end_pc": 1061,
"hash": "0xbcfb5eb0cbbb9619a101925c76da827a0e395ee8fdf4cf021ff71a9c49cb32bc",
"id": "bb:1050",
"start_pc": 1050,
"type": "basic_block"
},
{
"end_pc": 1087,
"hash": "0xb3fbd9a872ee0fa2f4c49ebc057f30a9a3f53c84033aa0ecca960bbad4b4c0a9",
"id": "bb:1062",
"start_pc": 1062,
"type": "basic_block"
},
{
"end_pc": 1102,
"hash": "0xc8aa566a590afa04d032ed647b60ff79827533d15ce7ae4dbf692a3527217526",
"id": "bb:1088",
"start_pc": 1088,
"type": "basic_block"
},
{
"end_pc": 1181,
"hash": "0x91e632a03f6b536436c879e4294f818ab1368d7f4a0516e3d93f5eafce34ff3b",
"id": "bb:1103",
"start_pc": 1103,
"type": "basic_block"
},
{
"end_pc": 1204,
"hash": "0x75c8d446b9508934abcf8a68fb3f51198fb042b3dcc307bb3a6d50c883cfc7aa",
"id": "bb:1182",
"start_pc": 1182,
"type": "basic_block"
},
{
"end_pc": 1216,
"hash": "0x3c4df0c1c5b8e6e6fd541b5bf53751a943a5211aa3a80dbbe17b4ad3c5d585aa",
"id": "bb:1205",
"start_pc": 1205,
"type": "basic_block"
},
{
"end_pc": 1269,
"hash": "0x510cc1e68c5fc6a676ba77db092bc0f22ecd7af5b5342632b0ac7d09afb4bc15",
"id": "bb:1217",
"start_pc": 1217,
"type": "basic_block"
},
{
"end_pc": 1299,
"hash": "0x199042b036c780163119e88e5190ab7122a1ece7149af3686eff4120d101ac4c",
"id": "bb:1270",
"start_pc": 1270,
"type": "basic_block"
},
{
"end_pc": 1342,
"hash": "0xc833b9824e402a064b69cd8c791d53c8d20604bc0346f1fb2dd1cbc8fad02d54",
"id": "bb:1300",
"start_pc": 1300,
"type": "basic_block"
},
{
"end_pc": 1372,
"hash": "0x11ec8d71e26da21d53125a3ce00ef8d6857b8ea7040924a48dfaa65171245a4d",
"id": "bb:1343",
"start_pc": 1343,
"type": "basic_block"
},
{
"end_pc": 1589,
"hash": "0x02054584e06f4d9998b6c79a10921df40514ee80912d0c87210e7c861a324efc",
"id": "bb:1373",
"start_pc": 1373,
"type": "basic_block"
},
{
"end_pc": 1602,
"hash": "0x39baf8973d735e12c5eba37b936a8e569c54cf936a86235816afe7aad4db3cc0",
"id": "bb:1590",
"start_pc": 1590,
"type": "basic_block"
},
{
"end_pc": 1636,
"hash": "0xce1e47419a8afbde1300ee758de0477d0b9182a7264e6b1cb3c39dda5dc3b62c",
"id": "bb:1603",
"start_pc": 1603,
"type": "basic_block"
},
{
"end_pc": 1649,
"hash": "0xa7d361928073a6f33953546a6ff07558ebe46dec98551cc7f9ec48b6ebcaf323",
"id": "bb:1637",
"start_pc": 1637,
"type": "basic_block"
},
{
"end_pc": 1674,
"hash": "0x13f65ab3e7ed4d90a0d1a97f9721b2563391efd9abb1a13b9fe6286605d4f4e4",
"id": "bb:1650",
"start_pc": 1650,
"type": "basic_block"
},
{
"end_pc": 1687,
"hash": "0x13697bca6cb14fe48886a8101e00e9ad69c25c53e6ed703d4f74a193807cb6fd",
"id": "bb:1675",
"start_pc": 1675,
"type": "basic_block"
},
{
"end_pc": 1785,
"hash": "0x512ad13fa92f374051510deeccb452deb7e6147ee3e108b8cac8889e2e4c9e40",
"id": "bb:1688",
"start_pc": 1688,
"type": "basic_block"
},
{
"end_pc": 1786,
"hash": "0x87d2ff36bd4401a32e7a02aa78dc0329aaa1bc606cf50ea84275299ddf2c1a57",
"id": "bb:1786",
"start_pc": 1786,
"type": "basic_block"
},
{
"end_pc": 1788,
"hash": "0x470325709d62a92c86b548624dba5cd6cb46f1b45624589eecdd7ef8c5ad2ad2",
"id": "bb:1787",
"start_pc": 1787,
"type": "basic_block"
},
{
"id": "call:648",
"opcode": "CALL",
"pc": 648,
"type": "callsite"
},
{
"id": "call:1152",
"opcode": "CALL",
"pc": 1152,
"type": "callsite"
},
{
"id": "call:1283",
"opcode": "CALL",
"pc": 1283,
"type": "callsite"
},
{
"id": "call:1356",
"opcode": "CALL",
"pc": 1356,
"type": "callsite"
},
{
"id": "call:1635",
"opcode": "CALL",
"pc": 1635,
"type": "callsite"
},
{
"id": "sink:call",
"type": "sink"
},
{
"entry_pc": null,
"id": "fn:0xf7fc250f",
"selector": "0xf7fc250f",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0xe0c516ec",
"selector": "0xe0c516ec",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0x7dbda4fb",
"selector": "0x7dbda4fb",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0x81d1d3a6",
"selector": "0x81d1d3a6",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0x4f3739bc",
"selector": "0x4f3739bc",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0xcbc1cfd2",
"selector": "0xcbc1cfd2",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0x3ccfd60b",
"selector": "0x3ccfd60b",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0x990e9591",
"selector": "0x990e9591",
"type": "function"
},
{
"entry_pc": null,
"id": "fn:0xaadcfc8c",
"selector": "0xaadcfc8c",
"type": "function"
}
],
"version": "capability_graph_v1"
},
"id": 1589,
"updated_at": "2026-04-04T19:45:48.000000Z",
"version": "capability_graph_v1"
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.basic_blocks[] | select(.start_pc <= 700 and .end_pc >= 600)' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"end_pc": 614,
"hash": "0x8bfc41849491057a3d1abb24b966d562627648b7b3c5d6baa6c95021d5021d70",
"opcodes": [
"PUSH2",
"MLOAD",
"PUSH1",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"PUSH1",
"OP_81",
"MSTORE",
"PUSH2",
"MLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"OP_81",
"ADD",
"OP_90",
"POP",
"PUSH1",
"PUSH1",
"OP_82",
"SUB",
"MLOAD",
"MUL",
"OP_81",
"SHA3",
"OP_90",
"POP",
"DIV",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH2",
"MLOAD",
"SLT",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 528
}
{
"end_pc": 758,
"hash": "0x1b73b1e5e9f5676923a0e7b791fc30db233ac921e1da0efb9d180137e95c8593",
"opcodes": [
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH2",
"CALL",
"POP",
"PUSH1",
"PUSH1",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"ADD",
"PUSH2",
"MLOAD",
"OP_81",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH32",
"PUSH1",
"OP_82",
"OP_A1",
"POP",
"PUSH2",
"JUMP"
],
"start_pc": 615
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.basic_blocks[] | select(.start_pc <= 1200 and .end_pc >= 1100)' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"end_pc": 1102,
"hash": "0xc8aa566a590afa04d032ed647b60ff79827533d15ce7ae4dbf692a3527217526",
"opcodes": [
"JUMPDEST",
"PUSH2",
"MLOAD",
"PUSH2",
"MLOAD",
"SLT",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1088
}
{
"end_pc": 1181,
"hash": "0x91e632a03f6b536436c879e4294f818ab1368d7f4a0516e3d93f5eafce34ff3b",
"opcodes": [
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH2",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"MUL",
"SDIV",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH2",
"CALL",
"POP",
"PUSH1",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"ADD",
"PUSH2",
"MSTORE",
"PUSH2",
"JUMP"
],
"start_pc": 1103
}
{
"end_pc": 1204,
"hash": "0x75c8d446b9508934abcf8a68fb3f51198fb042b3dcc307bb3a6d50c883cfc7aa",
"opcodes": [
"JUMPDEST",
"PUSH20",
"SELFDESTRUCT"
],
"start_pc": 1182
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.basic_blocks[] | select(.start_pc <= 1700 and .end_pc >= 1600)' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"end_pc": 1602,
"hash": "0x39baf8973d735e12c5eba37b936a8e569c54cf936a86235816afe7aad4db3cc0",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1590
}
{
"end_pc": 1636,
"hash": "0xce1e47419a8afbde1300ee758de0477d0b9182a7264e6b1cb3c39dda5dc3b62c",
"opcodes": [
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH13",
"SLOAD",
"ADDRESS",
"BALANCE",
"SUB",
"PUSH1",
"SLOAD",
"PUSH2",
"CALL",
"POP"
],
"start_pc": 1603
}
{
"end_pc": 1649,
"hash": "0xa7d361928073a6f33953546a6ff07558ebe46dec98551cc7f9ec48b6ebcaf323",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1637
}
{
"end_pc": 1674,
"hash": "0x13f65ab3e7ed4d90a0d1a97f9721b2563391efd9abb1a13b9fe6286605d4f4e4",
"opcodes": [
"PUSH13",
"SLOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 1650
}
{
"end_pc": 1687,
"hash": "0x13697bca6cb14fe48886a8101e00e9ad69c25c53e6ed703d4f74a193807cb6fd",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1675
}
{
"end_pc": 1785,
"hash": "0x512ad13fa92f374051510deeccb452deb7e6147ee3e108b8cac8889e2e4c9e40",
"opcodes": [
"PUSH1",
"CALLDATALOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"PUSH1",
"OP_81",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"OP_81",
"ADD",
"OP_90",
"POP",
"PUSH1",
"PUSH1",
"OP_82",
"SUB",
"MSTORE",
"PUSH1",
"PUSH1",
"OP_82",
"SUB",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"PUSH1",
"OP_82",
"SUB",
"RETURN"
],
"start_pc": 1688
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.basic_blocks[] | select(.start_pc>=238 and .start_pc<=527)' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"end_pc": 250,
"hash": "0x52206599173960b4619b7dde9c43b71098fde1d6b0b308aace3eea1060619205",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 238
}
{
"end_pc": 261,
"hash": "0x42cf5e86b271d1c8f911f0ff9b60c2a2cc154355351f3b93fa123f5966a49461",
"opcodes": [
"PUSH1",
"SLOAD",
"CALLER",
"EQ",
"ISZERO",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 251
}
{
"end_pc": 273,
"hash": "0x76fc5f324604fb1b7779c876e183220063c9a52938df6201763324ef651edbbf",
"opcodes": [
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 262
}
{
"end_pc": 293,
"hash": "0xce7d03bd62f52b9f8f7dfa86f730b42fce1a0e9dd870a879ae771bfeec5f13f1",
"opcodes": [
"JUMPDEST",
"PUSH1",
"NUMBER",
"ADD",
"PUSH13",
"SSTORE"
],
"start_pc": 274
}
{
"end_pc": 306,
"hash": "0xb0ffd41e6c710557377b5a76168cf71382f82256cecb2f92e78afd6d2c41047b",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 294
}
{
"end_pc": 346,
"hash": "0x44e119f6c4ac756f505116731250c6056be7c97d1162ed012274d2d8b0f8c0c2",
"opcodes": [
"CALLDATASIZE",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"CALLDATASIZE",
"PUSH1",
"OP_82",
"CALLDATACOPY",
"PUSH1",
"CALLDATALOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"CALLDATALOAD",
"PUSH2",
"MSTORE",
"POP",
"PUSH1",
"SLOAD",
"CALLER",
"EQ",
"ISZERO",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 307
}
{
"end_pc": 358,
"hash": "0xb5fed0c5ad84e5e5f88376a0a94ed231476a76ab5e6878c0f4ccd5d8febda68c",
"opcodes": [
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 347
}
{
"end_pc": 381,
"hash": "0xc8da3cc4a6c2c23b9fb47bafcc393506d11bb128acf5ba11a78d25837a878495",
"opcodes": [
"JUMPDEST",
"NUMBER",
"PUSH13",
"SLOAD",
"SGT",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 359
}
{
"end_pc": 393,
"hash": "0x6fe0ba83733c68cb87b870009e3e4411896183b429d90d65d282d64e56e53c62",
"opcodes": [
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 382
}
{
"end_pc": 418,
"hash": "0xba9ce3fde6bb0a71befa9b4fc84ca03f28f12e585bfee64a73aa745c0029d313",
"opcodes": [
"JUMPDEST",
"PUSH1",
"SLOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"SHA3",
"PUSH2",
"MLOAD",
"EQ",
"ISZERO",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 394
}
{
"end_pc": 429,
"hash": "0xaf4ea132ebcb8454f351f8251530d2ff4701246ba232bbc624b13f838d1abe64",
"opcodes": [
"PUSH1",
"PUSH1",
"SLOAD",
"EQ",
"ISZERO",
"PUSH2",
"JUMP"
],
"start_pc": 419
}
{
"end_pc": 431,
"hash": "0xb94b7d0cff9dd437d4743ffda5e29a0e3260dc6d855858ad6e90b2238ab68f94",
"opcodes": [
"JUMPDEST",
"PUSH1"
],
"start_pc": 430
}
{
"end_pc": 438,
"hash": "0x2031410f9f25b073e186c45cbb2233381a76c4db09f0279d11449ddb93e23c1f",
"opcodes": [
"JUMPDEST",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 433
}
{
"end_pc": 450,
"hash": "0x2aa0ff76b4255f2a69cb0250dc388d5fb92fefea93de9818f15e95a4c01ca6e3",
"opcodes": [
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 439
}
{
"end_pc": 512,
"hash": "0xaca70030f273f0626df8e24698774e07ac7aaa399013217034c92ac54f4342dc",
"opcodes": [
"JUMPDEST",
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH13",
"SLOAD",
"PUSH2",
"MSTORE",
"PUSH31",
"PUSH2",
"MSTORE"
],
"start_pc": 451
}
{
"end_pc": 527,
"hash": "0xecc8b5c3ad37b8f019fce39ab60fc62c0552e3a272f05b20abb723370887d020",
"opcodes": [
"JUMPDEST",
"PUSH2",
"MLOAD",
"PUSH2",
"MLOAD",
"SLT",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 513
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.basic_blocks[] | select(.start_pc>=894 and .start_pc<=1372)' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"end_pc": 1025,
"hash": "0xd368052c7f1e5c48cce65da3c03444acde68a9c9e1710fa8e465c56df29877c4",
"opcodes": [
"JUMPDEST",
"PUSH1",
"PUSH13",
"SSTORE",
"PUSH2",
"MLOAD",
"PUSH1",
"SSTORE",
"PUSH3",
"TIMESTAMP",
"ADD",
"PUSH1",
"SSTORE",
"PUSH1",
"PUSH13",
"SSTORE",
"PUSH1",
"MLOAD",
"PUSH13",
"SSTORE",
"PUSH1",
"PUSH1",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"ADD",
"PUSH32",
"PUSH1",
"OP_82",
"OP_A1",
"POP",
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 894
}
{
"end_pc": 1038,
"hash": "0x5a98314b7d65f3f61d443ff6393cca83f69985a8360dcd76a8e25b3ffdd27cb0",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1026
}
{
"end_pc": 1049,
"hash": "0x3f43743928186e3c289b8e2723e66d4db7f478b18e0b176c0efe04a1a0b43136",
"opcodes": [
"PUSH1",
"SLOAD",
"TIMESTAMP",
"SGT",
"ISZERO",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1039
}
{
"end_pc": 1061,
"hash": "0xbcfb5eb0cbbb9619a101925c76da827a0e395ee8fdf4cf021ff71a9c49cb32bc",
"opcodes": [
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 1050
}
{
"end_pc": 1087,
"hash": "0xb3fbd9a872ee0fa2f4c49ebc057f30a9a3f53c84033aa0ecca960bbad4b4c0a9",
"opcodes": [
"JUMPDEST",
"PUSH1",
"PUSH2",
"MSTORE",
"PUSH13",
"SLOAD",
"PUSH2",
"MSTORE"
],
"start_pc": 1062
}
{
"end_pc": 1102,
"hash": "0xc8aa566a590afa04d032ed647b60ff79827533d15ce7ae4dbf692a3527217526",
"opcodes": [
"JUMPDEST",
"PUSH2",
"MLOAD",
"PUSH2",
"MLOAD",
"SLT",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1088
}
{
"end_pc": 1181,
"hash": "0x91e632a03f6b536436c879e4294f818ab1368d7f4a0516e3d93f5eafce34ff3b",
"opcodes": [
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH2",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"MUL",
"SDIV",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH2",
"CALL",
"POP",
"PUSH1",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"ADD",
"PUSH2",
"MSTORE",
"PUSH2",
"JUMP"
],
"start_pc": 1103
}
{
"end_pc": 1204,
"hash": "0x75c8d446b9508934abcf8a68fb3f51198fb042b3dcc307bb3a6d50c883cfc7aa",
"opcodes": [
"JUMPDEST",
"PUSH20",
"SELFDESTRUCT"
],
"start_pc": 1182
}
{
"end_pc": 1216,
"hash": "0x3c4df0c1c5b8e6e6fd541b5bf53751a943a5211aa3a80dbbe17b4ad3c5d585aa",
"opcodes": [
"JUMPDEST",
"PUSH3",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1205
}
{
"end_pc": 1269,
"hash": "0x510cc1e68c5fc6a676ba77db092bc0f22ecd7af5b5342632b0ac7d09afb4bc15",
"opcodes": [
"CALLDATASIZE",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"CALLDATASIZE",
"PUSH1",
"OP_82",
"CALLDATACOPY",
"PUSH1",
"CALLDATALOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"CALLDATALOAD",
"PUSH2",
"MSTORE",
"POP",
"PUSH1",
"PUSH13",
"SLOAD",
"SLT",
"ISZERO",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1217
}
{
"end_pc": 1299,
"hash": "0x199042b036c780163119e88e5190ab7122a1ece7149af3686eff4120d101ac4c",
"opcodes": [
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"CALLVALUE",
"CALLER",
"PUSH2",
"CALL",
"POP",
"PUSH1",
"PUSH1",
"SUB",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 1270
}
{
"end_pc": 1342,
"hash": "0xc833b9824e402a064b69cd8c791d53c8d20604bc0346f1fb2dd1cbc8fad02d54",
"opcodes": [
"JUMPDEST",
"PUSH2",
"MLOAD",
"PUSH2",
"CALLVALUE",
"MUL",
"SDIV",
"PUSH2",
"MSTORE",
"PUSH2",
"MLOAD",
"PUSH13",
"SLOAD",
"ADDRESS",
"BALANCE",
"SUB",
"SLT",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1300
}
{
"end_pc": 1372,
"hash": "0x11ec8d71e26da21d53125a3ce00ef8d6857b8ea7040924a48dfaa65171245a4d",
"opcodes": [
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"CALLVALUE",
"CALLER",
"PUSH2",
"CALL",
"POP",
"PUSH1",
"PUSH1",
"SUB",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 1343
}
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json.basic_blocks[] | select(.start_pc>=1373 and .start_pc<=1788)' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"end_pc": 1589,
"hash": "0x02054584e06f4d9998b6c79a10921df40514ee80912d0c87210e7c861a324efc",
"opcodes": [
"JUMPDEST",
"PUSH2",
"MLOAD",
"PUSH13",
"SLOAD",
"ADD",
"PUSH13",
"SSTORE",
"PUSH13",
"SLOAD",
"PUSH2",
"MSTORE",
"CALLER",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SSTORE",
"PUSH2",
"MLOAD",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SSTORE",
"PUSH2",
"MLOAD",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SSTORE",
"PUSH2",
"MLOAD",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"ADD",
"PUSH13",
"SSTORE",
"PUSH1",
"PUSH1",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"ADD",
"CALLER",
"OP_81",
"MSTORE",
"CALLVALUE",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH2",
"MLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH32",
"PUSH1",
"OP_82",
"OP_A1",
"POP",
"PUSH2",
"MLOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 1373
}
{
"end_pc": 1602,
"hash": "0x39baf8973d735e12c5eba37b936a8e569c54cf936a86235816afe7aad4db3cc0",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1590
}
{
"end_pc": 1636,
"hash": "0xce1e47419a8afbde1300ee758de0477d0b9182a7264e6b1cb3c39dda5dc3b62c",
"opcodes": [
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH1",
"PUSH13",
"SLOAD",
"ADDRESS",
"BALANCE",
"SUB",
"PUSH1",
"SLOAD",
"PUSH2",
"CALL",
"POP"
],
"start_pc": 1603
}
{
"end_pc": 1649,
"hash": "0xa7d361928073a6f33953546a6ff07558ebe46dec98551cc7f9ec48b6ebcaf323",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1637
}
{
"end_pc": 1674,
"hash": "0x13f65ab3e7ed4d90a0d1a97f9721b2563391efd9abb1a13b9fe6286605d4f4e4",
"opcodes": [
"PUSH13",
"SLOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"PUSH2",
"RETURN"
],
"start_pc": 1650
}
{
"end_pc": 1687,
"hash": "0x13697bca6cb14fe48886a8101e00e9ad69c25c53e6ed703d4f74a193807cb6fd",
"opcodes": [
"JUMPDEST",
"PUSH4",
"OP_81",
"EQ",
"ISZERO",
"PUSH2",
"JUMPI"
],
"start_pc": 1675
}
{
"end_pc": 1785,
"hash": "0x512ad13fa92f374051510deeccb452deb7e6147ee3e108b8cac8889e2e4c9e40",
"opcodes": [
"PUSH1",
"CALLDATALOAD",
"PUSH2",
"MSTORE",
"PUSH1",
"MSIZE",
"OP_90",
"MSIZE",
"ADD",
"PUSH1",
"OP_90",
"MSTORE",
"PUSH1",
"OP_81",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"PUSH2",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"SLOAD",
"PUSH1",
"OP_82",
"ADD",
"MSTORE",
"PUSH1",
"OP_81",
"ADD",
"OP_90",
"POP",
"PUSH1",
"PUSH1",
"OP_82",
"SUB",
"MSTORE",
"PUSH1",
"PUSH1",
"OP_82",
"SUB",
"MLOAD",
"MUL",
"PUSH1",
"ADD",
"PUSH1",
"OP_82",
"SUB",
"RETURN"
],
"start_pc": 1688
}
{
"end_pc": 1786,
"hash": "0x87d2ff36bd4401a32e7a02aa78dc0329aaa1bc606cf50ea84275299ddf2c1a57",
"opcodes": [
"POP"
],
"start_pc": 1786
}
{
"end_pc": 1788,
"hash": "0x470325709d62a92c86b548624dba5cd6cb46f1b45624589eecdd7ef8c5ad2ad2",
"opcodes": [
"JUMPDEST",
"POP"
],
"start_pc": 1787
}
exec
/bin/bash -lc "jq '.artifact | keys' BYTECODE_BUNDLE.json" in /tmp/codex-q9mrotit
succeeded in 0ms:
[
"codehash",
"compiler_json",
"implementation_address",
"is_proxy",
"runtime_bytecode",
"verified_source"
]
exec
/bin/bash -lc "jq '.artifact' BYTECODE_BUNDLE.json | sed -n '1,160p'" in /tmp/codex-q9mrotit
succeeded in 0ms:
{
"codehash": "0x73eac4fcdff0980bf8b760531ebf17fc623926ec16089c78062957150e32e523",
"compiler_json": {
"etherscan": {
"skipped": true
}
},
"implementation_address": null,
"is_proxy": false,
"runtime_bytecode": {
"full": "0x600061045f537c0100000000000000000000000000000000000000000000000000000000600035046c1000000000000000000000000060205263f7fc250f8114156100505760015460605260206060f35b63e0c516ec811415610077576c400000000000000000000000045430310360805260206080f35b637dbda4fb8114156100ee576020516c400000000000000000000000055414156100ad57600160000360a052602060a0f36100ed565b436c400000000000000000000000055413156100e157436c40000000000000000000000005540360c052602060c0f36100ec565b600060e052602060e0f35b5b5b6381d1d3a68114156101265760005433141515610112576000610100526020610100f35b600543016c40000000000000000000000005555b634f3739bc81141561040257365990590160009052366004823760043561014052602435610160525060005433141515610167576000610180526020610180f35b436c4000000000000000000000000554131561018a5760006101a05260206101a0f35b6001546101c05260206101c020610140511415156101ae57600060015414156101b1565b60005b156101c35760006101e05260206101e0f35b6000610200526c4000000000000000000000000354610220527e4189374bc6a7ef9db22d0e5604189374bc6a7ef9db22d0e5604189374bc6a7610240525b6102205161020051121561037e5761024051606059905901600090526002815261014051602082015260046102005102600401546040820152602081019050602060208203510281209050046102605260046102005102600601546102605112156102f757600060006000600060046102005102600501546004610200510260030154611388f150601c60a05990590160009052016102005181526004610200510260030154602082015260046102005102600501546040820152600461020051026006015460608201527fab09721a4ae05073358d023b9649596f7c6b1c3dc68ab166ea65239d0842c453608082a150610361565b601c60a05990590160009052016102005181526004610200510260030154602082015260046102005102600501546040820152600461020051026006015460608201527fc23655ee45230bbc23257253de9eba1ffd39f0b6cadfdf7994624201838da81f608082a1505b600060046102005102600301556001610200510161020052610201565b60006c4000000000000000000000000355610160516001556202a300420160025560006c40000000000000000000000004556020516c4000000000000000000000000555601c60205990590160009052017f04d83c8059bd80db11b4f1e1043ec8e6b4bdbfcb139c0eb0f73e92a5278e01ca600082a15060016102e05260206102e0f35b63cbc1cfd28114156104b55760025442131515610426576000610300526020610300f35b6000610200526c4000000000000000000000000354610220525b6102205161020051121561049e5760006000600060006103e86004610200510260060154600461020051026005015402056004610200510260030154611388f150600060046102005102600301556001610200510161020052610440565b73de0b295669a9fd93d5f28d9ec85e40f4cb697baeff5b62a044ac81141561063657365990590160009052366004823760043561032052602435610340525060646c40000000000000000000000003541215156105145760006000600060003433611388f1506001600003610360526020610360f35b610340516103e834020561038052610380516c4000000000000000000000000454303103121561055d5760006000600060003433611388f15060026000036103a05260206103a0f35b610380516c4000000000000000000000000454016c40000000000000000000000004556c40000000000000000000000003546103c0523360046103c05102600301556103205160046103c05102600401556103805160046103c05102600501556103405160046103c051026006015560016103c051016c4000000000000000000000000355601c60805990590160009052013381523460208201526103405160408201527ff41b7910e085d0992d604fd470931728fd77cc8eb504d99e50e51a0a30fcfd1a606082a1506103c0516103e05260206103e0f35b633ccfd60b8114156106655760006000600060006c4000000000000000000000000454303103600054611388f1505b63990e959181141561068b576c4000000000000000000000000354610400526020610400f35b63aadcfc8c8114156106fb576004356103c052608059905901600090526003815260046103c0510260030154602082015260046103c0510260050154604082015260046103c0510260060154606082015260208101905060206040820352602060208203510260400160408203f3505b50",
"head": null,
"length": 3580,
"tail": null,
"truncated": false
},
"verified_source": false
}
exec
/bin/bash -lc 'which cast' in /tmp/codex-q9mrotit
exec
/bin/bash -lc 'which evm' in /tmp/codex-q9mrotit
exited 1 in 0ms:
succeeded in 0ms:
/home/noahkuhn/.foundry/bin/cast
exec
/bin/bash -lc 'which python3' in /tmp/codex-q9mrotit
succeeded in 0ms:
/var/www/tripwire/.venv/bin/python3
exec
/bin/bash -lc 'cast disassemble $(jq -r '"'.artifact.runtime_bytecode.full' BYTECODE_BUNDLE.json) | sed -n '1,260p'" in /tmp/codex-q9mrotit
succeeded in 0ms:
00000000: PUSH1 0x00
00000002: PUSH2 0x045f
00000005: MSTORE8
00000006: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
00000024: PUSH1 0x00
00000026: CALLDATALOAD
00000027: DIV
00000028: PUSH13 0x10000000000000000000000000
00000036: PUSH1 0x20
00000038: MSTORE
00000039: PUSH4 0xf7fc250f
0000003e: DUP2
0000003f: EQ
00000040: ISZERO
00000041: PUSH2 0x0050
00000044: JUMPI
00000045: PUSH1 0x01
00000047: SLOAD
00000048: PUSH1 0x60
0000004a: MSTORE
0000004b: PUSH1 0x20
0000004d: PUSH1 0x60
0000004f: RETURN
00000050: JUMPDEST
00000051: PUSH4 0xe0c516ec
00000056: DUP2
00000057: EQ
00000058: ISZERO
00000059: PUSH2 0x0077
0000005c: JUMPI
0000005d: PUSH13 0x40000000000000000000000004
0000006b: SLOAD
0000006c: ADDRESS
0000006d: BALANCE
0000006e: SUB
0000006f: PUSH1 0x80
00000071: MSTORE
00000072: PUSH1 0x20
00000074: PUSH1 0x80
00000076: RETURN
00000077: JUMPDEST
00000078: PUSH4 0x7dbda4fb
0000007d: DUP2
0000007e: EQ
0000007f: ISZERO
00000080: PUSH2 0x00ee
00000083: JUMPI
00000084: PUSH1 0x20
00000086: MLOAD
00000087: PUSH13 0x40000000000000000000000005
00000095: SLOAD
00000096: EQ
00000097: ISZERO
00000098: PUSH2 0x00ad
0000009b: JUMPI
0000009c: PUSH1 0x01
0000009e: PUSH1 0x00
000000a0: SUB
000000a1: PUSH1 0xa0
000000a3: MSTORE
000000a4: PUSH1 0x20
000000a6: PUSH1 0xa0
000000a8: RETURN
000000a9: PUSH2 0x00ed
000000ac: JUMP
000000ad: JUMPDEST
000000ae: NUMBER
000000af: PUSH13 0x40000000000000000000000005
000000bd: SLOAD
000000be: SGT
000000bf: ISZERO
000000c0: PUSH2 0x00e1
000000c3: JUMPI
000000c4: NUMBER
000000c5: PUSH13 0x40000000000000000000000005
000000d3: SLOAD
000000d4: SUB
000000d5: PUSH1 0xc0
000000d7: MSTORE
000000d8: PUSH1 0x20
000000da: PUSH1 0xc0
000000dc: RETURN
000000dd: PUSH2 0x00ec
000000e0: JUMP
000000e1: JUMPDEST
000000e2: PUSH1 0x00
000000e4: PUSH1 0xe0
000000e6: MSTORE
000000e7: PUSH1 0x20
000000e9: PUSH1 0xe0
000000eb: RETURN
000000ec: JUMPDEST
000000ed: JUMPDEST
000000ee: JUMPDEST
000000ef: PUSH4 0x81d1d3a6
000000f4: DUP2
000000f5: EQ
000000f6: ISZERO
000000f7: PUSH2 0x0126
000000fa: JUMPI
000000fb: PUSH1 0x00
000000fd: SLOAD
000000fe: CALLER
000000ff: EQ
00000100: ISZERO
00000101: ISZERO
00000102: PUSH2 0x0112
00000105: JUMPI
00000106: PUSH1 0x00
00000108: PUSH2 0x0100
0000010b: MSTORE
0000010c: PUSH1 0x20
0000010e: PUSH2 0x0100
00000111: RETURN
00000112: JUMPDEST
00000113: PUSH1 0x05
00000115: NUMBER
00000116: ADD
00000117: PUSH13 0x40000000000000000000000005
00000125: SSTORE
00000126: JUMPDEST
00000127: PUSH4 0x4f3739bc
0000012c: DUP2
0000012d: EQ
0000012e: ISZERO
0000012f: PUSH2 0x0402
00000132: JUMPI
00000133: CALLDATASIZE
00000134: MSIZE
00000135: SWAP1
00000136: MSIZE
00000137: ADD
00000138: PUSH1 0x00
0000013a: SWAP1
0000013b: MSTORE
0000013c: CALLDATASIZE
0000013d: PUSH1 0x04
0000013f: DUP3
00000140: CALLDATACOPY
00000141: PUSH1 0x04
00000143: CALLDATALOAD
00000144: PUSH2 0x0140
00000147: MSTORE
00000148: PUSH1 0x24
0000014a: CALLDATALOAD
0000014b: PUSH2 0x0160
0000014e: MSTORE
0000014f: POP
00000150: PUSH1 0x00
00000152: SLOAD
00000153: CALLER
00000154: EQ
00000155: ISZERO
00000156: ISZERO
00000157: PUSH2 0x0167
0000015a: JUMPI
0000015b: PUSH1 0x00
0000015d: PUSH2 0x0180
00000160: MSTORE
00000161: PUSH1 0x20
00000163: PUSH2 0x0180
00000166: RETURN
00000167: JUMPDEST
00000168: NUMBER
00000169: PUSH13 0x40000000000000000000000005
00000177: SLOAD
00000178: SGT
00000179: ISZERO
0000017a: PUSH2 0x018a
0000017d: JUMPI
0000017e: PUSH1 0x00
00000180: PUSH2 0x01a0
00000183: MSTORE
00000184: PUSH1 0x20
00000186: PUSH2 0x01a0
00000189: RETURN
0000018a: JUMPDEST
0000018b: PUSH1 0x01
0000018d: SLOAD
0000018e: PUSH2 0x01c0
00000191: MSTORE
00000192: PUSH1 0x20
00000194: PUSH2 0x01c0
00000197: KECCAK256
00000198: PUSH2 0x0140
0000019b: MLOAD
0000019c: EQ
0000019d: ISZERO
0000019e: ISZERO
0000019f: PUSH2 0x01ae
000001a2: JUMPI
000001a3: PUSH1 0x00
000001a5: PUSH1 0x01
000001a7: SLOAD
000001a8: EQ
000001a9: ISZERO
000001aa: PUSH2 0x01b1
000001ad: JUMP
000001ae: JUMPDEST
000001af: PUSH1 0x00
000001b1: JUMPDEST
000001b2: ISZERO
000001b3: PUSH2 0x01c3
000001b6: JUMPI
000001b7: PUSH1 0x00
000001b9: PUSH2 0x01e0
000001bc: MSTORE
000001bd: PUSH1 0x20
000001bf: PUSH2 0x01e0
000001c2: RETURN
000001c3: JUMPDEST
000001c4: PUSH1 0x00
000001c6: PUSH2 0x0200
000001c9: MSTORE
000001ca: PUSH13 0x40000000000000000000000003
000001d8: SLOAD
000001d9: PUSH2 0x0220
000001dc: MSTORE
000001dd: PUSH31 0x4189374bc6a7ef9db22d0e5604189374bc6a7ef9db22d0e5604189374bc6a7
000001fd: PUSH2 0x0240
00000200: MSTORE
00000201: JUMPDEST
00000202: PUSH2 0x0220
00000205: MLOAD
00000206: PUSH2 0x0200
00000209: MLOAD
0000020a: SLT
0000020b: ISZERO
0000020c: PUSH2 0x037e
0000020f: JUMPI
00000210: PUSH2 0x0240
00000213: MLOAD
00000214: PUSH1 0x60
00000216: MSIZE
00000217: SWAP1
00000218: MSIZE
00000219: ADD
0000021a: PUSH1 0x00
0000021c: SWAP1
0000021d: MSTORE
0000021e: PUSH1 0x02
00000220: DUP2
00000221: MSTORE
00000222: PUSH2 0x0140
00000225: MLOAD
00000226: PUSH1 0x20
00000228: DUP3
00000229: ADD
0000022a: MSTORE
0000022b: PUSH1 0x04
0000022d: PUSH2 0x0200
00000230: MLOAD
00000231: MUL
00000232: PUSH1 0x04
00000234: ADD
00000235: SLOAD
00000236: PUSH1 0x40
00000238: DUP3
00000239: ADD
0000023a: MSTORE
exec
/bin/bash -lc 'cast disassemble $(jq -r '"'.artifact.runtime_bytecode.full' BYTECODE_BUNDLE.json) | sed -n '261,520p'" in /tmp/codex-q9mrotit
succeeded in 0ms:
0000023b: PUSH1 0x20
0000023d: DUP2
0000023e: ADD
0000023f: SWAP1
00000240: POP
00000241: PUSH1 0x20
00000243: PUSH1 0x20
00000245: DUP3
00000246: SUB
00000247: MLOAD
00000248: MUL
00000249: DUP2
0000024a: KECCAK256
0000024b: SWAP1
0000024c: POP
0000024d: DIV
0000024e: PUSH2 0x0260
00000251: MSTORE
00000252: PUSH1 0x04
00000254: PUSH2 0x0200
00000257: MLOAD
00000258: MUL
00000259: PUSH1 0x06
0000025b: ADD
0000025c: SLOAD
0000025d: PUSH2 0x0260
00000260: MLOAD
00000261: SLT
00000262: ISZERO
00000263: PUSH2 0x02f7
00000266: JUMPI
00000267: PUSH1 0x00
00000269: PUSH1 0x00
0000026b: PUSH1 0x00
0000026d: PUSH1 0x00
0000026f: PUSH1 0x04
00000271: PUSH2 0x0200
00000274: MLOAD
00000275: MUL
00000276: PUSH1 0x05
00000278: ADD
00000279: SLOAD
0000027a: PUSH1 0x04
0000027c: PUSH2 0x0200
0000027f: MLOAD
00000280: MUL
00000281: PUSH1 0x03
00000283: ADD
00000284: SLOAD
00000285: PUSH2 0x1388
00000288: CALL
00000289: POP
0000028a: PUSH1 0x1c
0000028c: PUSH1 0xa0
0000028e: MSIZE
0000028f: SWAP1
00000290: MSIZE
00000291: ADD
00000292: PUSH1 0x00
00000294: SWAP1
00000295: MSTORE
00000296: ADD
00000297: PUSH2 0x0200
0000029a: MLOAD
0000029b: DUP2
0000029c: MSTORE
0000029d: PUSH1 0x04
0000029f: PUSH2 0x0200
000002a2: MLOAD
000002a3: MUL
000002a4: PUSH1 0x03
000002a6: ADD
000002a7: SLOAD
000002a8: PUSH1 0x20
000002aa: DUP3
000002ab: ADD
000002ac: MSTORE
000002ad: PUSH1 0x04
000002af: PUSH2 0x0200
000002b2: MLOAD
000002b3: MUL
000002b4: PUSH1 0x05
000002b6: ADD
000002b7: SLOAD
000002b8: PUSH1 0x40
000002ba: DUP3
000002bb: ADD
000002bc: MSTORE
000002bd: PUSH1 0x04
000002bf: PUSH2 0x0200
000002c2: MLOAD
000002c3: MUL
000002c4: PUSH1 0x06
000002c6: ADD
000002c7: SLOAD
000002c8: PUSH1 0x60
000002ca: DUP3
000002cb: ADD
000002cc: MSTORE
000002cd: PUSH32 0xab09721a4ae05073358d023b9649596f7c6b1c3dc68ab166ea65239d0842c453
000002ee: PUSH1 0x80
000002f0: DUP3
000002f1: LOG1
000002f2: POP
000002f3: PUSH2 0x0361
000002f6: JUMP
000002f7: JUMPDEST
000002f8: PUSH1 0x1c
000002fa: PUSH1 0xa0
000002fc: MSIZE
000002fd: SWAP1
000002fe: MSIZE
000002ff: ADD
00000300: PUSH1 0x00
00000302: SWAP1
00000303: MSTORE
00000304: ADD
00000305: PUSH2 0x0200
00000308: MLOAD
00000309: DUP2
0000030a: MSTORE
0000030b: PUSH1 0x04
0000030d: PUSH2 0x0200
00000310: MLOAD
00000311: MUL
00000312: PUSH1 0x03
00000314: ADD
00000315: SLOAD
00000316: PUSH1 0x20
00000318: DUP3
00000319: ADD
0000031a: MSTORE
0000031b: PUSH1 0x04
0000031d: PUSH2 0x0200
00000320: MLOAD
00000321: MUL
00000322: PUSH1 0x05
00000324: ADD
00000325: SLOAD
00000326: PUSH1 0x40
00000328: DUP3
00000329: ADD
0000032a: MSTORE
0000032b: PUSH1 0x04
0000032d: PUSH2 0x0200
00000330: MLOAD
00000331: MUL
00000332: PUSH1 0x06
00000334: ADD
00000335: SLOAD
00000336: PUSH1 0x60
00000338: DUP3
00000339: ADD
0000033a: MSTORE
0000033b: PUSH32 0xc23655ee45230bbc23257253de9eba1ffd39f0b6cadfdf7994624201838da81f
0000035c: PUSH1 0x80
0000035e: DUP3
0000035f: LOG1
00000360: POP
00000361: JUMPDEST
00000362: PUSH1 0x00
00000364: PUSH1 0x04
00000366: PUSH2 0x0200
00000369: MLOAD
0000036a: MUL
0000036b: PUSH1 0x03
0000036d: ADD
0000036e: SSTORE
0000036f: PUSH1 0x01
00000371: PUSH2 0x0200
00000374: MLOAD
00000375: ADD
00000376: PUSH2 0x0200
00000379: MSTORE
0000037a: PUSH2 0x0201
0000037d: JUMP
0000037e: JUMPDEST
0000037f: PUSH1 0x00
00000381: PUSH13 0x40000000000000000000000003
0000038f: SSTORE
00000390: PUSH2 0x0160
00000393: MLOAD
00000394: PUSH1 0x01
00000396: SSTORE
00000397: PUSH3 0x02a300
0000039b: TIMESTAMP
0000039c: ADD
0000039d: PUSH1 0x02
0000039f: SSTORE
000003a0: PUSH1 0x00
000003a2: PUSH13 0x40000000000000000000000004
000003b0: SSTORE
000003b1: PUSH1 0x20
000003b3: MLOAD
000003b4: PUSH13 0x40000000000000000000000005
000003c2: SSTORE
000003c3: PUSH1 0x1c
000003c5: PUSH1 0x20
000003c7: MSIZE
000003c8: SWAP1
000003c9: MSIZE
000003ca: ADD
000003cb: PUSH1 0x00
000003cd: SWAP1
000003ce: MSTORE
000003cf: ADD
000003d0: PUSH32 0x04d83c8059bd80db11b4f1e1043ec8e6b4bdbfcb139c0eb0f73e92a5278e01ca
000003f1: PUSH1 0x00
000003f3: DUP3
000003f4: LOG1
000003f5: POP
000003f6: PUSH1 0x01
000003f8: PUSH2 0x02e0
000003fb: MSTORE
000003fc: PUSH1 0x20
000003fe: PUSH2 0x02e0
00000401: RETURN
00000402: JUMPDEST
00000403: PUSH4 0xcbc1cfd2
00000408: DUP2
00000409: EQ
0000040a: ISZERO
0000040b: PUSH2 0x04b5
0000040e: JUMPI
0000040f: PUSH1 0x02
00000411: SLOAD
00000412: TIMESTAMP
00000413: SGT
00000414: ISZERO
00000415: ISZERO
00000416: PUSH2 0x0426
00000419: JUMPI
0000041a: PUSH1 0x00
0000041c: PUSH2 0x0300
0000041f: MSTORE
00000420: PUSH1 0x20
00000422: PUSH2 0x0300
00000425: RETURN
00000426: JUMPDEST
00000427: PUSH1 0x00
00000429: PUSH2 0x0200
0000042c: MSTORE
0000042d: PUSH13 0x40000000000000000000000003
0000043b: SLOAD
0000043c: PUSH2 0x0220
0000043f: MSTORE
00000440: JUMPDEST
00000441: PUSH2 0x0220
00000444: MLOAD
00000445: PUSH2 0x0200
00000448: MLOAD
00000449: SLT
0000044a: ISZERO
0000044b: PUSH2 0x049e
0000044e: JUMPI
0000044f: PUSH1 0x00
00000451: PUSH1 0x00
00000453: PUSH1 0x00
00000455: PUSH1 0x00
00000457: PUSH2 0x03e8
exec
/bin/bash -lc 'cast disassemble $(jq -r '"'.artifact.runtime_bytecode.full' BYTECODE_BUNDLE.json) | sed -n '521,780p'" in /tmp/codex-q9mrotit
succeeded in 0ms:
0000045a: PUSH1 0x04
0000045c: PUSH2 0x0200
0000045f: MLOAD
00000460: MUL
00000461: PUSH1 0x06
00000463: ADD
00000464: SLOAD
00000465: PUSH1 0x04
00000467: PUSH2 0x0200
0000046a: MLOAD
0000046b: MUL
0000046c: PUSH1 0x05
0000046e: ADD
0000046f: SLOAD
00000470: MUL
00000471: SDIV
00000472: PUSH1 0x04
00000474: PUSH2 0x0200
00000477: MLOAD
00000478: MUL
00000479: PUSH1 0x03
0000047b: ADD
0000047c: SLOAD
0000047d: PUSH2 0x1388
00000480: CALL
00000481: POP
00000482: PUSH1 0x00
00000484: PUSH1 0x04
00000486: PUSH2 0x0200
00000489: MLOAD
0000048a: MUL
0000048b: PUSH1 0x03
0000048d: ADD
0000048e: SSTORE
0000048f: PUSH1 0x01
00000491: PUSH2 0x0200
00000494: MLOAD
00000495: ADD
00000496: PUSH2 0x0200
00000499: MSTORE
0000049a: PUSH2 0x0440
0000049d: JUMP
0000049e: JUMPDEST
0000049f: PUSH20 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae
000004b4: SELFDESTRUCT
000004b5: JUMPDEST
000004b6: PUSH3 0xa044ac
000004ba: DUP2
000004bb: EQ
000004bc: ISZERO
000004bd: PUSH2 0x0636
000004c0: JUMPI
000004c1: CALLDATASIZE
000004c2: MSIZE
000004c3: SWAP1
000004c4: MSIZE
000004c5: ADD
000004c6: PUSH1 0x00
000004c8: SWAP1
000004c9: MSTORE
000004ca: CALLDATASIZE
000004cb: PUSH1 0x04
000004cd: DUP3
000004ce: CALLDATACOPY
000004cf: PUSH1 0x04
000004d1: CALLDATALOAD
000004d2: PUSH2 0x0320
000004d5: MSTORE
000004d6: PUSH1 0x24
000004d8: CALLDATALOAD
000004d9: PUSH2 0x0340
000004dc: MSTORE
000004dd: POP
000004de: PUSH1 0x64
000004e0: PUSH13 0x40000000000000000000000003
000004ee: SLOAD
000004ef: SLT
000004f0: ISZERO
000004f1: ISZERO
000004f2: PUSH2 0x0514
000004f5: JUMPI
000004f6: PUSH1 0x00
000004f8: PUSH1 0x00
000004fa: PUSH1 0x00
000004fc: PUSH1 0x00
000004fe: CALLVALUE
000004ff: CALLER
00000500: PUSH2 0x1388
00000503: CALL
00000504: POP
00000505: PUSH1 0x01
00000507: PUSH1 0x00
00000509: SUB
0000050a: PUSH2 0x0360
0000050d: MSTORE
0000050e: PUSH1 0x20
00000510: PUSH2 0x0360
00000513: RETURN
00000514: JUMPDEST
00000515: PUSH2 0x0340
00000518: MLOAD
00000519: PUSH2 0x03e8
0000051c: CALLVALUE
0000051d: MUL
0000051e: SDIV
0000051f: PUSH2 0x0380
00000522: MSTORE
00000523: PUSH2 0x0380
00000526: MLOAD
00000527: PUSH13 0x40000000000000000000000004
00000535: SLOAD
00000536: ADDRESS
00000537: BALANCE
00000538: SUB
00000539: SLT
0000053a: ISZERO
0000053b: PUSH2 0x055d
0000053e: JUMPI
0000053f: PUSH1 0x00
00000541: PUSH1 0x00
00000543: PUSH1 0x00
00000545: PUSH1 0x00
00000547: CALLVALUE
00000548: CALLER
00000549: PUSH2 0x1388
0000054c: CALL
0000054d: POP
0000054e: PUSH1 0x02
00000550: PUSH1 0x00
00000552: SUB
00000553: PUSH2 0x03a0
00000556: MSTORE
00000557: PUSH1 0x20
00000559: PUSH2 0x03a0
0000055c: RETURN
0000055d: JUMPDEST
0000055e: PUSH2 0x0380
00000561: MLOAD
00000562: PUSH13 0x40000000000000000000000004
00000570: SLOAD
00000571: ADD
00000572: PUSH13 0x40000000000000000000000004
00000580: SSTORE
00000581: PUSH13 0x40000000000000000000000003
0000058f: SLOAD
00000590: PUSH2 0x03c0
00000593: MSTORE
00000594: CALLER
00000595: PUSH1 0x04
00000597: PUSH2 0x03c0
0000059a: MLOAD
0000059b: MUL
0000059c: PUSH1 0x03
0000059e: ADD
0000059f: SSTORE
000005a0: PUSH2 0x0320
000005a3: MLOAD
000005a4: PUSH1 0x04
000005a6: PUSH2 0x03c0
000005a9: MLOAD
000005aa: MUL
000005ab: PUSH1 0x04
000005ad: ADD
000005ae: SSTORE
000005af: PUSH2 0x0380
000005b2: MLOAD
000005b3: PUSH1 0x04
000005b5: PUSH2 0x03c0
000005b8: MLOAD
000005b9: MUL
000005ba: PUSH1 0x05
000005bc: ADD
000005bd: SSTORE
000005be: PUSH2 0x0340
000005c1: MLOAD
000005c2: PUSH1 0x04
000005c4: PUSH2 0x03c0
000005c7: MLOAD
000005c8: MUL
000005c9: PUSH1 0x06
000005cb: ADD
000005cc: SSTORE
000005cd: PUSH1 0x01
000005cf: PUSH2 0x03c0
000005d2: MLOAD
000005d3: ADD
000005d4: PUSH13 0x40000000000000000000000003
000005e2: SSTORE
000005e3: PUSH1 0x1c
000005e5: PUSH1 0x80
000005e7: MSIZE
000005e8: SWAP1
000005e9: MSIZE
000005ea: ADD
000005eb: PUSH1 0x00
000005ed: SWAP1
000005ee: MSTORE
000005ef: ADD
000005f0: CALLER
000005f1: DUP2
000005f2: MSTORE
000005f3: CALLVALUE
000005f4: PUSH1 0x20
000005f6: DUP3
000005f7: ADD
000005f8: MSTORE
000005f9: PUSH2 0x0340
000005fc: MLOAD
000005fd: PUSH1 0x40
000005ff: DUP3
00000600: ADD
00000601: MSTORE
00000602: PUSH32 0xf41b7910e085d0992d604fd470931728fd77cc8eb504d99e50e51a0a30fcfd1a
00000623: PUSH1 0x60
00000625: DUP3
00000626: LOG1
00000627: POP
00000628: PUSH2 0x03c0
0000062b: MLOAD
0000062c: PUSH2 0x03e0
0000062f: MSTORE
00000630: PUSH1 0x20
00000632: PUSH2 0x03e0
00000635: RETURN
00000636: JUMPDEST
00000637: PUSH4 0x3ccfd60b
0000063c: DUP2
0000063d: EQ
0000063e: ISZERO
0000063f: PUSH2 0x0665
00000642: JUMPI
00000643: PUSH1 0x00
00000645: PUSH1 0x00
00000647: PUSH1 0x00
00000649: PUSH1 0x00
0000064b: PUSH13 0x40000000000000000000000004
00000659: SLOAD
0000065a: ADDRESS
0000065b: BALANCE
0000065c: SUB
0000065d: PUSH1 0x00
0000065f: SLOAD
00000660: PUSH2 0x1388
00000663: CALL
00000664: POP
00000665: JUMPDEST
00000666: PUSH4 0x990e9591
0000066b: DUP2
0000066c: EQ
0000066d: ISZERO
0000066e: PUSH2 0x068b
00000671: JUMPI
00000672: PUSH13 0x40000000000000000000000003
00000680: SLOAD
00000681: PUSH2 0x0400
00000684: MSTORE
00000685: PUSH1 0x20
00000687: PUSH2 0x0400
0000068a: RETURN
0000068b: JUMPDEST
exec
/bin/bash -lc 'cast disassemble $(jq -r '"'.artifact.runtime_bytecode.full' BYTECODE_BUNDLE.json) | sed -n '781,940p'" in /tmp/codex-q9mrotit
succeeded in 103ms:
0000068c: PUSH4 0xaadcfc8c
00000691: DUP2
00000692: EQ
00000693: ISZERO
00000694: PUSH2 0x06fb
00000697: JUMPI
00000698: PUSH1 0x04
0000069a: CALLDATALOAD
0000069b: PUSH2 0x03c0
0000069e: MSTORE
0000069f: PUSH1 0x80
000006a1: MSIZE
000006a2: SWAP1
000006a3: MSIZE
000006a4: ADD
000006a5: PUSH1 0x00
000006a7: SWAP1
000006a8: MSTORE
000006a9: PUSH1 0x03
000006ab: DUP2
000006ac: MSTORE
000006ad: PUSH1 0x04
000006af: PUSH2 0x03c0
000006b2: MLOAD
000006b3: MUL
000006b4: PUSH1 0x03
000006b6: ADD
000006b7: SLOAD
000006b8: PUSH1 0x20
000006ba: DUP3
000006bb: ADD
000006bc: MSTORE
000006bd: PUSH1 0x04
000006bf: PUSH2 0x03c0
000006c2: MLOAD
000006c3: MUL
000006c4: PUSH1 0x05
000006c6: ADD
000006c7: SLOAD
000006c8: PUSH1 0x40
000006ca: DUP3
000006cb: ADD
000006cc: MSTORE
000006cd: PUSH1 0x04
000006cf: PUSH2 0x03c0
000006d2: MLOAD
000006d3: MUL
000006d4: PUSH1 0x06
000006d6: ADD
000006d7: SLOAD
000006d8: PUSH1 0x60
000006da: DUP3
000006db: ADD
000006dc: MSTORE
000006dd: PUSH1 0x20
000006df: DUP2
000006e0: ADD
000006e1: SWAP1
000006e2: POP
000006e3: PUSH1 0x20
000006e5: PUSH1 0x40
000006e7: DUP3
000006e8: SUB
000006e9: MSTORE
000006ea: PUSH1 0x20
000006ec: PUSH1 0x20
000006ee: DUP3
000006ef: SUB
000006f0: MLOAD
000006f1: MUL
000006f2: PUSH1 0x40
000006f4: ADD
000006f5: PUSH1 0x40
000006f7: DUP3
000006f8: SUB
000006f9: RETURN
000006fa: POP
000006fb: JUMPDEST
000006fc: POP
codex
{"no_findings":false,"summary":"Bytecode-only review found a confirmed public timeout/destruction path and multiple unchecked ETH-transfer callsites. The strongest issue is that payout loops ignore CALL success and then mark entries as processed, which can strand funds; the timeout path also exposes a plausible reentrancy window and ends in SELFDESTRUCT to a hardcoded beneficiary.","findings":[{"severity":"high","category":"other","title":"Unchecked ETH payouts can mark participants paid even when the transfer fails","exploit_scenario":"A participant can join from a contract wallet whose fallback reverts or needs more than the hardcoded 0x1388 gas. During either payout loop, the contract sends ETH with CALL, ignores the return value, and then clears the participant record anyway. The participant is treated as paid, but the ETH stays in the contract and can later be swept by the timeout teardown path.","recommendation":"Do not ignore CALL results. Apply checks-effects-interactions, mark state only after a successful transfer, and prefer a pull-withdraw pattern over pushing ETH with a fixed gas amount.","evidence":"At pc 0x288 and pc 0x480 the contract executes CALL with gas 0x1388 to an address/value loaded from per-entry storage, and immediately POPs the success flag. The surrounding code then clears entry storage at pc 0x36e and pc 0x48e respectively. This is strong bytecode evidence of silent transfer failure followed by state mutation. Selector inference is best-effort, but these callsites sit inside the 0x4f3739bc and 0xcbc1cfd2 entrypaths.","locations":["pc:0x288","pc:0x36e","pc:0x480","pc:0x48e","selector:0x4f3739bc","selector:0xcbc1cfd2"]},{"severity":"medium","category":"reentrancy","title":"Timeout payout loop calls out before clearing the current entry","exploit_scenario":"After the timeout gate is reached, a participant implemented as a contract can receive a payout and attempt to reenter the same timeout function before its record is zeroed. If the fallback can fit a nested call inside the provided gas, the same entry may be observed as still active and paid again, or iteration may be disrupted.","recommendation":"Clear or lock the entry before the external call, or add an explicit reentrancy guard. A pull-claim model avoids this class of issue entirely.","evidence":"The timeout path for selector 0xcbc1cfd2 checks only a timestamp condition at pc 0x411 and then enters a payout loop. Inside that loop, pc 0x480 performs CALL, while the record-clearing SSTORE does not happen until pc 0x48e. There is no heuristic reentrancy guard detected on this path. Exploitability is somewhat uncertain because the call forwards only 0x1388 gas, so severity is kept at medium.","locations":["selector:0xcbc1cfd2","pc:0x411","pc:0x480","pc:0x48e"]},{"severity":"medium","category":"access_control","title":"Public timeout path can selfdestruct the contract and sweep leftovers to a hardcoded address","exploit_scenario":"Once the stored deadline expires, any caller can invoke the timeout entrypath, trigger the payout loop, and then destroy the contract. Any ETH left behind, including funds stranded by failed payouts, is forcibly sent to the hardcoded beneficiary 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae.","recommendation":"Remove SELFDESTRUCT from the runtime path, or strictly gate teardown and use an auditable, configurable beneficiary. Ensure all owed payouts succeed before any terminal sweep.","evidence":"The bytecode compares selector 0xcbc1cfd2, checks a timestamp/deadline condition at pc 0x411, and reaches SELFDESTRUCT at pc 0x49e. The beneficiary is hardcoded by PUSH20 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae immediately before SELFDESTRUCT. Unlike the owner-only paths guarded around pc 0xff/0x154, this timeout/destruction path shows no msg.sender equality guard.","locations":["selector:0xcbc1cfd2","pc:0x411","pc:0x49e"]}]}
tokens used
81,502
{
"codex": {
"ran_at": "2026-04-05T01:00:53.306550+00:00",
"returncode": 0
},
"project": {
"mode": "bytecode",
"bytecode_length": 3580,
"bytecode_truncated": false,
"capability_graph_present": true,
"analysis_artifact_present": true
},
"summary": "Bytecode-only review found a confirmed public timeout/destruction path and multiple unchecked ETH-transfer callsites. The strongest issue is that payout loops ignore CALL success and then mark entries as processed, which can strand funds; the timeout path also exposes a plausible reentrancy window and ends in SELFDESTRUCT to a hardcoded beneficiary.",
"raw_final": {
"summary": "Bytecode-only review found a confirmed public timeout/destruction path and multiple unchecked ETH-transfer callsites. The strongest issue is that payout loops ignore CALL success and then mark entries as processed, which can strand funds; the timeout path also exposes a plausible reentrancy window and ends in SELFDESTRUCT to a hardcoded beneficiary.",
"findings": [
{
"title": "Unchecked ETH payouts can mark participants paid even when the transfer fails",
"category": "other",
"evidence": "At pc 0x288 and pc 0x480 the contract executes CALL with gas 0x1388 to an address/value loaded from per-entry storage, and immediately POPs the success flag. The surrounding code then clears entry storage at pc 0x36e and pc 0x48e respectively. This is strong bytecode evidence of silent transfer failure followed by state mutation. Selector inference is best-effort, but these callsites sit inside the 0x4f3739bc and 0xcbc1cfd2 entrypaths.",
"severity": "high",
"locations": [
"pc:0x288",
"pc:0x36e",
"pc:0x480",
"pc:0x48e",
"selector:0x4f3739bc",
"selector:0xcbc1cfd2"
],
"recommendation": "Do not ignore CALL results. Apply checks-effects-interactions, mark state only after a successful transfer, and prefer a pull-withdraw pattern over pushing ETH with a fixed gas amount.",
"exploit_scenario": "A participant can join from a contract wallet whose fallback reverts or needs more than the hardcoded 0x1388 gas. During either payout loop, the contract sends ETH with CALL, ignores the return value, and then clears the participant record anyway. The participant is treated as paid, but the ETH stays in the contract and can later be swept by the timeout teardown path."
},
{
"title": "Timeout payout loop calls out before clearing the current entry",
"category": "reentrancy",
"evidence": "The timeout path for selector 0xcbc1cfd2 checks only a timestamp condition at pc 0x411 and then enters a payout loop. Inside that loop, pc 0x480 performs CALL, while the record-clearing SSTORE does not happen until pc 0x48e. There is no heuristic reentrancy guard detected on this path. Exploitability is somewhat uncertain because the call forwards only 0x1388 gas, so severity is kept at medium.",
"severity": "medium",
"locations": [
"selector:0xcbc1cfd2",
"pc:0x411",
"pc:0x480",
"pc:0x48e"
],
"recommendation": "Clear or lock the entry before the external call, or add an explicit reentrancy guard. A pull-claim model avoids this class of issue entirely.",
"exploit_scenario": "After the timeout gate is reached, a participant implemented as a contract can receive a payout and attempt to reenter the same timeout function before its record is zeroed. If the fallback can fit a nested call inside the provided gas, the same entry may be observed as still active and paid again, or iteration may be disrupted."
},
{
"title": "Public timeout path can selfdestruct the contract and sweep leftovers to a hardcoded address",
"category": "access_control",
"evidence": "The bytecode compares selector 0xcbc1cfd2, checks a timestamp/deadline condition at pc 0x411, and reaches SELFDESTRUCT at pc 0x49e. The beneficiary is hardcoded by PUSH20 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae immediately before SELFDESTRUCT. Unlike the owner-only paths guarded around pc 0xff/0x154, this timeout/destruction path shows no msg.sender equality guard.",
"severity": "medium",
"locations": [
"selector:0xcbc1cfd2",
"pc:0x411",
"pc:0x49e"
],
"recommendation": "Remove SELFDESTRUCT from the runtime path, or strictly gate teardown and use an auditable, configurable beneficiary. Ensure all owed payouts succeed before any terminal sweep.",
"exploit_scenario": "Once the stored deadline expires, any caller can invoke the timeout entrypath, trigger the payout loop, and then destroy the contract. Any ETH left behind, including funds stranded by failed payouts, is forcibly sent to the hardcoded beneficiary 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae."
}
],
"no_findings": false
},
"no_findings": false,
"schema_version": 1
}
00000000: PUSH1 0x00 00000002: PUSH2 0x045f 00000005: MSTORE8 00000006: PUSH29 0x0100000000000000000000000000000000000000000000000000000000 00000024: PUSH1 0x00 00000026: CALLDATALOAD 00000027: DIV 00000028: PUSH13 0x10000000000000000000000000 00000036: PUSH1 0x20 00000038: MSTORE 00000039: PUSH4 0xf7fc250f 0000003e: DUP2 0000003f: EQ 00000040: ISZERO 00000041: PUSH2 0x0050 00000044: JUMPI 00000045: PUSH1 0x01 00000047: SLOAD 00000048: PUSH1 0x60 0000004a: MSTORE 0000004b: PUSH1 0x20 0000004d: PUSH1 0x60 0000004f: RETURN 00000050: JUMPDEST 00000051: PUSH4 0xe0c516ec 00000056: DUP2 00000057: EQ 00000058: ISZERO 00000059: PUSH2 0x0077 0000005c: JUMPI 0000005d: PUSH13 0x40000000000000000000000004 0000006b: SLOAD 0000006c: ADDRESS 0000006d: BALANCE 0000006e: SUB 0000006f: PUSH1 0x80 00000071: MSTORE 00000072: PUSH1 0x20 00000074: PUSH1 0x80 00000076: RETURN 00000077: JUMPDEST 00000078: PUSH4 0x7dbda4fb 0000007d: DUP2 0000007e: EQ 0000007f: ISZERO 00000080: PUSH2 0x00ee 00000083: JUMPI 00000084: PUSH1 0x20 00000086: MLOAD 00000087: PUSH13 0x40000000000000000000000005 00000095: SLOAD 00000096: EQ 00000097: ISZERO 00000098: PUSH2 0x00ad 0000009b: JUMPI 0000009c: PUSH1 0x01 0000009e: PUSH1 0x00 000000a0: SUB 000000a1: PUSH1 0xa0 000000a3: MSTORE 000000a4: PUSH1 0x20 000000a6: PUSH1 0xa0 000000a8: RETURN 000000a9: PUSH2 0x00ed 000000ac: JUMP 000000ad: JUMPDEST 000000ae: NUMBER 000000af: PUSH13 0x40000000000000000000000005 000000bd: SLOAD 000000be: SGT 000000bf: ISZERO 000000c0: PUSH2 0x00e1 000000c3: JUMPI 000000c4: NUMBER 000000c5: PUSH13 0x40000000000000000000000005 000000d3: SLOAD 000000d4: SUB 000000d5: PUSH1 0xc0 000000d7: MSTORE 000000d8: PUSH1 0x20 000000da: PUSH1 0xc0 000000dc: RETURN 000000dd: PUSH2 0x00ec 000000e0: JUMP 000000e1: JUMPDEST 000000e2: PUSH1 0x00 000000e4: PUSH1 0xe0 000000e6: MSTORE 000000e7: PUSH1 0x20 000000e9: PUSH1 0xe0 000000eb: RETURN 000000ec: JUMPDEST 000000ed: JUMPDEST 000000ee: JUMPDEST 000000ef: PUSH4 0x81d1d3a6 000000f4: DUP2 000000f5: EQ 000000f6: ISZERO 000000f7: PUSH2 0x0126 000000fa: JUMPI 000000fb: PUSH1 0x00 000000fd: SLOAD 000000fe: CALLER 000000ff: EQ 00000100: ISZERO 00000101: ISZERO 00000102: PUSH2 0x0112 00000105: JUMPI 00000106: PUSH1 0x00 00000108: PUSH2 0x0100 0000010b: MSTORE 0000010c: PUSH1 0x20 0000010e: PUSH2 0x0100 00000111: RETURN 00000112: JUMPDEST 00000113: PUSH1 0x05 00000115: NUMBER 00000116: ADD 00000117: PUSH13 0x40000000000000000000000005 00000125: SSTORE 00000126: JUMPDEST 00000127: PUSH4 0x4f3739bc 0000012c: DUP2 0000012d: EQ 0000012e: ISZERO 0000012f: PUSH2 0x0402 00000132: JUMPI 00000133: CALLDATASIZE 00000134: MSIZE 00000135: SWAP1 00000136: MSIZE 00000137: ADD 00000138: PUSH1 0x00 0000013a: SWAP1 0000013b: MSTORE 0000013c: CALLDATASIZE 0000013d: PUSH1 0x04 0000013f: DUP3 00000140: CALLDATACOPY 00000141: PUSH1 0x04 00000143: CALLDATALOAD 00000144: PUSH2 0x0140 00000147: MSTORE 00000148: PUSH1 0x24 0000014a: CALLDATALOAD 0000014b: PUSH2 0x0160 0000014e: MSTORE 0000014f: POP 00000150: PUSH1 0x00 00000152: SLOAD 00000153: CALLER 00000154: EQ 00000155: ISZERO 00000156: ISZERO 00000157: PUSH2 0x0167 0000015a: JUMPI 0000015b: PUSH1 0x00 0000015d: PUSH2 0x0180 00000160: MSTORE 00000161: PUSH1 0x20 00000163: PUSH2 0x0180 00000166: RETURN 00000167: JUMPDEST 00000168: NUMBER 00000169: PUSH13 0x40000000000000000000000005 00000177: SLOAD 00000178: SGT 00000179: ISZERO 0000017a: PUSH2 0x018a 0000017d: JUMPI 0000017e: PUSH1 0x00 00000180: PUSH2 0x01a0 00000183: MSTORE 00000184: PUSH1 0x20 00000186: PUSH2 0x01a0 00000189: RETURN 0000018a: JUMPDEST 0000018b: PUSH1 0x01 0000018d: SLOAD 0000018e: PUSH2 0x01c0 00000191: MSTORE 00000192: PUSH1 0x20 00000194: PUSH2 0x01c0 00000197: KECCAK256 00000198: PUSH2 0x0140 0000019b: MLOAD 0000019c: EQ 0000019d: ISZERO 0000019e: ISZERO 0000019f: PUSH2 0x01ae 000001a2: JUMPI 000001a3: PUSH1 0x00 000001a5: PUSH1 0x01 000001a7: SLOAD 000001a8: EQ 000001a9: ISZERO 000001aa: PUSH2 0x01b1 000001ad: JUMP 000001ae: JUMPDEST 000001af: PUSH1 0x00 000001b1: JUMPDEST 000001b2: ISZERO 000001b3: PUSH2 0x01c3 000001b6: JUMPI 000001b7: PUSH1 0x00 000001b9: PUSH2 0x01e0 000001bc: MSTORE 000001bd: PUSH1 0x20 000001bf: PUSH2 0x01e0 000001c2: RETURN 000001c3: JUMPDEST 000001c4: PUSH1 0x00 000001c6: PUSH2 0x0200 000001c9: MSTORE 000001ca: PUSH13 0x40000000000000000000000003 000001d8: SLOAD 000001d9: PUSH2 0x0220 000001dc: MSTORE 000001dd: PUSH31 0x4189374bc6a7ef9db22d0e5604189374bc6a7ef9db22d0e5604189374bc6a7 000001fd: PUSH2 0x0240 00000200: MSTORE 00000201: JUMPDEST 00000202: PUSH2 0x0220 00000205: MLOAD 00000206: PUSH2 0x0200 00000209: MLOAD 0000020a: SLT 0000020b: ISZERO 0000020c: PUSH2 0x037e 0000020f: JUMPI 00000210: PUSH2 0x0240 00000213: MLOAD 00000214: PUSH1 0x60 00000216: MSIZE 00000217: SWAP1 00000218: MSIZE 00000219: ADD 0000021a: PUSH1 0x00 0000021c: SWAP1 0000021d: MSTORE 0000021e: PUSH1 0x02 00000220: DUP2 00000221: MSTORE 00000222: PUSH2 0x0140 00000225: MLOAD 00000226: PUSH1 0x20 00000228: DUP3 00000229: ADD 0000022a: MSTORE 0000022b: PUSH1 0x04 0000022d: PUSH2 0x0200 00000230: MLOAD 00000231: MUL 00000232: PUSH1 0x04 00000234: ADD 00000235: SLOAD 00000236: PUSH1 0x40 00000238: DUP3 00000239: ADD 0000023a: MSTORE 0000023b: PUSH1 0x20 0000023d: DUP2 0000023e: ADD 0000023f: SWAP1 00000240: POP 00000241: PUSH1 0x20 00000243: PUSH1 0x20 00000245: DUP3 00000246: SUB 00000247: MLOAD 00000248: MUL 00000249: DUP2 0000024a: KECCAK256 0000024b: SWAP1 0000024c: POP 0000024d: DIV 0000024e: PUSH2 0x0260 00000251: MSTORE 00000252: PUSH1 0x04 00000254: PUSH2 0x0200 00000257: MLOAD 00000258: MUL 00000259: PUSH1 0x06 0000025b: ADD 0000025c: SLOAD 0000025d: PUSH2 0x0260 00000260: MLOAD 00000261: SLT 00000262: ISZERO 00000263: PUSH2 0x02f7 00000266: JUMPI 00000267: PUSH1 0x00 00000269: PUSH1 0x00 0000026b: PUSH1 0x00 0000026d: PUSH1 0x00 0000026f: PUSH1 0x04 00000271: PUSH2 0x0200 00000274: MLOAD 00000275: MUL 00000276: PUSH1 0x05 00000278: ADD 00000279: SLOAD 0000027a: PUSH1 0x04 0000027c: PUSH2 0x0200 0000027f: MLOAD 00000280: MUL 00000281: PUSH1 0x03 00000283: ADD 00000284: SLOAD 00000285: PUSH2 0x1388 00000288: CALL 00000289: POP 0000028a: PUSH1 0x1c 0000028c: PUSH1 0xa0 0000028e: MSIZE 0000028f: SWAP1 00000290: MSIZE 00000291: ADD 00000292: PUSH1 0x00 00000294: SWAP1 00000295: MSTORE 00000296: ADD 00000297: PUSH2 0x0200 0000029a: MLOAD 0000029b: DUP2 0000029c: MSTORE 0000029d: PUSH1 0x04 0000029f: PUSH2 0x0200 000002a2: MLOAD 000002a3: MUL 000002a4: PUSH1 0x03 000002a6: ADD 000002a7: SLOAD 000002a8: PUSH1 0x20 000002aa: DUP3 000002ab: ADD 000002ac: MSTORE 000002ad: PUSH1 0x04 000002af: PUSH2 0x0200 000002b2: MLOAD 000002b3: MUL 000002b4: PUSH1 0x05 000002b6: ADD 000002b7: SLOAD 000002b8: PUSH1 0x40 000002ba: DUP3 000002bb: ADD 000002bc: MSTORE 000002bd: PUSH1 0x04 000002bf: PUSH2 0x0200 000002c2: MLOAD 000002c3: MUL 000002c4: PUSH1 0x06 000002c6: ADD 000002c7: SLOAD 000002c8: PUSH1 0x60 000002ca: DUP3 000002cb: ADD 000002cc: MSTORE 000002cd: PUSH32 0xab09721a4ae05073358d023b9649596f7c6b1c3dc68ab166ea65239d0842c453 000002ee: PUSH1 0x80 000002f0: DUP3 000002f1: LOG1 000002f2: POP 000002f3: PUSH2 0x0361 000002f6: JUMP 000002f7: JUMPDEST 000002f8: PUSH1 0x1c 000002fa: PUSH1 0xa0 000002fc: MSIZE 000002fd: SWAP1 000002fe: MSIZE 000002ff: ADD 00000300: PUSH1 0x00 00000302: SWAP1 00000303: MSTORE 00000304: ADD 00000305: PUSH2 0x0200 00000308: MLOAD 00000309: DUP2 0000030a: MSTORE 0000030b: PUSH1 0x04 0000030d: PUSH2 0x0200 00000310: MLOAD 00000311: MUL 00000312: PUSH1 0x03 00000314: ADD 00000315: SLOAD 00000316: PUSH1 0x20 00000318: DUP3 00000319: ADD 0000031a: MSTORE 0000031b: PUSH1 0x04 0000031d: PUSH2 0x0200 00000320: MLOAD 00000321: MUL 00000322: PUSH1 0x05 00000324: ADD 00000325: SLOAD 00000326: PUSH1 0x40 00000328: DUP3 00000329: ADD 0000032a: MSTORE 0000032b: PUSH1 0x04 0000032d: PUSH2 0x0200 00000330: MLOAD 00000331: MUL 00000332: PUSH1 0x06 00000334: ADD 00000335: SLOAD 00000336: PUSH1 0x60 00000338: DUP3 00000339: ADD 0000033a: MSTORE 0000033b: PUSH32 0xc23655ee45230bbc23257253de9eba1ffd39f0b6cadfdf7994624201838da81f 0000035c: PUSH1 0x80 0000035e: DUP3 0000035f: LOG1 00000360: POP 00000361: JUMPDEST 00000362: PUSH1 0x00 00000364: PUSH1 0x04 00000366: PUSH2 0x0200 00000369: MLOAD 0000036a: MUL 0000036b: PUSH1 0x03 0000036d: ADD 0000036e: SSTORE 0000036f: PUSH1 0x01 00000371: PUSH2 0x0200 00000374: MLOAD 00000375: ADD 00000376: PUSH2 0x0200 00000379: MSTORE 0000037a: PUSH2 0x0201 0000037d: JUMP 0000037e: JUMPDEST 0000037f: PUSH1 0x00 00000381: PUSH13 0x40000000000000000000000003 0000038f: SSTORE 00000390: PUSH2 0x0160 00000393: MLOAD 00000394: PUSH1 0x01 00000396: SSTORE 00000397: PUSH3 0x02a300 0000039b: TIMESTAMP 0000039c: ADD 0000039d: PUSH1 0x02 0000039f: SSTORE 000003a0: PUSH1 0x00 000003a2: PUSH13 0x40000000000000000000000004 000003b0: SSTORE 000003b1: PUSH1 0x20 000003b3: MLOAD 000003b4: PUSH13 0x40000000000000000000000005 000003c2: SSTORE 000003c3: PUSH1 0x1c 000003c5: PUSH1 0x20 000003c7: MSIZE 000003c8: SWAP1 000003c9: MSIZE 000003ca: ADD 000003cb: PUSH1 0x00 000003cd: SWAP1 000003ce: MSTORE 000003cf: ADD 000003d0: PUSH32 0x04d83c8059bd80db11b4f1e1043ec8e6b4bdbfcb139c0eb0f73e92a5278e01ca 000003f1: PUSH1 0x00 000003f3: DUP3 000003f4: LOG1 000003f5: POP 000003f6: PUSH1 0x01 000003f8: PUSH2 0x02e0 000003fb: MSTORE 000003fc: PUSH1 0x20 000003fe: PUSH2 0x02e0 00000401: RETURN 00000402: JUMPDEST 00000403: PUSH4 0xcbc1cfd2 00000408: DUP2 00000409: EQ 0000040a: ISZERO 0000040b: PUSH2 0x04b5 0000040e: JUMPI 0000040f: PUSH1 0x02 00000411: SLOAD 00000412: TIMESTAMP 00000413: SGT 00000414: ISZERO 00000415: ISZERO 00000416: PUSH2 0x0426 00000419: JUMPI 0000041a: PUSH1 0x00 0000041c: PUSH2 0x0300 0000041f: MSTORE 00000420: PUSH1 0x20 00000422: PUSH2 0x0300 00000425: RETURN 00000426: JUMPDEST 00000427: PUSH1 0x00 00000429: PUSH2 0x0200 0000042c: MSTORE 0000042d: PUSH13 0x40000000000000000000000003 0000043b: SLOAD 0000043c: PUSH2 0x0220 0000043f: MSTORE 00000440: JUMPDEST 00000441: PUSH2 0x0220 00000444: MLOAD 00000445: PUSH2 0x0200 00000448: MLOAD 00000449: SLT 0000044a: ISZERO 0000044b: PUSH2 0x049e 0000044e: JUMPI 0000044f: PUSH1 0x00 00000451: PUSH1 0x00 00000453: PUSH1 0x00 00000455: PUSH1 0x00 00000457: PUSH2 0x03e8 0000045a: PUSH1 0x04 0000045c: PUSH2 0x0200 0000045f: MLOAD 00000460: MUL 00000461: PUSH1 0x06 00000463: ADD 00000464: SLOAD 00000465: PUSH1 0x04 00000467: PUSH2 0x0200 0000046a: MLOAD 0000046b: MUL 0000046c: PUSH1 0x05 0000046e: ADD 0000046f: SLOAD 00000470: MUL 00000471: SDIV 00000472: PUSH1 0x04 00000474: PUSH2 0x0200 00000477: MLOAD 00000478: MUL 00000479: PUSH1 0x03 0000047b: ADD 0000047c: SLOAD 0000047d: PUSH2 0x1388 00000480: CALL 00000481: POP 00000482: PUSH1 0x00 00000484: PUSH1 0x04 00000486: PUSH2 0x0200 00000489: MLOAD 0000048a: MUL 0000048b: PUSH1 0x03 0000048d: ADD 0000048e: SSTORE 0000048f: PUSH1 0x01 00000491: PUSH2 0x0200 00000494: MLOAD 00000495: ADD 00000496: PUSH2 0x0200 00000499: MSTORE 0000049a: PUSH2 0x0440 0000049d: JUMP 0000049e: JUMPDEST 0000049f: PUSH20 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae 000004b4: SELFDESTRUCT 000004b5: JUMPDEST 000004b6: PUSH3 0xa044ac 000004ba: DUP2 000004bb: EQ 000004bc: ISZERO 000004bd: PUSH2 0x0636 000004c0: JUMPI 000004c1: CALLDATASIZE 000004c2: MSIZE 000004c3: SWAP1 000004c4: MSIZE 000004c5: ADD 000004c6: PUSH1 0x00 000004c8: SWAP1 000004c9: MSTORE 000004ca: CALLDATASIZE 000004cb: PUSH1 0x04 000004cd: DUP3 000004ce: CALLDATACOPY 000004cf: PUSH1 0x04 000004d1: CALLDATALOAD 000004d2: PUSH2 0x0320 000004d5: MSTORE 000004d6: PUSH1 0x24 000004d8: CALLDATALOAD 000004d9: PUSH2 0x0340 000004dc: MSTORE 000004dd: POP 000004de: PUSH1 0x64 000004e0: PUSH13 0x40000000000000000000000003 000004ee: SLOAD 000004ef: SLT 000004f0: ISZERO 000004f1: ISZERO 000004f2: PUSH2 0x0514 000004f5: JUMPI 000004f6: PUSH1 0x00 000004f8: PUSH1 0x00 000004fa: PUSH1 0x00 000004fc: PUSH1 0x00 000004fe: CALLVALUE 000004ff: CALLER 00000500: PUSH2 0x1388 00000503: CALL 00000504: POP 00000505: PUSH1 0x01 00000507: PUSH1 0x00 00000509: SUB 0000050a: PUSH2 0x0360 0000050d: MSTORE 0000050e: PUSH1 0x20 00000510: PUSH2 0x0360 00000513: RETURN 00000514: JUMPDEST 00000515: PUSH2 0x0340 00000518: MLOAD 00000519: PUSH2 0x03e8 0000051c: CALLVALUE 0000051d: MUL 0000051e: SDIV 0000051f: PUSH2 0x0380 00000522: MSTORE 00000523: PUSH2 0x0380 00000526: MLOAD 00000527: PUSH13 0x40000000000000000000000004 00000535: SLOAD 00000536: ADDRESS 00000537: BALANCE 00000538: SUB 00000539: SLT 0000053a: ISZERO 0000053b: PUSH2 0x055d 0000053e: JUMPI 0000053f: PUSH1 0x00 00000541: PUSH1 0x00 00000543: PUSH1 0x00 00000545: PUSH1 0x00 00000547: CALLVALUE 00000548: CALLER 00000549: PUSH2 0x1388 0000054c: CALL 0000054d: POP 0000054e: PUSH1 0x02 00000550: PUSH1 0x00 00000552: SUB 00000553: PUSH2 0x03a0 00000556: MSTORE 00000557: PUSH1 0x20 00000559: PUSH2 0x03a0 0000055c: RETURN 0000055d: JUMPDEST 0000055e: PUSH2 0x0380 00000561: MLOAD 00000562: PUSH13 0x40000000000000000000000004 00000570: SLOAD 00000571: ADD 00000572: PUSH13 0x40000000000000000000000004 00000580: SSTORE 00000581: PUSH13 0x40000000000000000000000003 0000058f: SLOAD 00000590: PUSH2 0x03c0 00000593: MSTORE 00000594: CALLER 00000595: PUSH1 0x04 00000597: PUSH2 0x03c0 0000059a: MLOAD 0000059b: MUL 0000059c: PUSH1 0x03 0000059e: ADD 0000059f: SSTORE 000005a0: PUSH2 0x0320 000005a3: MLOAD 000005a4: PUSH1 0x04 000005a6: PUSH2 0x03c0 000005a9: MLOAD 000005aa: MUL 000005ab: PUSH1 0x04 000005ad: ADD 000005ae: SSTORE 000005af: PUSH2 0x0380 000005b2: MLOAD 000005b3: PUSH1 0x04 000005b5: PUSH2 0x03c0 000005b8: MLOAD 000005b9: MUL 000005ba: PUSH1 0x05 000005bc: ADD 000005bd: SSTORE 000005be: PUSH2 0x0340 000005c1: MLOAD 000005c2: PUSH1 0x04 000005c4: PUSH2 0x03c0 000005c7: MLOAD 000005c8: MUL 000005c9: PUSH1 0x06 000005cb: ADD 000005cc: SSTORE 000005cd: PUSH1 0x01 000005cf: PUSH2 0x03c0 000005d2: MLOAD 000005d3: ADD 000005d4: PUSH13 0x40000000000000000000000003 000005e2: SSTORE 000005e3: PUSH1 0x1c 000005e5: PUSH1 0x80 000005e7: MSIZE 000005e8: SWAP1 000005e9: MSIZE 000005ea: ADD 000005eb: PUSH1 0x00 000005ed: SWAP1 000005ee: MSTORE 000005ef: ADD 000005f0: CALLER 000005f1: DUP2 000005f2: MSTORE 000005f3: CALLVALUE 000005f4: PUSH1 0x20 000005f6: DUP3 000005f7: ADD 000005f8: MSTORE 000005f9: PUSH2 0x0340 000005fc: MLOAD 000005fd: PUSH1 0x40 000005ff: DUP3 00000600: ADD 00000601: MSTORE 00000602: PUSH32 0xf41b7910e085d0992d604fd470931728fd77cc8eb504d99e50e51a0a30fcfd1a 00000623: PUSH1 0x60 00000625: DUP3 00000626: LOG1 00000627: POP 00000628: PUSH2 0x03c0 0000062b: MLOAD 0000062c: PUSH2 0x03e0 0000062f: MSTORE 00000630: PUSH1 0x20 00000632: PUSH2 0x03e0 00000635: RETURN 00000636: JUMPDEST 00000637: PUSH4 0x3ccfd60b 0000063c: DUP2 0000063d: EQ 0000063e: ISZERO 0000063f: PUSH2 0x0665 00000642: JUMPI 00000643: PUSH1 0x00 00000645: PUSH1 0x00 00000647: PUSH1 0x00 00000649: PUSH1 0x00 0000064b: PUSH13 0x40000000000000000000000004 00000659: SLOAD 0000065a: ADDRESS 0000065b: BALANCE 0000065c: SUB 0000065d: PUSH1 0x00 0000065f: SLOAD 00000660: PUSH2 0x1388 00000663: CALL 00000664: POP 00000665: JUMPDEST 00000666: PUSH4 0x990e9591 0000066b: DUP2 0000066c: EQ 0000066d: ISZERO 0000066e: PUSH2 0x068b 00000671: JUMPI 00000672: PUSH13 0x40000000000000000000000003 00000680: SLOAD 00000681: PUSH2 0x0400 00000684: MSTORE 00000685: PUSH1 0x20 00000687: PUSH2 0x0400 0000068a: RETURN 0000068b: JUMPDEST 0000068c: PUSH4 0xaadcfc8c 00000691: DUP2 00000692: EQ 00000693: ISZERO 00000694: PUSH2 0x06fb 00000697: JUMPI 00000698: PUSH1 0x04 0000069a: CALLDATALOAD 0000069b: PUSH2 0x03c0 0000069e: MSTORE 0000069f: PUSH1 0x80 000006a1: MSIZE 000006a2: SWAP1 000006a3: MSIZE 000006a4: ADD 000006a5: PUSH1 0x00 000006a7: SWAP1 000006a8: MSTORE 000006a9: PUSH1 0x03 000006ab: DUP2 000006ac: MSTORE 000006ad: PUSH1 0x04 000006af: PUSH2 0x03c0 000006b2: MLOAD 000006b3: MUL 000006b4: PUSH1 0x03 000006b6: ADD 000006b7: SLOAD 000006b8: PUSH1 0x20 000006ba: DUP3 000006bb: ADD 000006bc: MSTORE 000006bd: PUSH1 0x04 000006bf: PUSH2 0x03c0 000006c2: MLOAD 000006c3: MUL 000006c4: PUSH1 0x05 000006c6: ADD 000006c7: SLOAD 000006c8: PUSH1 0x40 000006ca: DUP3 000006cb: ADD 000006cc: MSTORE 000006cd: PUSH1 0x04 000006cf: PUSH2 0x03c0 000006d2: MLOAD 000006d3: MUL 000006d4: PUSH1 0x06 000006d6: ADD 000006d7: SLOAD 000006d8: PUSH1 0x60 000006da: DUP3 000006db: ADD 000006dc: MSTORE 000006dd: PUSH1 0x20 000006df: DUP2 000006e0: ADD 000006e1: SWAP1 000006e2: POP 000006e3: PUSH1 0x20 000006e5: PUSH1 0x40 000006e7: DUP3 000006e8: SUB 000006e9: MSTORE 000006ea: PUSH1 0x20 000006ec: PUSH1 0x20 000006ee: DUP3 000006ef: SUB 000006f0: MLOAD 000006f1: MUL 000006f2: PUSH1 0x40 000006f4: ADD 000006f5: PUSH1 0x40 000006f7: DUP3 000006f8: SUB 000006f9: RETURN 000006fa: POP 000006fb: JUMPDEST 000006fc: POP
Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | other | codex | Unchecked ETH payouts can mark participants paid even when the transfer fails | 85 | no | — |
viewevidence_json{
"evidence": "At pc 0x288 and pc 0x480 the contract executes CALL with gas 0x1388 to an address/value loaded from per-entry storage, and immediately POPs the success flag. The surrounding code then clears entry storage at pc 0x36e and pc 0x48e respectively. This is strong bytecode evidence of silent transfer failure followed by state mutation. Selector inference is best-effort, but these callsites sit inside the 0x4f3739bc and 0xcbc1cfd2 entrypaths.",
"locations": [
"pc:0x288",
"pc:0x36e",
"pc:0x480",
"pc:0x48e",
"selector:0x4f3739bc",
"selector:0xcbc1cfd2"
],
"recommendation": "Do not ignore CALL results. Apply checks-effects-interactions, mark state only after a successful transfer, and prefer a pull-withdraw pattern over pushing ETH with a fixed gas amount.",
"exploit_scenario": "A participant can join from a contract wallet whose fallback reverts or needs more than the hardcoded 0x1388 gas. During either payout loop, the contract sends ETH with CALL, ignores the return value, and then clears the participant record anyway. The participant is treated as paid, but the ETH stays in the contract and can later be swept by the timeout teardown path."
}
|
| medium | other | detector | SELFDESTRUCT reachable | 45 | yes | yes |
viewtrace_id: 0x4d60b13d740085d4f3d1f5abbb5624690f6943903fc4ed7a3fe1afeb30a3025e
validation_json{
"sink": "SELFDESTRUCT",
"errors": 0,
"status": "confirmed",
"attempts": 11,
"trace_id": "0x4d60b13d740085d4f3d1f5abbb5624690f6943903fc4ed7a3fe1afeb30a3025e",
"confirmed": true,
"trace_mode": "structLogs",
"call_targets": null,
"matched_probe": null,
"target_varies": null,
"classification": "sink_reached"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xf7fc250f",
"selector": "0xf7fc250f",
"calldata_variants": [
"0xf7fc250f",
"0xf7fc250f0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe0c516ec",
"selector": "0xe0c516ec",
"calldata_variants": [
"0xe0c516ec",
"0xe0c516ec0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7dbda4fb",
"selector": "0x7dbda4fb",
"calldata_variants": [
"0x7dbda4fb",
"0x7dbda4fb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x81d1d3a6",
"selector": "0x81d1d3a6",
"calldata_variants": [
"0x81d1d3a6",
"0x81d1d3a60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4f3739bc",
"selector": "0x4f3739bc",
"calldata_variants": [
"0x4f3739bc",
"0x4f3739bc0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xcbc1cfd2",
"selector": "0xcbc1cfd2",
"calldata_variants": [
"0xcbc1cfd2",
"0xcbc1cfd20000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x3ccfd60b",
"selector": "0x3ccfd60b",
"calldata_variants": [
"0x3ccfd60b",
"0x3ccfd60b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x990e9591",
"selector": "0x990e9591",
"calldata_variants": [
"0x990e9591",
"0x990e95910000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"guards_detected": [
{
"pc": 255,
"type": "msg_sender_eq_storage"
},
{
"pc": 340,
"type": "msg_sender_eq_storage"
}
],
"selfdestruct_count": 1
}
|
| medium | access_control | codex | Public timeout path can selfdestruct the contract and sweep leftovers to a hardcoded address | 75 | no | — |
viewevidence_json{
"evidence": "The bytecode compares selector 0xcbc1cfd2, checks a timestamp/deadline condition at pc 0x411, and reaches SELFDESTRUCT at pc 0x49e. The beneficiary is hardcoded by PUSH20 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae immediately before SELFDESTRUCT. Unlike the owner-only paths guarded around pc 0xff/0x154, this timeout/destruction path shows no msg.sender equality guard.",
"locations": [
"selector:0xcbc1cfd2",
"pc:0x411",
"pc:0x49e"
],
"recommendation": "Remove SELFDESTRUCT from the runtime path, or strictly gate teardown and use an auditable, configurable beneficiary. Ensure all owed payouts succeed before any terminal sweep.",
"exploit_scenario": "Once the stored deadline expires, any caller can invoke the timeout entrypath, trigger the payout loop, and then destroy the contract. Any ETH left behind, including funds stranded by failed payouts, is forcibly sent to the hardcoded beneficiary 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae."
}
|
| medium | reentrancy | codex | Timeout payout loop calls out before clearing the current entry | 75 | no | — |
viewevidence_json{
"evidence": "The timeout path for selector 0xcbc1cfd2 checks only a timestamp condition at pc 0x411 and then enters a payout loop. Inside that loop, pc 0x480 performs CALL, while the record-clearing SSTORE does not happen until pc 0x48e. There is no heuristic reentrancy guard detected on this path. Exploitability is somewhat uncertain because the call forwards only 0x1388 gas, so severity is kept at medium.",
"locations": [
"selector:0xcbc1cfd2",
"pc:0x411",
"pc:0x480",
"pc:0x48e"
],
"recommendation": "Clear or lock the entry before the external call, or add an explicit reentrancy guard. A pull-claim model avoids this class of issue entirely.",
"exploit_scenario": "After the timeout gate is reached, a participant implemented as a contract can receive a payout and attempt to reenter the same timeout function before its record is zeroed. If the fallback can fit a nested call inside the provided gas, the same entry may be observed as still active and paid again, or iteration may be disrupted."
}
|
| low | other | detector | External CALL present | 40 | no | no |
viewtrace_id: 0xdd6b14328c674135ffd95c2220ccbafd5df4af363695c8ef400042e654252b07
call_targets:
0xdc00a9f92e9ea5cba399b026775e64596215861f
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0xdd6b14328c674135ffd95c2220ccbafd5df4af363695c8ef400042e654252b07",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xdc00a9f92e9ea5cba399b026775e64596215861f"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xf7fc250f",
"selector": "0xf7fc250f",
"calldata_variants": [
"0xf7fc250f",
"0xf7fc250f0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe0c516ec",
"selector": "0xe0c516ec",
"calldata_variants": [
"0xe0c516ec",
"0xe0c516ec0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7dbda4fb",
"selector": "0x7dbda4fb",
"calldata_variants": [
"0x7dbda4fb",
"0x7dbda4fb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x81d1d3a6",
"selector": "0x81d1d3a6",
"calldata_variants": [
"0x81d1d3a6",
"0x81d1d3a60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4f3739bc",
"selector": "0x4f3739bc",
"calldata_variants": [
"0x4f3739bc",
"0x4f3739bc0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xcbc1cfd2",
"selector": "0xcbc1cfd2",
"calldata_variants": [
"0xcbc1cfd2",
"0xcbc1cfd20000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x3ccfd60b",
"selector": "0x3ccfd60b",
"calldata_variants": [
"0x3ccfd60b",
"0x3ccfd60b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x990e9591",
"selector": "0x990e9591",
"calldata_variants": [
"0x990e9591",
"0x990e95910000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"call_count": 5
}
|