TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

019b3836-4684-7264-ba28-59830069d564

complete
Chain ID
1
Address
Block Number
Created
Fri, Dec 19, 2025 8:03 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

Confirmed
2
Validated
2
Source
Bytecode only
Review Backing
Not yet
Best current signal
Untrusted CALL target/value reachable
crit 0 high 2 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
6163 artifact.fetch complete 1 / 3 3 months ago
6164 tool.cast_disasm complete 1 / 3 3 months ago
81247 analysis.bundle complete 1 / 3 1 week ago
81248 capability.graph complete 1 / 3 1 week ago
81249 detector.run complete 1 / 3 1 week ago
81250 validation.fork complete 1 / 3 1 week ago
113634 report.consolidate complete 1 / 6 1 week ago

Artifact

Runtime bytecode: available
Creation TX:
Deployer:
Proxy: no
Implementation:
Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate
Job Status
complete
Attempts
1 / 6
Findings
0
No findings?
View stderr
OpenAI Codex v0.118.0 (research preview)
--------
workdir: /tmp/codex-910bqv2u
model: gpt-5.4
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: none
session id: 019d5c99-d5a5-7b11-ac95-cf0dc29a0acc
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.

Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".

Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
warning: Codex could not find system bubblewrap on PATH. Please install bubblewrap with your package manager. Codex will use the vendored bubblewrap in the meantime.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.
Metadata
{
    "codex": {
        "ran_at": "2026-04-05T07:44:40.435986+00:00",
        "returncode": 1
    },
    "project": {
        "mode": "bytecode",
        "bytecode_length": 3362,
        "bytecode_truncated": false,
        "capability_graph_present": true,
        "analysis_artifact_present": true
    },
    "summary": null,
    "no_findings": null,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
0
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
3
EXT*/BALANCE
0
Total opcodes
1214
Flags
No heuristic flags raised.
View cast disassembly output
00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: CALLDATASIZE
00000006: ISZERO
00000007: PUSH2 0x0082
0000000a: JUMPI
0000000b: PUSH1 0xe0
0000000d: PUSH1 0x02
0000000f: EXP
00000010: PUSH1 0x00
00000012: CALLDATALOAD
00000013: DIV
00000014: PUSH4 0x06fdde03
00000019: DUP2
0000001a: EQ
0000001b: PUSH2 0x008a
0000001e: JUMPI
0000001f: DUP1
00000020: PUSH4 0x18160ddd
00000025: EQ
00000026: PUSH2 0x00e6
00000029: JUMPI
0000002a: DUP1
0000002b: PUSH4 0x23b872dd
00000030: EQ
00000031: PUSH2 0x00ef
00000034: JUMPI
00000035: DUP1
00000036: PUSH4 0x313ce567
0000003b: EQ
0000003c: PUSH2 0x0121
0000003f: JUMPI
00000040: DUP1
00000041: PUSH4 0x5a3b7e42
00000046: EQ
00000047: PUSH2 0x012d
0000004a: JUMPI
0000004b: DUP1
0000004c: PUSH4 0x70a08231
00000051: EQ
00000052: PUSH2 0x018a
00000055: JUMPI
00000056: DUP1
00000057: PUSH4 0x95d89b41
0000005c: EQ
0000005d: PUSH2 0x01a2
00000060: JUMPI
00000061: DUP1
00000062: PUSH4 0xa9059cbb
00000067: EQ
00000068: PUSH2 0x01fc
0000006b: JUMPI
0000006c: DUP1
0000006d: PUSH4 0xcae9ca51
00000072: EQ
00000073: PUSH2 0x022b
00000076: JUMPI
00000077: DUP1
00000078: PUSH4 0xdd62ed3e
0000007d: EQ
0000007e: PUSH2 0x038d
00000081: JUMPI
00000082: JUMPDEST
00000083: PUSH2 0x03b2
00000086: PUSH2 0x0002
00000089: JUMP
0000008a: JUMPDEST
0000008b: PUSH2 0x03b4
0000008e: PUSH1 0x01
00000090: DUP1
00000091: SLOAD
00000092: PUSH1 0x20
00000094: PUSH1 0x02
00000096: DUP3
00000097: DUP5
00000098: AND
00000099: ISZERO
0000009a: PUSH2 0x0100
0000009d: MUL
0000009e: PUSH1 0x00
000000a0: NOT
000000a1: ADD
000000a2: SWAP1
000000a3: SWAP3
000000a4: AND
000000a5: SWAP2
000000a6: SWAP1
000000a7: SWAP2
000000a8: DIV
000000a9: PUSH1 0x1f
000000ab: DUP2
000000ac: ADD
000000ad: DUP3
000000ae: SWAP1
000000af: DIV
000000b0: SWAP1
000000b1: SWAP2
000000b2: MUL
000000b3: PUSH1 0x80
000000b5: SWAP1
000000b6: DUP2
000000b7: ADD
000000b8: PUSH1 0x40
000000ba: MSTORE
000000bb: PUSH1 0x60
000000bd: DUP3
000000be: DUP2
000000bf: MSTORE
000000c0: SWAP3
000000c1: SWAP2
000000c2: SWAP1
000000c3: DUP3
000000c4: DUP3
000000c5: DUP1
000000c6: ISZERO
000000c7: PUSH2 0x0469
000000ca: JUMPI
000000cb: DUP1
000000cc: PUSH1 0x1f
000000ce: LT
000000cf: PUSH2 0x043e
000000d2: JUMPI
000000d3: PUSH2 0x0100
000000d6: DUP1
000000d7: DUP4
000000d8: SLOAD
000000d9: DIV
000000da: MUL
000000db: DUP4
000000dc: MSTORE
000000dd: SWAP2
000000de: PUSH1 0x20
000000e0: ADD
000000e1: SWAP2
000000e2: PUSH2 0x0469
000000e5: JUMP
000000e6: JUMPDEST
000000e7: PUSH2 0x0422
000000ea: PUSH1 0x04
000000ec: SLOAD
000000ed: DUP2
000000ee: JUMP
000000ef: JUMPDEST
000000f0: PUSH2 0x0422
000000f3: PUSH1 0x04
000000f5: CALLDATALOAD
000000f6: PUSH1 0x24
000000f8: CALLDATALOAD
000000f9: PUSH1 0x44
000000fb: CALLDATALOAD
000000fc: PUSH1 0x01
000000fe: PUSH1 0xa0
00000100: PUSH1 0x02
00000102: EXP
00000103: SUB
00000104: DUP4
00000105: AND
00000106: PUSH1 0x00
00000108: SWAP1
00000109: DUP2
0000010a: MSTORE
0000010b: PUSH1 0x05
0000010d: PUSH1 0x20
0000010f: MSTORE
00000110: PUSH1 0x40
00000112: DUP2
00000113: KECCAK256
00000114: SLOAD
00000115: DUP3
00000116: SWAP1
00000117: LT
00000118: ISZERO
00000119: PUSH2 0x0540
0000011c: JUMPI
0000011d: PUSH2 0x0002
00000120: JUMP
00000121: JUMPDEST
00000122: PUSH2 0x0434
00000125: PUSH1 0x03
00000127: SLOAD
00000128: PUSH1 0xff
0000012a: AND
0000012b: DUP2
0000012c: JUMP
0000012d: JUMPDEST
0000012e: PUSH2 0x03b4
00000131: PUSH1 0x00
00000133: DUP1
00000134: SLOAD
00000135: PUSH1 0x20
00000137: PUSH1 0x02
00000139: PUSH1 0x01
0000013b: DUP4
0000013c: AND
0000013d: ISZERO
0000013e: PUSH2 0x0100
00000141: MUL
00000142: PUSH1 0x00
00000144: NOT
00000145: ADD
00000146: SWAP1
00000147: SWAP3
00000148: AND
00000149: SWAP2
0000014a: SWAP1
0000014b: SWAP2
0000014c: DIV
0000014d: PUSH1 0x1f
0000014f: DUP2
00000150: ADD
00000151: DUP3
00000152: SWAP1
00000153: DIV
00000154: SWAP1
00000155: SWAP2
00000156: MUL
00000157: PUSH1 0x80
00000159: SWAP1
0000015a: DUP2
0000015b: ADD
0000015c: PUSH1 0x40
0000015e: MSTORE
0000015f: PUSH1 0x60
00000161: DUP3
00000162: DUP2
00000163: MSTORE
00000164: SWAP3
00000165: SWAP2
00000166: SWAP1
00000167: DUP3
00000168: DUP3
00000169: DUP1
0000016a: ISZERO
0000016b: PUSH2 0x0469
0000016e: JUMPI
0000016f: DUP1
00000170: PUSH1 0x1f
00000172: LT
00000173: PUSH2 0x043e
00000176: JUMPI
00000177: PUSH2 0x0100
0000017a: DUP1
0000017b: DUP4
0000017c: SLOAD
0000017d: DIV
0000017e: MUL
0000017f: DUP4
00000180: MSTORE
00000181: SWAP2
00000182: PUSH1 0x20
00000184: ADD
00000185: SWAP2
00000186: PUSH2 0x0469
00000189: JUMP
0000018a: JUMPDEST
0000018b: PUSH2 0x0422
0000018e: PUSH1 0x04
00000190: CALLDATALOAD
00000191: PUSH1 0x05
00000193: PUSH1 0x20
00000195: MSTORE
00000196: PUSH1 0x00
00000198: SWAP1
00000199: DUP2
0000019a: MSTORE
0000019b: PUSH1 0x40
0000019d: SWAP1
0000019e: KECCAK256
0000019f: SLOAD
000001a0: DUP2
000001a1: JUMP
000001a2: JUMPDEST
000001a3: PUSH2 0x03b4
000001a6: PUSH1 0x02
000001a8: DUP1
000001a9: SLOAD
000001aa: PUSH1 0x20
000001ac: PUSH1 0x01
000001ae: DUP3
000001af: AND
000001b0: ISZERO
000001b1: PUSH2 0x0100
000001b4: MUL
000001b5: PUSH1 0x00
000001b7: NOT
000001b8: ADD
000001b9: SWAP1
000001ba: SWAP2
000001bb: AND
000001bc: DUP3
000001bd: SWAP1
000001be: DIV
000001bf: PUSH1 0x1f
000001c1: DUP2
000001c2: ADD
000001c3: DUP3
000001c4: SWAP1
000001c5: DIV
000001c6: SWAP1
000001c7: SWAP2
000001c8: MUL
000001c9: PUSH1 0x80
000001cb: SWAP1
000001cc: DUP2
000001cd: ADD
000001ce: PUSH1 0x40
000001d0: MSTORE
000001d1: PUSH1 0x60
000001d3: DUP3
000001d4: DUP2
000001d5: MSTORE
000001d6: SWAP3
000001d7: SWAP2
000001d8: SWAP1
000001d9: DUP3
000001da: DUP3
000001db: DUP1
000001dc: ISZERO
000001dd: PUSH2 0x0469
000001e0: JUMPI
000001e1: DUP1
000001e2: PUSH1 0x1f
000001e4: LT
000001e5: PUSH2 0x043e
000001e8: JUMPI
000001e9: PUSH2 0x0100
000001ec: DUP1
000001ed: DUP4
000001ee: SLOAD
000001ef: DIV
000001f0: MUL
000001f1: DUP4
000001f2: MSTORE
000001f3: SWAP2
000001f4: PUSH1 0x20
000001f6: ADD
000001f7: SWAP2
000001f8: PUSH2 0x0469
000001fb: JUMP
000001fc: JUMPDEST
000001fd: PUSH2 0x03b2
00000200: PUSH1 0x04
00000202: CALLDATALOAD
00000203: PUSH1 0x24
00000205: CALLDATALOAD
00000206: PUSH1 0x01
00000208: PUSH1 0xa0
0000020a: PUSH1 0x02
0000020c: EXP
0000020d: SUB
0000020e: CALLER
0000020f: AND
00000210: PUSH1 0x00
00000212: SWAP1
00000213: DUP2
00000214: MSTORE
00000215: PUSH1 0x05
00000217: PUSH1 0x20
00000219: MSTORE
0000021a: PUSH1 0x40
0000021c: SWAP1
0000021d: KECCAK256
0000021e: SLOAD
0000021f: DUP2
00000220: SWAP1
00000221: LT
00000222: ISZERO
00000223: PUSH2 0x0471
00000226: JUMPI
00000227: PUSH2 0x0002
0000022a: JUMP
0000022b: JUMPDEST
0000022c: PUSH1 0x80
0000022e: PUSH1 0x20
00000230: PUSH1 0x44
00000232: CALLDATALOAD
00000233: PUSH1 0x04
00000235: DUP2
00000236: DUP2
00000237: ADD
00000238: CALLDATALOAD
00000239: PUSH1 0x1f
0000023b: DUP2
0000023c: ADD
0000023d: DUP5
0000023e: SWAP1
0000023f: DIV
00000240: SWAP1
00000241: SWAP4
00000242: MUL
00000243: DUP5
00000244: ADD
00000245: PUSH1 0x40
00000247: MSTORE
00000248: PUSH1 0x60
0000024a: DUP4
0000024b: DUP2
0000024c: MSTORE
0000024d: PUSH2 0x0422
00000250: SWAP5
00000251: DUP3
00000252: CALLDATALOAD
00000253: SWAP5
00000254: PUSH1 0x24
00000256: DUP1
00000257: CALLDATALOAD
00000258: SWAP6
00000259: PUSH1 0x64
0000025b: SWAP5
0000025c: SWAP4
0000025d: SWAP2
0000025e: ADD
0000025f: SWAP2
00000260: SWAP1
00000261: DUP2
00000262: SWAP1
00000263: DUP4
00000264: DUP3
00000265: DUP1
00000266: DUP3
00000267: DUP5
00000268: CALLDATACOPY
00000269: POP
0000026a: SWAP5
0000026b: SWAP7
0000026c: POP
0000026d: POP
0000026e: POP
0000026f: POP
00000270: POP
00000271: POP
00000272: POP
00000273: PUSH1 0x00
00000275: PUSH1 0x00
00000277: DUP4
00000278: PUSH1 0x06
0000027a: PUSH1 0x00
0000027c: POP
0000027d: PUSH1 0x00
0000027f: CALLER
00000280: PUSH1 0x01
00000282: PUSH1 0xa0
00000284: PUSH1 0x02
00000286: EXP
00000287: SUB
00000288: AND
00000289: DUP2
0000028a: MSTORE
0000028b: PUSH1 0x20
0000028d: ADD
0000028e: SWAP1
0000028f: DUP2
00000290: MSTORE
00000291: PUSH1 0x20
00000293: ADD
00000294: PUSH1 0x00
00000296: KECCAK256
00000297: PUSH1 0x00
00000299: POP
0000029a: PUSH1 0x00
0000029c: DUP8
0000029d: PUSH1 0x01
0000029f: PUSH1 0xa0
000002a1: PUSH1 0x02
000002a3: EXP
000002a4: SUB
000002a5: AND
000002a6: DUP2
000002a7: MSTORE
000002a8: PUSH1 0x20
000002aa: ADD
000002ab: SWAP1
000002ac: DUP2
000002ad: MSTORE
000002ae: PUSH1 0x20
000002b0: ADD
000002b1: PUSH1 0x00
000002b3: KECCAK256
000002b4: PUSH1 0x00
000002b6: POP
000002b7: DUP2
000002b8: SWAP1
000002b9: SSTORE
000002ba: POP
000002bb: DUP5
000002bc: SWAP1
000002bd: POP
000002be: DUP1
000002bf: PUSH1 0x01
000002c1: PUSH1 0xa0
000002c3: PUSH1 0x02
000002c5: EXP
000002c6: SUB
000002c7: AND
000002c8: PUSH4 0x8f4ffcb1
000002cd: CALLER
000002ce: DUP7
000002cf: ADDRESS
000002d0: DUP8
000002d1: PUSH1 0x40
000002d3: MLOAD
000002d4: DUP6
000002d5: PUSH1 0xe0
000002d7: PUSH1 0x02
000002d9: EXP
000002da: MUL
000002db: DUP2
000002dc: MSTORE
000002dd: PUSH1 0x04
000002df: ADD
000002e0: DUP1
000002e1: DUP6
000002e2: PUSH1 0x01
000002e4: PUSH1 0xa0
000002e6: PUSH1 0x02
000002e8: EXP
000002e9: SUB
000002ea: AND
000002eb: DUP2
000002ec: MSTORE
000002ed: PUSH1 0x20
000002ef: ADD
000002f0: DUP5
000002f1: DUP2
000002f2: MSTORE
000002f3: PUSH1 0x20
000002f5: ADD
000002f6: DUP4
000002f7: PUSH1 0x01
000002f9: PUSH1 0xa0
000002fb: PUSH1 0x02
000002fd: EXP
000002fe: SUB
000002ff: AND
00000300: DUP2
00000301: MSTORE
00000302: PUSH1 0x20
00000304: ADD
00000305: DUP1
00000306: PUSH1 0x20
00000308: ADD
00000309: DUP3
0000030a: DUP2
0000030b: SUB
0000030c: DUP3
0000030d: MSTORE
0000030e: DUP4
0000030f: DUP2
00000310: DUP2
00000311: MLOAD
00000312: DUP2
00000313: MSTORE
00000314: PUSH1 0x20
00000316: ADD
00000317: SWAP2
00000318: POP
00000319: DUP1
0000031a: MLOAD
0000031b: SWAP1
0000031c: PUSH1 0x20
0000031e: ADD
0000031f: SWAP1
00000320: DUP1
00000321: DUP4
00000322: DUP4
00000323: DUP3
00000324: SWAP1
00000325: PUSH1 0x00
00000327: PUSH1 0x04
00000329: PUSH1 0x20
0000032b: DUP5
0000032c: PUSH1 0x1f
0000032e: ADD
0000032f: DIV
00000330: PUSH1 0x0f
00000332: MUL
00000333: PUSH1 0x03
00000335: ADD
00000336: CALL
00000337: POP
00000338: SWAP1
00000339: POP
0000033a: SWAP1
0000033b: DUP2
0000033c: ADD
0000033d: SWAP1
0000033e: PUSH1 0x1f
00000340: AND
00000341: DUP1
00000342: ISZERO
00000343: PUSH2 0x0360
00000346: JUMPI
00000347: DUP1
00000348: DUP3
00000349: SUB
0000034a: DUP1
0000034b: MLOAD
0000034c: PUSH1 0x01
0000034e: DUP4
0000034f: PUSH1 0x20
00000351: SUB
00000352: PUSH2 0x0100
00000355: EXP
00000356: SUB
00000357: NOT
00000358: AND
00000359: DUP2
0000035a: MSTORE
0000035b: PUSH1 0x20
0000035d: ADD
0000035e: SWAP2
0000035f: POP
00000360: JUMPDEST
00000361: POP
00000362: SWAP6
00000363: POP
00000364: POP
00000365: POP
00000366: POP
00000367: POP
00000368: POP
00000369: PUSH1 0x00
0000036b: PUSH1 0x40
0000036d: MLOAD
0000036e: DUP1
0000036f: DUP4
00000370: SUB
00000371: DUP2
00000372: PUSH1 0x00
00000374: DUP8
00000375: PUSH2 0x61da
00000378: GAS
00000379: SUB
0000037a: CALL
0000037b: ISZERO
0000037c: PUSH2 0x0002
0000037f: JUMPI
00000380: POP
00000381: PUSH1 0x01
00000383: SWAP8
00000384: SWAP7
00000385: POP
00000386: POP
00000387: POP
00000388: POP
00000389: POP
0000038a: POP
0000038b: POP
0000038c: JUMP
0000038d: JUMPDEST
0000038e: PUSH1 0x06
00000390: PUSH1 0x20
00000392: SWAP1
00000393: DUP2
00000394: MSTORE
00000395: PUSH1 0x04
00000397: CALLDATALOAD
00000398: PUSH1 0x00
0000039a: SWAP1
0000039b: DUP2
0000039c: MSTORE
0000039d: PUSH1 0x40
0000039f: DUP1
000003a0: DUP3
000003a1: KECCAK256
000003a2: SWAP1
000003a3: SWAP3
000003a4: MSTORE
000003a5: PUSH1 0x24
000003a7: CALLDATALOAD
000003a8: DUP2
000003a9: MSTORE
000003aa: KECCAK256
000003ab: SLOAD
000003ac: PUSH2 0x0422
000003af: SWAP1
000003b0: DUP2
000003b1: JUMP
000003b2: JUMPDEST
000003b3: STOP
000003b4: JUMPDEST
000003b5: PUSH1 0x40
000003b7: MLOAD
000003b8: DUP1
000003b9: DUP1
000003ba: PUSH1 0x20
000003bc: ADD
000003bd: DUP3
000003be: DUP2
000003bf: SUB
000003c0: DUP3
000003c1: MSTORE
000003c2: DUP4
000003c3: DUP2
000003c4: DUP2
000003c5: MLOAD
000003c6: DUP2
000003c7: MSTORE
000003c8: PUSH1 0x20
000003ca: ADD
000003cb: SWAP2
000003cc: POP
000003cd: DUP1
000003ce: MLOAD
000003cf: SWAP1
000003d0: PUSH1 0x20
000003d2: ADD
000003d3: SWAP1
000003d4: DUP1
000003d5: DUP4
000003d6: DUP4
000003d7: DUP3
000003d8: SWAP1
000003d9: PUSH1 0x00
000003db: PUSH1 0x04
000003dd: PUSH1 0x20
000003df: DUP5
000003e0: PUSH1 0x1f
000003e2: ADD
000003e3: DIV
000003e4: PUSH1 0x0f
000003e6: MUL
000003e7: PUSH1 0x03
000003e9: ADD
000003ea: CALL
000003eb: POP
000003ec: SWAP1
000003ed: POP
000003ee: SWAP1
000003ef: DUP2
000003f0: ADD
000003f1: SWAP1
000003f2: PUSH1 0x1f
000003f4: AND
000003f5: DUP1
000003f6: ISZERO
000003f7: PUSH2 0x0414
000003fa: JUMPI
000003fb: DUP1
000003fc: DUP3
000003fd: SUB
000003fe: DUP1
000003ff: MLOAD
00000400: PUSH1 0x01
00000402: DUP4
00000403: PUSH1 0x20
00000405: SUB
00000406: PUSH2 0x0100
00000409: EXP
0000040a: SUB
0000040b: NOT
0000040c: AND
0000040d: DUP2
0000040e: MSTORE
0000040f: PUSH1 0x20
00000411: ADD
00000412: SWAP2
00000413: POP
00000414: JUMPDEST
00000415: POP
00000416: SWAP3
00000417: POP
00000418: POP
00000419: POP
0000041a: PUSH1 0x40
0000041c: MLOAD
0000041d: DUP1
0000041e: SWAP2
0000041f: SUB
00000420: SWAP1
00000421: RETURN
00000422: JUMPDEST
00000423: PUSH1 0x40
00000425: DUP1
00000426: MLOAD
00000427: SWAP2
00000428: DUP3
00000429: MSTORE
0000042a: MLOAD
0000042b: SWAP1
0000042c: DUP2
0000042d: SWAP1
0000042e: SUB
0000042f: PUSH1 0x20
00000431: ADD
00000432: SWAP1
00000433: RETURN
00000434: JUMPDEST
00000435: PUSH1 0x60
00000437: SWAP1
00000438: DUP2
00000439: MSTORE
0000043a: PUSH1 0x20
0000043c: SWAP1
0000043d: RETURN
0000043e: JUMPDEST
0000043f: DUP3
00000440: ADD
00000441: SWAP2
00000442: SWAP1
00000443: PUSH1 0x00
00000445: MSTORE
00000446: PUSH1 0x20
00000448: PUSH1 0x00
0000044a: KECCAK256
0000044b: SWAP1
0000044c: JUMPDEST
0000044d: DUP2
0000044e: SLOAD
0000044f: DUP2
00000450: MSTORE
00000451: SWAP1
00000452: PUSH1 0x01
00000454: ADD
00000455: SWAP1
00000456: PUSH1 0x20
00000458: ADD
00000459: DUP1
0000045a: DUP4
0000045b: GT
0000045c: PUSH2 0x044c
0000045f: JUMPI
00000460: DUP3
00000461: SWAP1
00000462: SUB
00000463: PUSH1 0x1f
00000465: AND
00000466: DUP3
00000467: ADD
00000468: SWAP2
00000469: JUMPDEST
0000046a: POP
0000046b: POP
0000046c: POP
0000046d: POP
0000046e: POP
0000046f: DUP2
00000470: JUMP
00000471: JUMPDEST
00000472: PUSH1 0x01
00000474: PUSH1 0xa0
00000476: PUSH1 0x02
00000478: EXP
00000479: SUB
0000047a: DUP3
0000047b: AND
0000047c: PUSH1 0x00
0000047e: SWAP1
0000047f: DUP2
00000480: MSTORE
00000481: PUSH1 0x40
00000483: SWAP1
00000484: KECCAK256
00000485: SLOAD
00000486: DUP1
00000487: DUP3
00000488: ADD
00000489: LT
0000048a: ISZERO
0000048b: PUSH2 0x0493
0000048e: JUMPI
0000048f: PUSH2 0x0002
00000492: JUMP
00000493: JUMPDEST
00000494: DUP1
00000495: PUSH1 0x05
00000497: PUSH1 0x00
00000499: POP
0000049a: PUSH1 0x00
0000049c: CALLER
0000049d: PUSH1 0x01
0000049f: PUSH1 0xa0
000004a1: PUSH1 0x02
000004a3: EXP
000004a4: SUB
000004a5: AND
000004a6: DUP2
000004a7: MSTORE
000004a8: PUSH1 0x20
000004aa: ADD
000004ab: SWAP1
000004ac: DUP2
000004ad: MSTORE
000004ae: PUSH1 0x20
000004b0: ADD
000004b1: PUSH1 0x00
000004b3: KECCAK256
000004b4: PUSH1 0x00
000004b6: DUP3
000004b7: DUP3
000004b8: DUP3
000004b9: POP
000004ba: SLOAD
000004bb: SUB
000004bc: SWAP3
000004bd: POP
000004be: POP
000004bf: DUP2
000004c0: SWAP1
000004c1: SSTORE
000004c2: POP
000004c3: DUP1
000004c4: PUSH1 0x05
000004c6: PUSH1 0x00
000004c8: POP
000004c9: PUSH1 0x00
000004cb: DUP5
000004cc: PUSH1 0x01
000004ce: PUSH1 0xa0
000004d0: PUSH1 0x02
000004d2: EXP
000004d3: SUB
000004d4: AND
000004d5: DUP2
000004d6: MSTORE
000004d7: PUSH1 0x20
000004d9: ADD
000004da: SWAP1
000004db: DUP2
000004dc: MSTORE
000004dd: PUSH1 0x20
000004df: ADD
000004e0: PUSH1 0x00
000004e2: KECCAK256
000004e3: PUSH1 0x00
000004e5: DUP3
000004e6: DUP3
000004e7: DUP3
000004e8: POP
000004e9: SLOAD
000004ea: ADD
000004eb: SWAP3
000004ec: POP
000004ed: POP
000004ee: DUP2
000004ef: SWAP1
000004f0: SSTORE
000004f1: POP
000004f2: DUP2
000004f3: PUSH1 0x01
000004f5: PUSH1 0xa0
000004f7: PUSH1 0x02
000004f9: EXP
000004fa: SUB
000004fb: AND
000004fc: CALLER
000004fd: PUSH1 0x01
000004ff: PUSH1 0xa0
00000501: PUSH1 0x02
00000503: EXP
00000504: SUB
00000505: AND
00000506: PUSH32 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef
00000527: DUP4
00000528: PUSH1 0x40
0000052a: MLOAD
0000052b: DUP1
0000052c: DUP3
0000052d: DUP2
0000052e: MSTORE
0000052f: PUSH1 0x20
00000531: ADD
00000532: SWAP2
00000533: POP
00000534: POP
00000535: PUSH1 0x40
00000537: MLOAD
00000538: DUP1
00000539: SWAP2
0000053a: SUB
0000053b: SWAP1
0000053c: LOG3
0000053d: POP
0000053e: POP
0000053f: JUMP
00000540: JUMPDEST
00000541: PUSH1 0x01
00000543: PUSH1 0xa0
00000545: PUSH1 0x02
00000547: EXP
00000548: SUB
00000549: DUP4
0000054a: AND
0000054b: DUP2
0000054c: MSTORE
0000054d: PUSH1 0x40
0000054f: DUP2
00000550: KECCAK256
00000551: SLOAD
00000552: DUP1
00000553: DUP4
00000554: ADD
00000555: LT
00000556: ISZERO
00000557: PUSH2 0x055f
0000055a: JUMPI
0000055b: PUSH2 0x0002
0000055e: JUMP
0000055f: JUMPDEST
00000560: PUSH1 0x01
00000562: PUSH1 0xa0
00000564: PUSH1 0x02
00000566: EXP
00000567: SUB
00000568: DUP1
00000569: DUP6
0000056a: AND
0000056b: DUP3
0000056c: MSTORE
0000056d: PUSH1 0x06
0000056f: PUSH1 0x20
00000571: SWAP1
00000572: DUP2
00000573: MSTORE
00000574: PUSH1 0x40
00000576: DUP1
00000577: DUP5
00000578: KECCAK256
00000579: CALLER
0000057a: SWAP4
0000057b: SWAP1
0000057c: SWAP4
0000057d: AND
0000057e: DUP5
0000057f: MSTORE
00000580: SWAP2
00000581: SWAP1
00000582: MSTORE
00000583: DUP2
00000584: KECCAK256
00000585: SLOAD
00000586: DUP3
00000587: GT
00000588: ISZERO
00000589: PUSH2 0x0591
0000058c: JUMPI
0000058d: PUSH2 0x0002
00000590: JUMP
00000591: JUMPDEST
00000592: DUP2
00000593: PUSH1 0x05
00000595: PUSH1 0x00
00000597: POP
00000598: PUSH1 0x00
0000059a: DUP7
0000059b: PUSH1 0x01
0000059d: PUSH1 0xa0
0000059f: PUSH1 0x02
000005a1: EXP
000005a2: SUB
000005a3: AND
000005a4: DUP2
000005a5: MSTORE
000005a6: PUSH1 0x20
000005a8: ADD
000005a9: SWAP1
000005aa: DUP2
000005ab: MSTORE
000005ac: PUSH1 0x20
000005ae: ADD
000005af: PUSH1 0x00
000005b1: KECCAK256
000005b2: PUSH1 0x00
000005b4: DUP3
000005b5: DUP3
000005b6: DUP3
000005b7: POP
000005b8: SLOAD
000005b9: SUB
000005ba: SWAP3
000005bb: POP
000005bc: POP
000005bd: DUP2
000005be: SWAP1
000005bf: SSTORE
000005c0: POP
000005c1: DUP2
000005c2: PUSH1 0x05
000005c4: PUSH1 0x00
000005c6: POP
000005c7: PUSH1 0x00
000005c9: DUP6
000005ca: PUSH1 0x01
000005cc: PUSH1 0xa0
000005ce: PUSH1 0x02
000005d0: EXP
000005d1: SUB
000005d2: AND
000005d3: DUP2
000005d4: MSTORE
000005d5: PUSH1 0x20
000005d7: ADD
000005d8: SWAP1
000005d9: DUP2
000005da: MSTORE
000005db: PUSH1 0x20
000005dd: ADD
000005de: PUSH1 0x00
000005e0: KECCAK256
000005e1: PUSH1 0x00
000005e3: DUP3
000005e4: DUP3
000005e5: DUP3
000005e6: POP
000005e7: SLOAD
000005e8: ADD
000005e9: SWAP3
000005ea: POP
000005eb: POP
000005ec: DUP2
000005ed: SWAP1
000005ee: SSTORE
000005ef: POP
000005f0: DUP2
000005f1: PUSH1 0x06
000005f3: PUSH1 0x00
000005f5: POP
000005f6: PUSH1 0x00
000005f8: DUP7
000005f9: PUSH1 0x01
000005fb: PUSH1 0xa0
000005fd: PUSH1 0x02
000005ff: EXP
00000600: SUB
00000601: AND
00000602: DUP2
00000603: MSTORE
00000604: PUSH1 0x20
00000606: ADD
00000607: SWAP1
00000608: DUP2
00000609: MSTORE
0000060a: PUSH1 0x20
0000060c: ADD
0000060d: PUSH1 0x00
0000060f: KECCAK256
00000610: PUSH1 0x00
00000612: POP
00000613: PUSH1 0x00
00000615: CALLER
00000616: PUSH1 0x01
00000618: PUSH1 0xa0
0000061a: PUSH1 0x02
0000061c: EXP
0000061d: SUB
0000061e: AND
0000061f: DUP2
00000620: MSTORE
00000621: PUSH1 0x20
00000623: ADD
00000624: SWAP1
00000625: DUP2
00000626: MSTORE
00000627: PUSH1 0x20
00000629: ADD
0000062a: PUSH1 0x00
0000062c: KECCAK256
0000062d: PUSH1 0x00
0000062f: DUP3
00000630: DUP3
00000631: DUP3
00000632: POP
00000633: SLOAD
00000634: SUB
00000635: SWAP3
00000636: POP
00000637: POP
00000638: DUP2
00000639: SWAP1
0000063a: SSTORE
0000063b: POP
0000063c: DUP3
0000063d: PUSH1 0x01
0000063f: PUSH1 0xa0
00000641: PUSH1 0x02
00000643: EXP
00000644: SUB
00000645: AND
00000646: DUP5
00000647: PUSH1 0x01
00000649: PUSH1 0xa0
0000064b: PUSH1 0x02
0000064d: EXP
0000064e: SUB
0000064f: AND
00000650: PUSH32 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef
00000671: DUP5
00000672: PUSH1 0x40
00000674: MLOAD
00000675: DUP1
00000676: DUP3
00000677: DUP2
00000678: MSTORE
00000679: PUSH1 0x20
0000067b: ADD
0000067c: SWAP2
0000067d: POP
0000067e: POP
0000067f: PUSH1 0x40
00000681: MLOAD
00000682: DUP1
00000683: SWAP2
00000684: SUB
00000685: SWAP1
00000686: LOG3
00000687: POP
00000688: PUSH1 0x01
0000068a: SWAP4
0000068b: SWAP3
0000068c: POP
0000068d: POP
0000068e: POP
0000068f: JUMP
View stderr
Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
high other detector Untrusted CALL target/value reachable 60 yes yes
view
trace_id: 0xe4017b4606df3e312106058efb6400333c01cdd27824d7e797a5aa73dc50cf40
call_targets: 0x0000000000000000000000000000000000000004, 0xdc9f5e8ed6a55054ee2e44363b955b99f2a9e0db
target_varies: yes
classification: target_varies
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0xe4017b4606df3e312106058efb6400333c01cdd27824d7e797a5aa73dc50cf40",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x0000000000000000000000000000000000000004",
        "0xdc9f5e8ed6a55054ee2e44363b955b99f2a9e0db"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x06fdde03",
            "selector": "0x06fdde03",
            "calldata_variants": [
                "0x06fdde03",
                "0x06fdde030000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x18160ddd",
            "selector": "0x18160ddd",
            "calldata_variants": [
                "0x18160ddd",
                "0x18160ddd0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x23b872dd",
            "selector": "0x23b872dd",
            "calldata_variants": [
                "0x23b872dd",
                "0x23b872dd0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x313ce567",
            "selector": "0x313ce567",
            "calldata_variants": [
                "0x313ce567",
                "0x313ce5670000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x5a3b7e42",
            "selector": "0x5a3b7e42",
            "calldata_variants": [
                "0x5a3b7e42",
                "0x5a3b7e420000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x70a08231",
            "selector": "0x70a08231",
            "calldata_variants": [
                "0x70a08231",
                "0x70a082310000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x95d89b41",
            "selector": "0x95d89b41",
            "calldata_variants": [
                "0x95d89b41",
                "0x95d89b410000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa9059cbb",
            "selector": "0xa9059cbb",
            "calldata_variants": [
                "0xa9059cbb",
                "0xa9059cbb0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 822,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 890,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1002,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 3,
    "guards_detected": [],
    "untrusted_call_count": 3
}
high other detector ETH value transfer possible 55 yes yes
view
trace_id: 0xe4017b4606df3e312106058efb6400333c01cdd27824d7e797a5aa73dc50cf40
call_targets: 0x0000000000000000000000000000000000000004, 0xdc9f5e8ed6a55054ee2e44363b955b99f2a9e0db
target_varies: yes
classification: target_varies
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0xe4017b4606df3e312106058efb6400333c01cdd27824d7e797a5aa73dc50cf40",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x0000000000000000000000000000000000000004",
        "0xdc9f5e8ed6a55054ee2e44363b955b99f2a9e0db"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x06fdde03",
            "selector": "0x06fdde03",
            "calldata_variants": [
                "0x06fdde03",
                "0x06fdde030000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x18160ddd",
            "selector": "0x18160ddd",
            "calldata_variants": [
                "0x18160ddd",
                "0x18160ddd0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x23b872dd",
            "selector": "0x23b872dd",
            "calldata_variants": [
                "0x23b872dd",
                "0x23b872dd0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x313ce567",
            "selector": "0x313ce567",
            "calldata_variants": [
                "0x313ce567",
                "0x313ce5670000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x5a3b7e42",
            "selector": "0x5a3b7e42",
            "calldata_variants": [
                "0x5a3b7e42",
                "0x5a3b7e420000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x70a08231",
            "selector": "0x70a08231",
            "calldata_variants": [
                "0x70a08231",
                "0x70a082310000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x95d89b41",
            "selector": "0x95d89b41",
            "calldata_variants": [
                "0x95d89b41",
                "0x95d89b410000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa9059cbb",
            "selector": "0xa9059cbb",
            "calldata_variants": [
                "0xa9059cbb",
                "0xa9059cbb0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 822,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 890,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1002,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 3,
    "guards_detected": []
}