TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

019b3836-564d-70a1-82e3-b88feceaadd8

complete
Chain ID
1
Address
Block Number
Created
Fri, Dec 19, 2025 8:04 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

Confirmed
0
Validated
0
Source
Bytecode only
Review Backing
Not yet
Best current signal
Untrusted CALL target/value reachable
crit 0 high 0 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
8369 artifact.fetch complete 1 / 3 4 months ago
8370 tool.cast_disasm complete 1 / 3 4 months ago
51752 analysis.bundle complete 1 / 3 2 weeks ago
51753 capability.graph complete 1 / 3 2 weeks ago
51754 detector.run complete 1 / 3 2 weeks ago
51755 validation.fork complete 1 / 3 2 weeks ago

Artifact

Runtime bytecode: available
Creation TX:
Deployer:
Proxy: no
Implementation:
Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm
Delegatecall
0
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
2
EXT*/BALANCE
0
Total opcodes
565
Flags
No heuristic flags raised.
View cast disassembly output
00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: CALLDATASIZE
00000006: ISZERO
00000007: PUSH2 0x0061
0000000a: JUMPI
0000000b: PUSH1 0xe0
0000000d: PUSH1 0x02
0000000f: EXP
00000010: PUSH1 0x00
00000012: CALLDATALOAD
00000013: DIV
00000014: PUSH4 0x13af4035
00000019: DUP2
0000001a: EQ
0000001b: PUSH2 0x006c
0000001e: JUMPI
0000001f: DUP1
00000020: PUSH4 0x35c1d349
00000025: EQ
00000026: PUSH2 0x009f
00000029: JUMPI
0000002a: DUP1
0000002b: PUSH4 0x8da5cb5b
00000030: EQ
00000031: PUSH2 0x0112
00000034: JUMPI
00000035: DUP1
00000036: PUSH4 0x9003adfe
0000003b: EQ
0000003c: PUSH2 0x0124
0000003f: JUMPI
00000040: DUP1
00000041: PUSH4 0xa60f3588
00000046: EQ
00000047: PUSH2 0x012d
0000004a: JUMPI
0000004b: DUP1
0000004c: PUSH4 0xc8796572
00000051: EQ
00000052: PUSH2 0x0136
00000055: JUMPI
00000056: DUP1
00000057: PUSH4 0xe97dcb62
0000005c: EQ
0000005d: PUSH2 0x015e
00000060: JUMPI
00000061: JUMPDEST
00000062: PUSH2 0x01cc
00000065: PUSH2 0x015c
00000068: PUSH2 0x0162
0000006b: JUMP
0000006c: JUMPDEST
0000006d: PUSH2 0x01cc
00000070: PUSH1 0x04
00000072: CALLDATALOAD
00000073: PUSH1 0x04
00000075: SLOAD
00000076: CALLER
00000077: PUSH1 0x01
00000079: PUSH1 0xa0
0000007b: PUSH1 0x02
0000007d: EXP
0000007e: SUB
0000007f: SWAP1
00000080: DUP2
00000081: AND
00000082: SWAP2
00000083: AND
00000084: EQ
00000085: ISZERO
00000086: PUSH2 0x009c
00000089: JUMPI
0000008a: PUSH1 0x04
0000008c: DUP1
0000008d: SLOAD
0000008e: PUSH1 0x01
00000090: PUSH1 0xa0
00000092: PUSH1 0x02
00000094: EXP
00000095: SUB
00000096: NOT
00000097: AND
00000098: DUP3
00000099: OR
0000009a: SWAP1
0000009b: SSTORE
0000009c: JUMPDEST
0000009d: POP
0000009e: JUMP
0000009f: JUMPDEST
000000a0: PUSH2 0x01ce
000000a3: PUSH1 0x04
000000a5: CALLDATALOAD
000000a6: PUSH1 0x00
000000a8: DUP1
000000a9: SLOAD
000000aa: DUP3
000000ab: SWAP1
000000ac: DUP2
000000ad: LT
000000ae: ISZERO
000000af: PUSH2 0x0002
000000b2: JUMPI
000000b3: POP
000000b4: DUP1
000000b5: MSTORE
000000b6: PUSH1 0x02
000000b8: MUL
000000b9: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563
000000da: DUP2
000000db: ADD
000000dc: SLOAD
000000dd: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e564
000000fe: SWAP2
000000ff: SWAP1
00000100: SWAP2
00000101: ADD
00000102: SLOAD
00000103: PUSH1 0x01
00000105: PUSH1 0xa0
00000107: PUSH1 0x02
00000109: EXP
0000010a: SUB
0000010b: SWAP2
0000010c: SWAP1
0000010d: SWAP2
0000010e: AND
0000010f: SWAP1
00000110: DUP3
00000111: JUMP
00000112: JUMPDEST
00000113: PUSH2 0x01f4
00000116: PUSH1 0x04
00000118: SLOAD
00000119: PUSH1 0x01
0000011b: PUSH1 0xa0
0000011d: PUSH1 0x02
0000011f: EXP
00000120: SUB
00000121: AND
00000122: DUP2
00000123: JUMP
00000124: JUMPDEST
00000125: PUSH2 0x0211
00000128: PUSH1 0x02
0000012a: SLOAD
0000012b: DUP2
0000012c: JUMP
0000012d: JUMPDEST
0000012e: PUSH2 0x0211
00000131: PUSH1 0x01
00000133: SLOAD
00000134: DUP2
00000135: JUMP
00000136: JUMPDEST
00000137: PUSH2 0x01cc
0000013a: PUSH1 0x04
0000013c: SLOAD
0000013d: CALLER
0000013e: PUSH1 0x01
00000140: PUSH1 0xa0
00000142: PUSH1 0x02
00000144: EXP
00000145: SUB
00000146: SWAP1
00000147: DUP2
00000148: AND
00000149: SWAP2
0000014a: AND
0000014b: EQ
0000014c: ISZERO
0000014d: PUSH2 0x015c
00000150: JUMPI
00000151: PUSH1 0x02
00000153: SLOAD
00000154: PUSH1 0x00
00000156: EQ
00000157: ISZERO
00000158: PUSH2 0x0378
0000015b: JUMPI
0000015c: JUMPDEST
0000015d: JUMP
0000015e: JUMPDEST
0000015f: PUSH2 0x01cc
00000162: JUMPDEST
00000163: PUSH1 0x02
00000165: DUP1
00000166: SLOAD
00000167: PUSH1 0x28
00000169: CALLVALUE
0000016a: DIV
0000016b: SWAP1
0000016c: DUP2
0000016d: ADD
0000016e: SWAP1
0000016f: SWAP2
00000170: SSTORE
00000171: PUSH1 0x00
00000173: DUP1
00000174: SLOAD
00000175: PUSH1 0x01
00000177: DUP2
00000178: ADD
00000179: DUP1
0000017a: DUP4
0000017b: SSTORE
0000017c: SWAP1
0000017d: SWAP2
0000017e: SWAP1
0000017f: DUP3
00000180: SWAP1
00000181: DUP3
00000182: SWAP1
00000183: DUP3
00000184: DUP1
00000185: ISZERO
00000186: DUP3
00000187: SWAP1
00000188: GT
00000189: PUSH2 0x0223
0000018c: JUMPI
0000018d: PUSH1 0x02
0000018f: MUL
00000190: DUP2
00000191: PUSH1 0x02
00000193: MUL
00000194: DUP4
00000195: PUSH1 0x00
00000197: MSTORE
00000198: PUSH1 0x20
0000019a: PUSH1 0x00
0000019c: KECCAK256
0000019d: SWAP2
0000019e: DUP3
0000019f: ADD
000001a0: SWAP2
000001a1: ADD
000001a2: PUSH2 0x0223
000001a5: SWAP2
000001a6: SWAP1
000001a7: JUMPDEST
000001a8: DUP1
000001a9: DUP3
000001aa: GT
000001ab: ISZERO
000001ac: PUSH2 0x035d
000001af: JUMPI
000001b0: DUP1
000001b1: SLOAD
000001b2: PUSH1 0x01
000001b4: PUSH1 0xa0
000001b6: PUSH1 0x02
000001b8: EXP
000001b9: SUB
000001ba: NOT
000001bb: AND
000001bc: DUP2
000001bd: SSTORE
000001be: PUSH1 0x00
000001c0: PUSH1 0x01
000001c2: DUP3
000001c3: ADD
000001c4: SSTORE
000001c5: PUSH1 0x02
000001c7: ADD
000001c8: PUSH2 0x01a7
000001cb: JUMP
000001cc: JUMPDEST
000001cd: STOP
000001ce: JUMPDEST
000001cf: PUSH1 0x40
000001d1: MLOAD
000001d2: DUP1
000001d3: DUP4
000001d4: PUSH1 0x01
000001d6: PUSH1 0xa0
000001d8: PUSH1 0x02
000001da: EXP
000001db: SUB
000001dc: AND
000001dd: DUP2
000001de: MSTORE
000001df: PUSH1 0x20
000001e1: ADD
000001e2: DUP3
000001e3: DUP2
000001e4: MSTORE
000001e5: PUSH1 0x20
000001e7: ADD
000001e8: SWAP3
000001e9: POP
000001ea: POP
000001eb: POP
000001ec: PUSH1 0x40
000001ee: MLOAD
000001ef: DUP1
000001f0: SWAP2
000001f1: SUB
000001f2: SWAP1
000001f3: RETURN
000001f4: JUMPDEST
000001f5: PUSH1 0x40
000001f7: DUP1
000001f8: MLOAD
000001f9: PUSH1 0x01
000001fb: PUSH1 0xa0
000001fd: PUSH1 0x02
000001ff: EXP
00000200: SUB
00000201: SWAP3
00000202: SWAP1
00000203: SWAP3
00000204: AND
00000205: DUP3
00000206: MSTORE
00000207: MLOAD
00000208: SWAP1
00000209: DUP2
0000020a: SWAP1
0000020b: SUB
0000020c: PUSH1 0x20
0000020e: ADD
0000020f: SWAP1
00000210: RETURN
00000211: JUMPDEST
00000212: PUSH1 0x40
00000214: DUP1
00000215: MLOAD
00000216: SWAP2
00000217: DUP3
00000218: MSTORE
00000219: MLOAD
0000021a: SWAP1
0000021b: DUP2
0000021c: SWAP1
0000021d: SUB
0000021e: PUSH1 0x20
00000220: ADD
00000221: SWAP1
00000222: RETURN
00000223: JUMPDEST
00000224: POP
00000225: POP
00000226: POP
00000227: POP
00000228: CALLER
00000229: PUSH1 0x00
0000022b: PUSH1 0x00
0000022d: POP
0000022e: DUP4
0000022f: DUP2
00000230: SLOAD
00000231: DUP2
00000232: LT
00000233: ISZERO
00000234: PUSH2 0x0002
00000237: JUMPI
00000238: DUP2
00000239: DUP1
0000023a: MSTORE
0000023b: PUSH1 0x02
0000023d: MUL
0000023e: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563
0000025f: ADD
00000260: DUP1
00000261: SLOAD
00000262: PUSH1 0x01
00000264: PUSH1 0xa0
00000266: PUSH1 0x02
00000268: EXP
00000269: SUB
0000026a: NOT
0000026b: AND
0000026c: SWAP1
0000026d: SWAP3
0000026e: OR
0000026f: SWAP1
00000270: SWAP2
00000271: SSTORE
00000272: DUP1
00000273: SLOAD
00000274: CALLVALUE
00000275: DUP6
00000276: SWAP1
00000277: SUB
00000278: SWAP2
00000279: SWAP1
0000027a: DUP5
0000027b: SWAP1
0000027c: DUP2
0000027d: LT
0000027e: ISZERO
0000027f: PUSH2 0x0002
00000282: JUMPI
00000283: PUSH1 0x02
00000285: MUL
00000286: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e564
000002a7: ADD
000002a8: SWAP2
000002a9: SWAP1
000002aa: SWAP2
000002ab: SSTORE
000002ac: PUSH1 0x03
000002ae: DUP1
000002af: SLOAD
000002b0: CALLVALUE
000002b1: DUP7
000002b2: SWAP1
000002b3: SUB
000002b4: ADD
000002b5: SWAP1
000002b6: SSTORE
000002b7: PUSH1 0x01
000002b9: SLOAD
000002ba: DUP2
000002bb: SLOAD
000002bc: DUP2
000002bd: LT
000002be: ISZERO
000002bf: PUSH2 0x0002
000002c2: JUMPI
000002c3: PUSH1 0x03
000002c5: SLOAD
000002c6: PUSH1 0x02
000002c8: SWAP2
000002c9: DUP3
000002ca: MUL
000002cb: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e564
000002ec: ADD
000002ed: SLOAD
000002ee: SWAP1
000002ef: SWAP2
000002f0: MUL
000002f1: SWAP3
000002f2: POP
000002f3: DUP3
000002f4: SWAP1
000002f5: LT
000002f6: SWAP1
000002f7: POP
000002f8: PUSH2 0x0373
000002fb: JUMPI
000002fc: PUSH1 0x01
000002fe: SLOAD
000002ff: PUSH1 0x00
00000301: DUP1
00000302: SLOAD
00000303: SWAP1
00000304: SWAP2
00000305: SWAP1
00000306: DUP2
00000307: LT
00000308: ISZERO
00000309: PUSH2 0x0002
0000030c: JUMPI
0000030d: PUSH1 0x02
0000030f: MUL
00000310: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563
00000331: ADD
00000332: SLOAD
00000333: PUSH1 0x40
00000335: MLOAD
00000336: PUSH1 0x01
00000338: PUSH1 0xa0
0000033a: PUSH1 0x02
0000033c: EXP
0000033d: SUB
0000033e: SWAP2
0000033f: SWAP1
00000340: SWAP2
00000341: AND
00000342: SWAP2
00000343: SWAP1
00000344: DUP4
00000345: SWAP1
00000346: DUP3
00000347: DUP2
00000348: DUP2
00000349: DUP2
0000034a: DUP6
0000034b: DUP9
0000034c: DUP4
0000034d: CALL
0000034e: SWAP4
0000034f: POP
00000350: POP
00000351: POP
00000352: POP
00000353: ISZERO
00000354: ISZERO
00000355: PUSH2 0x0361
00000358: JUMPI
00000359: PUSH2 0x0002
0000035c: JUMP
0000035d: JUMPDEST
0000035e: POP
0000035f: SWAP1
00000360: JUMP
00000361: JUMPDEST
00000362: PUSH1 0x03
00000364: DUP1
00000365: SLOAD
00000366: DUP3
00000367: SWAP1
00000368: SUB
00000369: SWAP1
0000036a: SSTORE
0000036b: PUSH1 0x01
0000036d: DUP1
0000036e: SLOAD
0000036f: DUP2
00000370: ADD
00000371: SWAP1
00000372: SSTORE
00000373: JUMPDEST
00000374: POP
00000375: POP
00000376: POP
00000377: JUMP
00000378: JUMPDEST
00000379: PUSH1 0x04
0000037b: SLOAD
0000037c: PUSH1 0x02
0000037e: SLOAD
0000037f: PUSH1 0x40
00000381: MLOAD
00000382: PUSH1 0x01
00000384: PUSH1 0xa0
00000386: PUSH1 0x02
00000388: EXP
00000389: SUB
0000038a: SWAP3
0000038b: SWAP1
0000038c: SWAP3
0000038d: AND
0000038e: SWAP2
0000038f: PUSH1 0x00
00000391: SWAP2
00000392: SWAP1
00000393: DUP3
00000394: DUP2
00000395: DUP2
00000396: DUP2
00000397: DUP6
00000398: DUP9
00000399: DUP4
0000039a: CALL
0000039b: SWAP4
0000039c: POP
0000039d: POP
0000039e: POP
0000039f: POP
000003a0: ISZERO
000003a1: ISZERO
000003a2: PUSH2 0x03aa
000003a5: JUMPI
000003a6: PUSH2 0x0002
000003a9: JUMP
000003aa: JUMPDEST
000003ab: PUSH1 0x00
000003ad: PUSH1 0x02
000003af: SSTORE
000003b0: JUMP
View stderr
Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
high other detector Untrusted CALL target/value reachable 60 no no
view
trace_id: 0xf65c6f92d4bbdcdb87fc5ca08e47d0e4686737f6bbde608f8d9c6746b2bdfde3
call_targets: 0x7d3ae940eb73dc9131758ad2e326c7d863b0916a
target_varies: no
classification: constant_target
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0xf65c6f92d4bbdcdb87fc5ca08e47d0e4686737f6bbde608f8d9c6746b2bdfde3",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x7d3ae940eb73dc9131758ad2e326c7d863b0916a"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x35c1d349",
            "selector": "0x35c1d349",
            "calldata_variants": [
                "0x35c1d349",
                "0x35c1d3490000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9003adfe",
            "selector": "0x9003adfe",
            "calldata_variants": [
                "0x9003adfe",
                "0x9003adfe0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa60f3588",
            "selector": "0xa60f3588",
            "calldata_variants": [
                "0xa60f3588",
                "0xa60f35880000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xc8796572",
            "selector": "0xc8796572",
            "calldata_variants": [
                "0xc8796572",
                "0xc87965720000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xe97dcb62",
            "selector": "0xe97dcb62",
            "calldata_variants": [
                "0xe97dcb62",
                "0xe97dcb620000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 845,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 922,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 2,
    "guards_detected": [],
    "untrusted_call_count": 2
}
high other detector ETH value transfer possible 55 no no
view
trace_id: 0xf65c6f92d4bbdcdb87fc5ca08e47d0e4686737f6bbde608f8d9c6746b2bdfde3
call_targets: 0x7d3ae940eb73dc9131758ad2e326c7d863b0916a
target_varies: no
classification: constant_target
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0xf65c6f92d4bbdcdb87fc5ca08e47d0e4686737f6bbde608f8d9c6746b2bdfde3",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x7d3ae940eb73dc9131758ad2e326c7d863b0916a"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x35c1d349",
            "selector": "0x35c1d349",
            "calldata_variants": [
                "0x35c1d349",
                "0x35c1d3490000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9003adfe",
            "selector": "0x9003adfe",
            "calldata_variants": [
                "0x9003adfe",
                "0x9003adfe0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa60f3588",
            "selector": "0xa60f3588",
            "calldata_variants": [
                "0xa60f3588",
                "0xa60f35880000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xc8796572",
            "selector": "0xc8796572",
            "calldata_variants": [
                "0xc8796572",
                "0xc87965720000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xe97dcb62",
            "selector": "0xe97dcb62",
            "calldata_variants": [
                "0xe97dcb62",
                "0xe97dcb620000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 845,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 922,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 2,
    "guards_detected": []
}