Analysis Run

019b3836-4f28-70a0-a777-8fedb743bf2d

complete

Chain ID

1

Address

0xd5e6ef2f1d8d689e36a09577cc63bb21bbbefdbe

Block Number

—

Created

Fri, Dec 19, 2025 8:04 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Bytecode only

Review Backing

Not yet

Best current signal

ETH value transfer possible

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
7491	artifact.fetch	complete	1 / 3	3 months ago
7492	tool.cast_disasm	complete	1 / 3	3 months ago
109310	analysis.bundle	complete	1 / 3	1 week ago
109311	capability.graph	complete	1 / 3	1 week ago
109312	detector.run	complete	1 / 3	1 week ago
109313	validation.fork	complete	1 / 3	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

0

Selfdestruct

0

CREATE2

0

CALL-family (heavy)

1

EXT*/BALANCE

0

Total opcodes

230

Flags

No heuristic flags raised.

View cast disassembly output

00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: CALLDATASIZE
00000006: ISZERO
00000007: PUSH2 0x0040
0000000a: JUMPI
0000000b: PUSH1 0xe0
0000000d: PUSH1 0x02
0000000f: EXP
00000010: PUSH1 0x00
00000012: CALLDATALOAD
00000013: DIV
00000014: PUSH4 0x0221038a
00000019: DUP2
0000001a: EQ
0000001b: PUSH2 0x004d
0000001e: JUMPI
0000001f: DUP1
00000020: PUSH4 0x18bdc79a
00000025: EQ
00000026: PUSH2 0x00aa
00000029: JUMPI
0000002a: DUP1
0000002b: PUSH4 0x8da5cb5b
00000030: EQ
00000031: PUSH2 0x00be
00000034: JUMPI
00000035: DUP1
00000036: PUSH4 0xd2cc718f
0000003b: EQ
0000003c: PUSH2 0x00d0
0000003f: JUMPI
00000040: JUMPDEST
00000041: PUSH2 0x00d9
00000044: PUSH1 0x01
00000046: DUP1
00000047: SLOAD
00000048: CALLVALUE
00000049: ADD
0000004a: SWAP1
0000004b: SSTORE
0000004c: JUMP
0000004d: JUMPDEST
0000004e: PUSH2 0x00db
00000051: PUSH1 0x04
00000053: CALLDATALOAD
00000054: PUSH1 0x24
00000056: CALLDATALOAD
00000057: PUSH1 0x00
00000059: DUP1
0000005a: SLOAD
0000005b: CALLER
0000005c: PUSH1 0x01
0000005e: PUSH1 0xa0
00000060: PUSH1 0x02
00000062: EXP
00000063: SUB
00000064: SWAP1
00000065: DUP2
00000066: AND
00000067: SWAP2
00000068: AND
00000069: EQ
0000006a: ISZERO
0000006b: DUP1
0000006c: PUSH2 0x0075
0000006f: JUMPI
00000070: POP
00000071: PUSH1 0x00
00000073: CALLVALUE
00000074: GT
00000075: JUMPDEST
00000076: DUP1
00000077: PUSH2 0x00a0
0000007a: JUMPI
0000007b: POP
0000007c: DUP1
0000007d: SLOAD
0000007e: PUSH1 0xa0
00000080: PUSH1 0x02
00000082: EXP
00000083: SWAP1
00000084: DIV
00000085: PUSH1 0xff
00000087: AND
00000088: DUP1
00000089: ISZERO
0000008a: PUSH2 0x00a0
0000008d: JUMPI
0000008e: POP
0000008f: DUP1
00000090: SLOAD
00000091: PUSH1 0x01
00000093: PUSH1 0xa0
00000095: PUSH1 0x02
00000097: EXP
00000098: SUB
00000099: DUP5
0000009a: DUP2
0000009b: AND
0000009c: SWAP2
0000009d: AND
0000009e: EQ
0000009f: ISZERO
000000a0: JUMPDEST
000000a1: ISZERO
000000a2: PUSH2 0x00f7
000000a5: JUMPI
000000a6: PUSH2 0x0002
000000a9: JUMP
000000aa: JUMPDEST
000000ab: PUSH2 0x00db
000000ae: PUSH1 0x00
000000b0: SLOAD
000000b1: PUSH1 0xff
000000b3: PUSH1 0xa0
000000b5: PUSH1 0x02
000000b7: EXP
000000b8: SWAP1
000000b9: SWAP2
000000ba: DIV
000000bb: AND
000000bc: DUP2
000000bd: JUMP
000000be: JUMPDEST
000000bf: PUSH2 0x00ed
000000c2: PUSH1 0x00
000000c4: SLOAD
000000c5: PUSH1 0x01
000000c7: PUSH1 0xa0
000000c9: PUSH1 0x02
000000cb: EXP
000000cc: SUB
000000cd: AND
000000ce: DUP2
000000cf: JUMP
000000d0: JUMPDEST
000000d1: PUSH2 0x00db
000000d4: PUSH1 0x01
000000d6: SLOAD
000000d7: DUP2
000000d8: JUMP
000000d9: JUMPDEST
000000da: STOP
000000db: JUMPDEST
000000dc: PUSH1 0x40
000000de: DUP1
000000df: MLOAD
000000e0: SWAP2
000000e1: DUP3
000000e2: MSTORE
000000e3: MLOAD
000000e4: SWAP1
000000e5: DUP2
000000e6: SWAP1
000000e7: SUB
000000e8: PUSH1 0x20
000000ea: ADD
000000eb: SWAP1
000000ec: RETURN
000000ed: JUMPDEST
000000ee: PUSH1 0x60
000000f0: SWAP1
000000f1: DUP2
000000f2: MSTORE
000000f3: PUSH1 0x20
000000f5: SWAP1
000000f6: RETURN
000000f7: JUMPDEST
000000f8: PUSH1 0x01
000000fa: PUSH1 0xa0
000000fc: PUSH1 0x02
000000fe: EXP
000000ff: SUB
00000100: DUP4
00000101: AND
00000102: DUP2
00000103: DUP4
00000104: PUSH1 0x60
00000106: DUP3
00000107: DUP2
00000108: DUP2
00000109: DUP2
0000010a: DUP6
0000010b: DUP9
0000010c: DUP4
0000010d: CALL
0000010e: SWAP4
0000010f: POP
00000110: POP
00000111: POP
00000112: POP
00000113: ISZERO
00000114: PUSH2 0x015a
00000117: JUMPI
00000118: PUSH1 0x40
0000011a: DUP1
0000011b: MLOAD
0000011c: DUP4
0000011d: DUP2
0000011e: MSTORE
0000011f: SWAP1
00000120: MLOAD
00000121: PUSH1 0x01
00000123: PUSH1 0xa0
00000125: PUSH1 0x02
00000127: EXP
00000128: SUB
00000129: DUP6
0000012a: AND
0000012b: SWAP2
0000012c: PUSH32 0x9735b0cb909f3d21d5c16bbcccd272d85fa11446f6d679f6ecb170d2dabfecfc
0000014d: SWAP2
0000014e: SWAP1
0000014f: DUP2
00000150: SWAP1
00000151: SUB
00000152: PUSH1 0x20
00000154: ADD
00000155: SWAP1
00000156: LOG2
00000157: POP
00000158: PUSH1 0x01
0000015a: JUMPDEST
0000015b: SWAP3
0000015c: SWAP2
0000015d: POP
0000015e: POP
0000015f: JUMP

View stderr

Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	other	detector	ETH value transfer possible	55	no	no	view trace_id: 0xf66cd26b293ffc7c92d60937e186f60caec52f5bb7eb4b950b1515c7ccb61b7c call_targets: 0xd5e6ef2f1d8d689e36a09577cc63bb21bbbefdbe target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xf66cd26b293ffc7c92d60937e186f60caec52f5bb7eb4b950b1515c7ccb61b7c", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0xd5e6ef2f1d8d689e36a09577cc63bb21bbbefdbe" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x0221038a", "selector": "0x0221038a", "calldata_variants": [ "0x0221038a", "0x0221038a0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x18bdc79a", "selector": "0x18bdc79a", "calldata_variants": [ "0x18bdc79a", "0x18bdc79a0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xd2cc718f", "selector": "0xd2cc718f", "calldata_variants": [ "0xd2cc718f", "0xd2cc718f0000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 269, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "eth_value_calls": 1, "guards_detected": [] }
high	other	detector	Untrusted CALL target/value reachable	60	no	no	view trace_id: 0xf66cd26b293ffc7c92d60937e186f60caec52f5bb7eb4b950b1515c7ccb61b7c call_targets: 0xd5e6ef2f1d8d689e36a09577cc63bb21bbbefdbe target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xf66cd26b293ffc7c92d60937e186f60caec52f5bb7eb4b950b1515c7ccb61b7c", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0xd5e6ef2f1d8d689e36a09577cc63bb21bbbefdbe" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x0221038a", "selector": "0x0221038a", "calldata_variants": [ "0x0221038a", "0x0221038a0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x18bdc79a", "selector": "0x18bdc79a", "calldata_variants": [ "0x18bdc79a", "0x18bdc79a0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xd2cc718f", "selector": "0xd2cc718f", "calldata_variants": [ "0xd2cc718f", "0xd2cc718f0000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 269, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "call_count": 1, "guards_detected": [], "untrusted_call_count": 1 }

Severity

Category

Tool

Title

Confidence

Validated

Confirmed

Details

high

other

detector

ETH value transfer possible

55

no

view

trace_id: 0xf66cd26b293ffc7c92d60937e186f60caec52f5bb7eb4b950b1515c7ccb61b7c

call_targets: 0xd5e6ef2f1d8d689e36a09577cc63bb21bbbefdbe

target_varies: no

classification: constant_target

validation_json

{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0xf66cd26b293ffc7c92d60937e186f60caec52f5bb7eb4b950b1515c7ccb61b7c",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xd5e6ef2f1d8d689e36a09577cc63bb21bbbefdbe"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x0221038a",
            "selector": "0x0221038a",
            "calldata_variants": [
                "0x0221038a",
                "0x0221038a0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x18bdc79a",
            "selector": "0x18bdc79a",
            "calldata_variants": [
                "0x18bdc79a",
                "0x18bdc79a0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xd2cc718f",
            "selector": "0xd2cc718f",
            "calldata_variants": [
                "0xd2cc718f",
                "0xd2cc718f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "examples": [
        {
            "pc": 269,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 1,
    "guards_detected": []
}