TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

019b3836-26f7-7228-9bbe-fced5cba1b95

complete
Chain ID
1
Address
Block Number
Created
Fri, Dec 19, 2025 8:03 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

Confirmed
2
Validated
2
Source
Bytecode only
Review Backing
Not yet
Best current signal
Untrusted CALL target/value reachable
crit 0 high 2 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
1009 artifact.fetch complete 1 / 3 3 months ago
1010 tool.cast_disasm complete 1 / 3 3 months ago
113221 analysis.bundle complete 1 / 3 1 week ago
113222 capability.graph complete 1 / 3 1 week ago
113223 detector.run complete 1 / 3 1 week ago
113224 validation.fork complete 1 / 3 1 week ago
113964 report.consolidate complete 1 / 6 1 week ago

Artifact

Runtime bytecode: available
Creation TX:
Deployer:
Proxy: no
Implementation:
Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate
Job Status
complete
Attempts
1 / 6
Findings
0
No findings?
View stderr
OpenAI Codex v0.118.0 (research preview)
--------
workdir: /tmp/codex-4tmadng4
model: gpt-5.4
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: none
session id: 019d5ca4-49ed-7033-8796-7fe2c8ce138b
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.

Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".

Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
warning: Codex could not find system bubblewrap on PATH. Please install bubblewrap with your package manager. Codex will use the vendored bubblewrap in the meantime.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.
Metadata
{
    "codex": {
        "ran_at": "2026-04-05T07:56:05.595382+00:00",
        "returncode": 1
    },
    "project": {
        "mode": "bytecode",
        "bytecode_length": 3730,
        "bytecode_truncated": false,
        "capability_graph_present": true,
        "analysis_artifact_present": true
    },
    "summary": null,
    "no_findings": null,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
0
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
2
EXT*/BALANCE
0
Total opcodes
1276
Flags
No heuristic flags raised.
View cast disassembly output
00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: CALLDATASIZE
00000006: ISZERO
00000007: PUSH2 0x0074
0000000a: JUMPI
0000000b: PUSH1 0x00
0000000d: CALLDATALOAD
0000000e: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
0000002c: SWAP1
0000002d: DIV
0000002e: DUP1
0000002f: PUSH4 0x06fdde03
00000034: EQ
00000035: PUSH2 0x0076
00000038: JUMPI
00000039: DUP1
0000003a: PUSH4 0x313ce567
0000003f: EQ
00000040: PUSH2 0x00f1
00000043: JUMPI
00000044: DUP1
00000045: PUSH4 0x70a08231
0000004a: EQ
0000004b: PUSH2 0x0117
0000004e: JUMPI
0000004f: DUP1
00000050: PUSH4 0x95d89b41
00000055: EQ
00000056: PUSH2 0x0143
00000059: JUMPI
0000005a: DUP1
0000005b: PUSH4 0x95f18951
00000060: EQ
00000061: PUSH2 0x01be
00000064: JUMPI
00000065: DUP1
00000066: PUSH4 0xa9059cbb
0000006b: EQ
0000006c: PUSH2 0x026d
0000006f: JUMPI
00000070: PUSH2 0x0074
00000073: JUMP
00000074: JUMPDEST
00000075: STOP
00000076: JUMPDEST
00000077: PUSH2 0x0083
0000007a: PUSH1 0x04
0000007c: DUP1
0000007d: POP
0000007e: POP
0000007f: PUSH2 0x0419
00000082: JUMP
00000083: JUMPDEST
00000084: PUSH1 0x40
00000086: MLOAD
00000087: DUP1
00000088: DUP1
00000089: PUSH1 0x20
0000008b: ADD
0000008c: DUP3
0000008d: DUP2
0000008e: SUB
0000008f: DUP3
00000090: MSTORE
00000091: DUP4
00000092: DUP2
00000093: DUP2
00000094: MLOAD
00000095: DUP2
00000096: MSTORE
00000097: PUSH1 0x20
00000099: ADD
0000009a: SWAP2
0000009b: POP
0000009c: DUP1
0000009d: MLOAD
0000009e: SWAP1
0000009f: PUSH1 0x20
000000a1: ADD
000000a2: SWAP1
000000a3: DUP1
000000a4: DUP4
000000a5: DUP4
000000a6: DUP3
000000a7: SWAP1
000000a8: PUSH1 0x00
000000aa: PUSH1 0x04
000000ac: PUSH1 0x20
000000ae: DUP5
000000af: PUSH1 0x1f
000000b1: ADD
000000b2: DIV
000000b3: PUSH1 0x0f
000000b5: MUL
000000b6: PUSH1 0x03
000000b8: ADD
000000b9: CALL
000000ba: POP
000000bb: SWAP1
000000bc: POP
000000bd: SWAP1
000000be: DUP2
000000bf: ADD
000000c0: SWAP1
000000c1: PUSH1 0x1f
000000c3: AND
000000c4: DUP1
000000c5: ISZERO
000000c6: PUSH2 0x00e3
000000c9: JUMPI
000000ca: DUP1
000000cb: DUP3
000000cc: SUB
000000cd: DUP1
000000ce: MLOAD
000000cf: PUSH1 0x01
000000d1: DUP4
000000d2: PUSH1 0x20
000000d4: SUB
000000d5: PUSH2 0x0100
000000d8: EXP
000000d9: SUB
000000da: NOT
000000db: AND
000000dc: DUP2
000000dd: MSTORE
000000de: PUSH1 0x20
000000e0: ADD
000000e1: SWAP2
000000e2: POP
000000e3: JUMPDEST
000000e4: POP
000000e5: SWAP3
000000e6: POP
000000e7: POP
000000e8: POP
000000e9: PUSH1 0x40
000000eb: MLOAD
000000ec: DUP1
000000ed: SWAP2
000000ee: SUB
000000ef: SWAP1
000000f0: RETURN
000000f1: JUMPDEST
000000f2: PUSH2 0x00fe
000000f5: PUSH1 0x04
000000f7: DUP1
000000f8: POP
000000f9: POP
000000fa: PUSH2 0x055b
000000fd: JUMP
000000fe: JUMPDEST
000000ff: PUSH1 0x40
00000101: MLOAD
00000102: DUP1
00000103: DUP3
00000104: PUSH1 0xff
00000106: AND
00000107: DUP2
00000108: MSTORE
00000109: PUSH1 0x20
0000010b: ADD
0000010c: SWAP2
0000010d: POP
0000010e: POP
0000010f: PUSH1 0x40
00000111: MLOAD
00000112: DUP1
00000113: SWAP2
00000114: SUB
00000115: SWAP1
00000116: RETURN
00000117: JUMPDEST
00000118: PUSH2 0x012d
0000011b: PUSH1 0x04
0000011d: DUP1
0000011e: DUP1
0000011f: CALLDATALOAD
00000120: SWAP1
00000121: PUSH1 0x20
00000123: ADD
00000124: SWAP1
00000125: SWAP2
00000126: SWAP1
00000127: POP
00000128: POP
00000129: PUSH2 0x056e
0000012c: JUMP
0000012d: JUMPDEST
0000012e: PUSH1 0x40
00000130: MLOAD
00000131: DUP1
00000132: DUP3
00000133: DUP2
00000134: MSTORE
00000135: PUSH1 0x20
00000137: ADD
00000138: SWAP2
00000139: POP
0000013a: POP
0000013b: PUSH1 0x40
0000013d: MLOAD
0000013e: DUP1
0000013f: SWAP2
00000140: SUB
00000141: SWAP1
00000142: RETURN
00000143: JUMPDEST
00000144: PUSH2 0x0150
00000147: PUSH1 0x04
00000149: DUP1
0000014a: POP
0000014b: POP
0000014c: PUSH2 0x04ba
0000014f: JUMP
00000150: JUMPDEST
00000151: PUSH1 0x40
00000153: MLOAD
00000154: DUP1
00000155: DUP1
00000156: PUSH1 0x20
00000158: ADD
00000159: DUP3
0000015a: DUP2
0000015b: SUB
0000015c: DUP3
0000015d: MSTORE
0000015e: DUP4
0000015f: DUP2
00000160: DUP2
00000161: MLOAD
00000162: DUP2
00000163: MSTORE
00000164: PUSH1 0x20
00000166: ADD
00000167: SWAP2
00000168: POP
00000169: DUP1
0000016a: MLOAD
0000016b: SWAP1
0000016c: PUSH1 0x20
0000016e: ADD
0000016f: SWAP1
00000170: DUP1
00000171: DUP4
00000172: DUP4
00000173: DUP3
00000174: SWAP1
00000175: PUSH1 0x00
00000177: PUSH1 0x04
00000179: PUSH1 0x20
0000017b: DUP5
0000017c: PUSH1 0x1f
0000017e: ADD
0000017f: DIV
00000180: PUSH1 0x0f
00000182: MUL
00000183: PUSH1 0x03
00000185: ADD
00000186: CALL
00000187: POP
00000188: SWAP1
00000189: POP
0000018a: SWAP1
0000018b: DUP2
0000018c: ADD
0000018d: SWAP1
0000018e: PUSH1 0x1f
00000190: AND
00000191: DUP1
00000192: ISZERO
00000193: PUSH2 0x01b0
00000196: JUMPI
00000197: DUP1
00000198: DUP3
00000199: SUB
0000019a: DUP1
0000019b: MLOAD
0000019c: PUSH1 0x01
0000019e: DUP4
0000019f: PUSH1 0x20
000001a1: SUB
000001a2: PUSH2 0x0100
000001a5: EXP
000001a6: SUB
000001a7: NOT
000001a8: AND
000001a9: DUP2
000001aa: MSTORE
000001ab: PUSH1 0x20
000001ad: ADD
000001ae: SWAP2
000001af: POP
000001b0: JUMPDEST
000001b1: POP
000001b2: SWAP3
000001b3: POP
000001b4: POP
000001b5: POP
000001b6: PUSH1 0x40
000001b8: MLOAD
000001b9: DUP1
000001ba: SWAP2
000001bb: SUB
000001bc: SWAP1
000001bd: RETURN
000001be: JUMPDEST
000001bf: PUSH2 0x026b
000001c2: PUSH1 0x04
000001c4: DUP1
000001c5: DUP1
000001c6: CALLDATALOAD
000001c7: SWAP1
000001c8: PUSH1 0x20
000001ca: ADD
000001cb: SWAP1
000001cc: SWAP2
000001cd: SWAP1
000001ce: DUP1
000001cf: CALLDATALOAD
000001d0: SWAP1
000001d1: PUSH1 0x20
000001d3: ADD
000001d4: SWAP1
000001d5: DUP3
000001d6: ADD
000001d7: DUP1
000001d8: CALLDATALOAD
000001d9: SWAP1
000001da: PUSH1 0x20
000001dc: ADD
000001dd: SWAP2
000001de: SWAP2
000001df: SWAP1
000001e0: DUP1
000001e1: DUP1
000001e2: PUSH1 0x1f
000001e4: ADD
000001e5: PUSH1 0x20
000001e7: DUP1
000001e8: SWAP2
000001e9: DIV
000001ea: MUL
000001eb: PUSH1 0x20
000001ed: ADD
000001ee: PUSH1 0x40
000001f0: MLOAD
000001f1: SWAP1
000001f2: DUP2
000001f3: ADD
000001f4: PUSH1 0x40
000001f6: MSTORE
000001f7: DUP1
000001f8: SWAP4
000001f9: SWAP3
000001fa: SWAP2
000001fb: SWAP1
000001fc: DUP2
000001fd: DUP2
000001fe: MSTORE
000001ff: PUSH1 0x20
00000201: ADD
00000202: DUP4
00000203: DUP4
00000204: DUP1
00000205: DUP3
00000206: DUP5
00000207: CALLDATACOPY
00000208: DUP3
00000209: ADD
0000020a: SWAP2
0000020b: POP
0000020c: POP
0000020d: POP
0000020e: POP
0000020f: POP
00000210: POP
00000211: SWAP1
00000212: SWAP1
00000213: SWAP2
00000214: SWAP1
00000215: DUP1
00000216: CALLDATALOAD
00000217: SWAP1
00000218: PUSH1 0x20
0000021a: ADD
0000021b: SWAP1
0000021c: DUP3
0000021d: ADD
0000021e: DUP1
0000021f: CALLDATALOAD
00000220: SWAP1
00000221: PUSH1 0x20
00000223: ADD
00000224: SWAP2
00000225: SWAP2
00000226: SWAP1
00000227: DUP1
00000228: DUP1
00000229: PUSH1 0x1f
0000022b: ADD
0000022c: PUSH1 0x20
0000022e: DUP1
0000022f: SWAP2
00000230: DIV
00000231: MUL
00000232: PUSH1 0x20
00000234: ADD
00000235: PUSH1 0x40
00000237: MLOAD
00000238: SWAP1
00000239: DUP2
0000023a: ADD
0000023b: PUSH1 0x40
0000023d: MSTORE
0000023e: DUP1
0000023f: SWAP4
00000240: SWAP3
00000241: SWAP2
00000242: SWAP1
00000243: DUP2
00000244: DUP2
00000245: MSTORE
00000246: PUSH1 0x20
00000248: ADD
00000249: DUP4
0000024a: DUP4
0000024b: DUP1
0000024c: DUP3
0000024d: DUP5
0000024e: CALLDATACOPY
0000024f: DUP3
00000250: ADD
00000251: SWAP2
00000252: POP
00000253: POP
00000254: POP
00000255: POP
00000256: POP
00000257: POP
00000258: SWAP1
00000259: SWAP1
0000025a: SWAP2
0000025b: SWAP1
0000025c: DUP1
0000025d: CALLDATALOAD
0000025e: SWAP1
0000025f: PUSH1 0x20
00000261: ADD
00000262: SWAP1
00000263: SWAP2
00000264: SWAP1
00000265: POP
00000266: POP
00000267: PUSH2 0x0589
0000026a: JUMP
0000026b: JUMPDEST
0000026c: STOP
0000026d: JUMPDEST
0000026e: PUSH2 0x028c
00000271: PUSH1 0x04
00000273: DUP1
00000274: DUP1
00000275: CALLDATALOAD
00000276: SWAP1
00000277: PUSH1 0x20
00000279: ADD
0000027a: SWAP1
0000027b: SWAP2
0000027c: SWAP1
0000027d: DUP1
0000027e: CALLDATALOAD
0000027f: SWAP1
00000280: PUSH1 0x20
00000282: ADD
00000283: SWAP1
00000284: SWAP2
00000285: SWAP1
00000286: POP
00000287: POP
00000288: PUSH2 0x028e
0000028b: JUMP
0000028c: JUMPDEST
0000028d: STOP
0000028e: JUMPDEST
0000028f: DUP1
00000290: PUSH1 0x03
00000292: PUSH1 0x00
00000294: POP
00000295: PUSH1 0x00
00000297: CALLER
00000298: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002ad: AND
000002ae: DUP2
000002af: MSTORE
000002b0: PUSH1 0x20
000002b2: ADD
000002b3: SWAP1
000002b4: DUP2
000002b5: MSTORE
000002b6: PUSH1 0x20
000002b8: ADD
000002b9: PUSH1 0x00
000002bb: KECCAK256
000002bc: PUSH1 0x00
000002be: POP
000002bf: SLOAD
000002c0: LT
000002c1: ISZERO
000002c2: PUSH2 0x02ca
000002c5: JUMPI
000002c6: PUSH2 0x0002
000002c9: JUMP
000002ca: JUMPDEST
000002cb: PUSH1 0x03
000002cd: PUSH1 0x00
000002cf: POP
000002d0: PUSH1 0x00
000002d2: DUP4
000002d3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002e8: AND
000002e9: DUP2
000002ea: MSTORE
000002eb: PUSH1 0x20
000002ed: ADD
000002ee: SWAP1
000002ef: DUP2
000002f0: MSTORE
000002f1: PUSH1 0x20
000002f3: ADD
000002f4: PUSH1 0x00
000002f6: KECCAK256
000002f7: PUSH1 0x00
000002f9: POP
000002fa: SLOAD
000002fb: DUP2
000002fc: PUSH1 0x03
000002fe: PUSH1 0x00
00000300: POP
00000301: PUSH1 0x00
00000303: DUP6
00000304: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000319: AND
0000031a: DUP2
0000031b: MSTORE
0000031c: PUSH1 0x20
0000031e: ADD
0000031f: SWAP1
00000320: DUP2
00000321: MSTORE
00000322: PUSH1 0x20
00000324: ADD
00000325: PUSH1 0x00
00000327: KECCAK256
00000328: PUSH1 0x00
0000032a: POP
0000032b: SLOAD
0000032c: ADD
0000032d: LT
0000032e: ISZERO
0000032f: PUSH2 0x0337
00000332: JUMPI
00000333: PUSH2 0x0002
00000336: JUMP
00000337: JUMPDEST
00000338: DUP1
00000339: PUSH1 0x03
0000033b: PUSH1 0x00
0000033d: POP
0000033e: PUSH1 0x00
00000340: CALLER
00000341: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000356: AND
00000357: DUP2
00000358: MSTORE
00000359: PUSH1 0x20
0000035b: ADD
0000035c: SWAP1
0000035d: DUP2
0000035e: MSTORE
0000035f: PUSH1 0x20
00000361: ADD
00000362: PUSH1 0x00
00000364: KECCAK256
00000365: PUSH1 0x00
00000367: DUP3
00000368: DUP3
00000369: DUP3
0000036a: POP
0000036b: SLOAD
0000036c: SUB
0000036d: SWAP3
0000036e: POP
0000036f: POP
00000370: DUP2
00000371: SWAP1
00000372: SSTORE
00000373: POP
00000374: DUP1
00000375: PUSH1 0x03
00000377: PUSH1 0x00
00000379: POP
0000037a: PUSH1 0x00
0000037c: DUP5
0000037d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000392: AND
00000393: DUP2
00000394: MSTORE
00000395: PUSH1 0x20
00000397: ADD
00000398: SWAP1
00000399: DUP2
0000039a: MSTORE
0000039b: PUSH1 0x20
0000039d: ADD
0000039e: PUSH1 0x00
000003a0: KECCAK256
000003a1: PUSH1 0x00
000003a3: DUP3
000003a4: DUP3
000003a5: DUP3
000003a6: POP
000003a7: SLOAD
000003a8: ADD
000003a9: SWAP3
000003aa: POP
000003ab: POP
000003ac: DUP2
000003ad: SWAP1
000003ae: SSTORE
000003af: POP
000003b0: DUP2
000003b1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003c6: AND
000003c7: CALLER
000003c8: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003dd: AND
000003de: PUSH32 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef
000003ff: DUP4
00000400: PUSH1 0x40
00000402: MLOAD
00000403: DUP1
00000404: DUP3
00000405: DUP2
00000406: MSTORE
00000407: PUSH1 0x20
00000409: ADD
0000040a: SWAP2
0000040b: POP
0000040c: POP
0000040d: PUSH1 0x40
0000040f: MLOAD
00000410: DUP1
00000411: SWAP2
00000412: SUB
00000413: SWAP1
00000414: LOG3
00000415: JUMPDEST
00000416: POP
00000417: POP
00000418: JUMP
00000419: JUMPDEST
0000041a: PUSH1 0x00
0000041c: PUSH1 0x00
0000041e: POP
0000041f: DUP1
00000420: SLOAD
00000421: PUSH1 0x01
00000423: DUP2
00000424: PUSH1 0x01
00000426: AND
00000427: ISZERO
00000428: PUSH2 0x0100
0000042b: MUL
0000042c: SUB
0000042d: AND
0000042e: PUSH1 0x02
00000430: SWAP1
00000431: DIV
00000432: DUP1
00000433: PUSH1 0x1f
00000435: ADD
00000436: PUSH1 0x20
00000438: DUP1
00000439: SWAP2
0000043a: DIV
0000043b: MUL
0000043c: PUSH1 0x20
0000043e: ADD
0000043f: PUSH1 0x40
00000441: MLOAD
00000442: SWAP1
00000443: DUP2
00000444: ADD
00000445: PUSH1 0x40
00000447: MSTORE
00000448: DUP1
00000449: SWAP3
0000044a: SWAP2
0000044b: SWAP1
0000044c: DUP2
0000044d: DUP2
0000044e: MSTORE
0000044f: PUSH1 0x20
00000451: ADD
00000452: DUP3
00000453: DUP1
00000454: SLOAD
00000455: PUSH1 0x01
00000457: DUP2
00000458: PUSH1 0x01
0000045a: AND
0000045b: ISZERO
0000045c: PUSH2 0x0100
0000045f: MUL
00000460: SUB
00000461: AND
00000462: PUSH1 0x02
00000464: SWAP1
00000465: DIV
00000466: DUP1
00000467: ISZERO
00000468: PUSH2 0x04b2
0000046b: JUMPI
0000046c: DUP1
0000046d: PUSH1 0x1f
0000046f: LT
00000470: PUSH2 0x0487
00000473: JUMPI
00000474: PUSH2 0x0100
00000477: DUP1
00000478: DUP4
00000479: SLOAD
0000047a: DIV
0000047b: MUL
0000047c: DUP4
0000047d: MSTORE
0000047e: SWAP2
0000047f: PUSH1 0x20
00000481: ADD
00000482: SWAP2
00000483: PUSH2 0x04b2
00000486: JUMP
00000487: JUMPDEST
00000488: DUP3
00000489: ADD
0000048a: SWAP2
0000048b: SWAP1
0000048c: PUSH1 0x00
0000048e: MSTORE
0000048f: PUSH1 0x20
00000491: PUSH1 0x00
00000493: KECCAK256
00000494: SWAP1
00000495: JUMPDEST
00000496: DUP2
00000497: SLOAD
00000498: DUP2
00000499: MSTORE
0000049a: SWAP1
0000049b: PUSH1 0x01
0000049d: ADD
0000049e: SWAP1
0000049f: PUSH1 0x20
000004a1: ADD
000004a2: DUP1
000004a3: DUP4
000004a4: GT
000004a5: PUSH2 0x0495
000004a8: JUMPI
000004a9: DUP3
000004aa: SWAP1
000004ab: SUB
000004ac: PUSH1 0x1f
000004ae: AND
000004af: DUP3
000004b0: ADD
000004b1: SWAP2
000004b2: JUMPDEST
000004b3: POP
000004b4: POP
000004b5: POP
000004b6: POP
000004b7: POP
000004b8: DUP2
000004b9: JUMP
000004ba: JUMPDEST
000004bb: PUSH1 0x01
000004bd: PUSH1 0x00
000004bf: POP
000004c0: DUP1
000004c1: SLOAD
000004c2: PUSH1 0x01
000004c4: DUP2
000004c5: PUSH1 0x01
000004c7: AND
000004c8: ISZERO
000004c9: PUSH2 0x0100
000004cc: MUL
000004cd: SUB
000004ce: AND
000004cf: PUSH1 0x02
000004d1: SWAP1
000004d2: DIV
000004d3: DUP1
000004d4: PUSH1 0x1f
000004d6: ADD
000004d7: PUSH1 0x20
000004d9: DUP1
000004da: SWAP2
000004db: DIV
000004dc: MUL
000004dd: PUSH1 0x20
000004df: ADD
000004e0: PUSH1 0x40
000004e2: MLOAD
000004e3: SWAP1
000004e4: DUP2
000004e5: ADD
000004e6: PUSH1 0x40
000004e8: MSTORE
000004e9: DUP1
000004ea: SWAP3
000004eb: SWAP2
000004ec: SWAP1
000004ed: DUP2
000004ee: DUP2
000004ef: MSTORE
000004f0: PUSH1 0x20
000004f2: ADD
000004f3: DUP3
000004f4: DUP1
000004f5: SLOAD
000004f6: PUSH1 0x01
000004f8: DUP2
000004f9: PUSH1 0x01
000004fb: AND
000004fc: ISZERO
000004fd: PUSH2 0x0100
00000500: MUL
00000501: SUB
00000502: AND
00000503: PUSH1 0x02
00000505: SWAP1
00000506: DIV
00000507: DUP1
00000508: ISZERO
00000509: PUSH2 0x0553
0000050c: JUMPI
0000050d: DUP1
0000050e: PUSH1 0x1f
00000510: LT
00000511: PUSH2 0x0528
00000514: JUMPI
00000515: PUSH2 0x0100
00000518: DUP1
00000519: DUP4
0000051a: SLOAD
0000051b: DIV
0000051c: MUL
0000051d: DUP4
0000051e: MSTORE
0000051f: SWAP2
00000520: PUSH1 0x20
00000522: ADD
00000523: SWAP2
00000524: PUSH2 0x0553
00000527: JUMP
00000528: JUMPDEST
00000529: DUP3
0000052a: ADD
0000052b: SWAP2
0000052c: SWAP1
0000052d: PUSH1 0x00
0000052f: MSTORE
00000530: PUSH1 0x20
00000532: PUSH1 0x00
00000534: KECCAK256
00000535: SWAP1
00000536: JUMPDEST
00000537: DUP2
00000538: SLOAD
00000539: DUP2
0000053a: MSTORE
0000053b: SWAP1
0000053c: PUSH1 0x01
0000053e: ADD
0000053f: SWAP1
00000540: PUSH1 0x20
00000542: ADD
00000543: DUP1
00000544: DUP4
00000545: GT
00000546: PUSH2 0x0536
00000549: JUMPI
0000054a: DUP3
0000054b: SWAP1
0000054c: SUB
0000054d: PUSH1 0x1f
0000054f: AND
00000550: DUP3
00000551: ADD
00000552: SWAP2
00000553: JUMPDEST
00000554: POP
00000555: POP
00000556: POP
00000557: POP
00000558: POP
00000559: DUP2
0000055a: JUMP
0000055b: JUMPDEST
0000055c: PUSH1 0x02
0000055e: PUSH1 0x00
00000560: SWAP1
00000561: SLOAD
00000562: SWAP1
00000563: PUSH2 0x0100
00000566: EXP
00000567: SWAP1
00000568: DIV
00000569: PUSH1 0xff
0000056b: AND
0000056c: DUP2
0000056d: JUMP
0000056e: JUMPDEST
0000056f: PUSH1 0x03
00000571: PUSH1 0x00
00000573: POP
00000574: PUSH1 0x20
00000576: MSTORE
00000577: DUP1
00000578: PUSH1 0x00
0000057a: MSTORE
0000057b: PUSH1 0x40
0000057d: PUSH1 0x00
0000057f: KECCAK256
00000580: PUSH1 0x00
00000582: SWAP2
00000583: POP
00000584: SWAP1
00000585: POP
00000586: SLOAD
00000587: DUP2
00000588: JUMP
00000589: JUMPDEST
0000058a: PUSH1 0x00
0000058c: DUP5
0000058d: EQ
0000058e: ISZERO
0000058f: PUSH2 0x059b
00000592: JUMPI
00000593: PUSH3 0x0f4240
00000597: SWAP4
00000598: POP
00000599: DUP4
0000059a: POP
0000059b: JUMPDEST
0000059c: DUP4
0000059d: PUSH1 0x03
0000059f: PUSH1 0x00
000005a1: POP
000005a2: PUSH1 0x00
000005a4: CALLER
000005a5: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000005ba: AND
000005bb: DUP2
000005bc: MSTORE
000005bd: PUSH1 0x20
000005bf: ADD
000005c0: SWAP1
000005c1: DUP2
000005c2: MSTORE
000005c3: PUSH1 0x20
000005c5: ADD
000005c6: PUSH1 0x00
000005c8: KECCAK256
000005c9: PUSH1 0x00
000005cb: POP
000005cc: DUP2
000005cd: SWAP1
000005ce: SSTORE
000005cf: POP
000005d0: DUP3
000005d1: PUSH1 0x00
000005d3: PUSH1 0x00
000005d5: POP
000005d6: SWAP1
000005d7: DUP1
000005d8: MLOAD
000005d9: SWAP1
000005da: PUSH1 0x20
000005dc: ADD
000005dd: SWAP1
000005de: DUP3
000005df: DUP1
000005e0: SLOAD
000005e1: PUSH1 0x01
000005e3: DUP2
000005e4: PUSH1 0x01
000005e6: AND
000005e7: ISZERO
000005e8: PUSH2 0x0100
000005eb: MUL
000005ec: SUB
000005ed: AND
000005ee: PUSH1 0x02
000005f0: SWAP1
000005f1: DIV
000005f2: SWAP1
000005f3: PUSH1 0x00
000005f5: MSTORE
000005f6: PUSH1 0x20
000005f8: PUSH1 0x00
000005fa: KECCAK256
000005fb: SWAP1
000005fc: PUSH1 0x1f
000005fe: ADD
000005ff: PUSH1 0x20
00000601: SWAP1
00000602: DIV
00000603: DUP2
00000604: ADD
00000605: SWAP3
00000606: DUP3
00000607: PUSH1 0x1f
00000609: LT
0000060a: PUSH2 0x061e
0000060d: JUMPI
0000060e: DUP1
0000060f: MLOAD
00000610: PUSH1 0xff
00000612: NOT
00000613: AND
00000614: DUP4
00000615: DUP1
00000616: ADD
00000617: OR
00000618: DUP6
00000619: SSTORE
0000061a: PUSH2 0x064f
0000061d: JUMP
0000061e: JUMPDEST
0000061f: DUP3
00000620: DUP1
00000621: ADD
00000622: PUSH1 0x01
00000624: ADD
00000625: DUP6
00000626: SSTORE
00000627: DUP3
00000628: ISZERO
00000629: PUSH2 0x064f
0000062c: JUMPI
0000062d: SWAP2
0000062e: DUP3
0000062f: ADD
00000630: JUMPDEST
00000631: DUP3
00000632: DUP2
00000633: GT
00000634: ISZERO
00000635: PUSH2 0x064e
00000638: JUMPI
00000639: DUP3
0000063a: MLOAD
0000063b: DUP3
0000063c: PUSH1 0x00
0000063e: POP
0000063f: SSTORE
00000640: SWAP2
00000641: PUSH1 0x20
00000643: ADD
00000644: SWAP2
00000645: SWAP1
00000646: PUSH1 0x01
00000648: ADD
00000649: SWAP1
0000064a: PUSH2 0x0630
0000064d: JUMP
0000064e: JUMPDEST
0000064f: JUMPDEST
00000650: POP
00000651: SWAP1
00000652: POP
00000653: PUSH2 0x067a
00000656: SWAP2
00000657: SWAP1
00000658: PUSH2 0x065c
0000065b: JUMP
0000065c: JUMPDEST
0000065d: DUP1
0000065e: DUP3
0000065f: GT
00000660: ISZERO
00000661: PUSH2 0x0676
00000664: JUMPI
00000665: PUSH1 0x00
00000667: DUP2
00000668: DUP2
00000669: POP
0000066a: PUSH1 0x00
0000066c: SWAP1
0000066d: SSTORE
0000066e: POP
0000066f: PUSH1 0x01
00000671: ADD
00000672: PUSH2 0x065c
00000675: JUMP
00000676: JUMPDEST
00000677: POP
00000678: SWAP1
00000679: JUMP
0000067a: JUMPDEST
0000067b: POP
0000067c: POP
0000067d: DUP2
0000067e: PUSH1 0x01
00000680: PUSH1 0x00
00000682: POP
00000683: SWAP1
00000684: DUP1
00000685: MLOAD
00000686: SWAP1
00000687: PUSH1 0x20
00000689: ADD
0000068a: SWAP1
0000068b: DUP3
0000068c: DUP1
0000068d: SLOAD
0000068e: PUSH1 0x01
00000690: DUP2
00000691: PUSH1 0x01
00000693: AND
00000694: ISZERO
00000695: PUSH2 0x0100
00000698: MUL
00000699: SUB
0000069a: AND
0000069b: PUSH1 0x02
0000069d: SWAP1
0000069e: DIV
0000069f: SWAP1
000006a0: PUSH1 0x00
000006a2: MSTORE
000006a3: PUSH1 0x20
000006a5: PUSH1 0x00
000006a7: KECCAK256
000006a8: SWAP1
000006a9: PUSH1 0x1f
000006ab: ADD
000006ac: PUSH1 0x20
000006ae: SWAP1
000006af: DIV
000006b0: DUP2
000006b1: ADD
000006b2: SWAP3
000006b3: DUP3
000006b4: PUSH1 0x1f
000006b6: LT
000006b7: PUSH2 0x06cb
000006ba: JUMPI
000006bb: DUP1
000006bc: MLOAD
000006bd: PUSH1 0xff
000006bf: NOT
000006c0: AND
000006c1: DUP4
000006c2: DUP1
000006c3: ADD
000006c4: OR
000006c5: DUP6
000006c6: SSTORE
000006c7: PUSH2 0x06fc
000006ca: JUMP
000006cb: JUMPDEST
000006cc: DUP3
000006cd: DUP1
000006ce: ADD
000006cf: PUSH1 0x01
000006d1: ADD
000006d2: DUP6
000006d3: SSTORE
000006d4: DUP3
000006d5: ISZERO
000006d6: PUSH2 0x06fc
000006d9: JUMPI
000006da: SWAP2
000006db: DUP3
000006dc: ADD
000006dd: JUMPDEST
000006de: DUP3
000006df: DUP2
000006e0: GT
000006e1: ISZERO
000006e2: PUSH2 0x06fb
000006e5: JUMPI
000006e6: DUP3
000006e7: MLOAD
000006e8: DUP3
000006e9: PUSH1 0x00
000006eb: POP
000006ec: SSTORE
000006ed: SWAP2
000006ee: PUSH1 0x20
000006f0: ADD
000006f1: SWAP2
000006f2: SWAP1
000006f3: PUSH1 0x01
000006f5: ADD
000006f6: SWAP1
000006f7: PUSH2 0x06dd
000006fa: JUMP
000006fb: JUMPDEST
000006fc: JUMPDEST
000006fd: POP
000006fe: SWAP1
000006ff: POP
00000700: PUSH2 0x0727
00000703: SWAP2
00000704: SWAP1
00000705: PUSH2 0x0709
00000708: JUMP
00000709: JUMPDEST
0000070a: DUP1
0000070b: DUP3
0000070c: GT
0000070d: ISZERO
0000070e: PUSH2 0x0723
00000711: JUMPI
00000712: PUSH1 0x00
00000714: DUP2
00000715: DUP2
00000716: POP
00000717: PUSH1 0x00
00000719: SWAP1
0000071a: SSTORE
0000071b: POP
0000071c: PUSH1 0x01
0000071e: ADD
0000071f: PUSH2 0x0709
00000722: JUMP
00000723: JUMPDEST
00000724: POP
00000725: SWAP1
00000726: JUMP
00000727: JUMPDEST
00000728: POP
00000729: POP
0000072a: DUP1
0000072b: PUSH1 0x02
0000072d: PUSH1 0x00
0000072f: PUSH2 0x0100
00000732: EXP
00000733: DUP2
00000734: SLOAD
00000735: DUP2
00000736: PUSH1 0xff
00000738: MUL
00000739: NOT
0000073a: AND
0000073b: SWAP1
0000073c: DUP4
0000073d: MUL
0000073e: OR
0000073f: SWAP1
00000740: SSTORE
00000741: POP
00000742: JUMPDEST
00000743: POP
00000744: POP
00000745: POP
00000746: POP
00000747: JUMP
View stderr
Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
high other detector Untrusted CALL target/value reachable 60 yes yes
view
trace_id: 0x2c7cec4485473b130e139f56e30cbc80a8a1c7741d205df854dd98ddf328826d
call_targets: 0x0000000000000000000000000000000000000004, 0x89230fdc3b73851da77ebec3cc9f340e48ac0df1
target_varies: yes
classification: target_varies
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0x2c7cec4485473b130e139f56e30cbc80a8a1c7741d205df854dd98ddf328826d",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x0000000000000000000000000000000000000004",
        "0x89230fdc3b73851da77ebec3cc9f340e48ac0df1"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x06fdde03",
            "selector": "0x06fdde03",
            "calldata_variants": [
                "0x06fdde03",
                "0x06fdde030000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x313ce567",
            "selector": "0x313ce567",
            "calldata_variants": [
                "0x313ce567",
                "0x313ce5670000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x70a08231",
            "selector": "0x70a08231",
            "calldata_variants": [
                "0x70a08231",
                "0x70a082310000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x95d89b41",
            "selector": "0x95d89b41",
            "calldata_variants": [
                "0x95d89b41",
                "0x95d89b410000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x95f18951",
            "selector": "0x95f18951",
            "calldata_variants": [
                "0x95f18951",
                "0x95f189510000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa9059cbb",
            "selector": "0xa9059cbb",
            "calldata_variants": [
                "0xa9059cbb",
                "0xa9059cbb0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 185,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 390,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 2,
    "guards_detected": [],
    "untrusted_call_count": 2
}
high other detector ETH value transfer possible 55 yes yes
view
trace_id: 0x2c7cec4485473b130e139f56e30cbc80a8a1c7741d205df854dd98ddf328826d
call_targets: 0x0000000000000000000000000000000000000004, 0x89230fdc3b73851da77ebec3cc9f340e48ac0df1
target_varies: yes
classification: target_varies
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0x2c7cec4485473b130e139f56e30cbc80a8a1c7741d205df854dd98ddf328826d",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x0000000000000000000000000000000000000004",
        "0x89230fdc3b73851da77ebec3cc9f340e48ac0df1"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x06fdde03",
            "selector": "0x06fdde03",
            "calldata_variants": [
                "0x06fdde03",
                "0x06fdde030000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x313ce567",
            "selector": "0x313ce567",
            "calldata_variants": [
                "0x313ce567",
                "0x313ce5670000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x70a08231",
            "selector": "0x70a08231",
            "calldata_variants": [
                "0x70a08231",
                "0x70a082310000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x95d89b41",
            "selector": "0x95d89b41",
            "calldata_variants": [
                "0x95d89b41",
                "0x95d89b410000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x95f18951",
            "selector": "0x95f18951",
            "calldata_variants": [
                "0x95f18951",
                "0x95f189510000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa9059cbb",
            "selector": "0xa9059cbb",
            "calldata_variants": [
                "0xa9059cbb",
                "0xa9059cbb0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 185,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 390,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 2,
    "guards_detected": []
}