Analysis Run

019b3836-58b9-733d-867b-f61a43d71175

complete

Chain ID

1

Address

0xd713f683ba2cd3541f81efed8a9fdefbe8d8bdb7

Block Number

—

Created

Fri, Dec 19, 2025 8:04 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

1

Validated

1

Source

Bytecode only

Review Backing

Not yet

Best current signal

SELFDESTRUCT reachable

crit 0 high 1 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
8681	artifact.fetch	complete	1 / 3	3 months ago
8682	tool.cast_disasm	complete	1 / 3	3 months ago
52152	analysis.bundle	complete	1 / 3	1 week ago
52153	capability.graph	complete	1 / 3	1 week ago
52154	detector.run	complete	1 / 3	1 week ago
52155	validation.fork	complete	1 / 3	1 week ago
113393	report.consolidate	complete	1 / 6	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

Job Status

complete

Attempts

1 / 6

Findings

0

No findings?

—

View stderr

OpenAI Codex v0.118.0 (research preview)
--------
workdir: /tmp/codex-dn40445k
model: gpt-5.4
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: none
session id: 019d5c92-7948-7c40-a11b-be6b5381a0de
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.

Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".

Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
warning: Codex could not find system bubblewrap on PATH. Please install bubblewrap with your package manager. Codex will use the vendored bubblewrap in the meantime.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.

Metadata

{
    "codex": {
        "ran_at": "2026-04-05T07:36:37.967835+00:00",
        "returncode": 1
    },
    "project": {
        "mode": "bytecode",
        "bytecode_length": 386,
        "bytecode_truncated": false,
        "capability_graph_present": true,
        "analysis_artifact_present": true
    },
    "summary": null,
    "no_findings": null,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm

Delegatecall

0

Selfdestruct

1

CREATE2

0

CALL-family (heavy)

0

EXT*/BALANCE

1

Total opcodes

113

Flags

selfdestruct_present

View cast disassembly output

00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: CALLDATASIZE
00000006: ISZERO
00000007: PUSH1 0x31
00000009: JUMPI
0000000a: PUSH1 0xe0
0000000c: PUSH1 0x02
0000000e: EXP
0000000f: PUSH1 0x00
00000011: CALLDATALOAD
00000012: DIV
00000013: PUSH4 0x090f4465
00000018: DUP2
00000019: EQ
0000001a: PUSH1 0x7f
0000001c: JUMPI
0000001d: DUP1
0000001e: PUSH4 0x66d003ac
00000023: EQ
00000024: PUSH1 0x87
00000026: JUMPI
00000027: DUP1
00000028: PUSH4 0xbfe8462b
0000002d: EQ
0000002e: PUSH1 0x98
00000030: JUMPI
00000031: JUMPDEST
00000032: PUSH1 0xb0
00000034: PUSH1 0x00
00000036: CALLVALUE
00000037: GT
00000038: ISZERO
00000039: PUSH1 0x7d
0000003b: JUMPI
0000003c: PUSH1 0x01
0000003e: PUSH1 0xa0
00000040: PUSH1 0x02
00000042: EXP
00000043: SUB
00000044: CALLER
00000045: DUP2
00000046: AND
00000047: PUSH1 0x60
00000049: SWAP1
0000004a: DUP2
0000004b: MSTORE
0000004c: CALLVALUE
0000004d: PUSH1 0x80
0000004f: MSTORE
00000050: ADDRESS
00000051: SWAP2
00000052: SWAP1
00000053: SWAP2
00000054: AND
00000055: BALANCE
00000056: PUSH1 0xa0
00000058: MSTORE
00000059: PUSH32 0x7dc4eff147124dee8430ea11c20ff769030bfece2d2bac1b49877284ec157b89
0000007a: SWAP1
0000007b: DUP1
0000007c: LOG1
0000007d: JUMPDEST
0000007e: JUMP
0000007f: JUMPDEST
00000080: PUSH1 0xb2
00000082: PUSH1 0x00
00000084: SLOAD
00000085: DUP2
00000086: JUMP
00000087: JUMPDEST
00000088: PUSH1 0xb2
0000008a: PUSH1 0x01
0000008c: SLOAD
0000008d: PUSH1 0x01
0000008f: PUSH1 0xa0
00000091: PUSH1 0x02
00000093: EXP
00000094: SUB
00000095: AND
00000096: DUP2
00000097: JUMP
00000098: JUMPDEST
00000099: PUSH1 0xb0
0000009b: PUSH1 0x00
0000009d: SLOAD
0000009e: TIMESTAMP
0000009f: LT
000000a0: PUSH1 0xbc
000000a2: JUMPI
000000a3: PUSH1 0x01
000000a5: SLOAD
000000a6: PUSH1 0x01
000000a8: PUSH1 0xa0
000000aa: PUSH1 0x02
000000ac: EXP
000000ad: SUB
000000ae: AND
000000af: SELFDESTRUCT
000000b0: JUMPDEST
000000b1: STOP
000000b2: JUMPDEST
000000b3: PUSH1 0x60
000000b5: SWAP1
000000b6: DUP2
000000b7: MSTORE
000000b8: PUSH1 0x20
000000ba: SWAP1
000000bb: RETURN
000000bc: JUMPDEST
000000bd: PUSH1 0x02
000000bf: JUMP

View stderr

Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	other	detector	SELFDESTRUCT reachable	65	yes	yes	view trace_id: 0x83fda4976b2cd2ddc71a893f1e46dc86f867dc5b8ca35ed5ddc98a8df008f6ea validation_json { "sink": "SELFDESTRUCT", "errors": 0, "status": "confirmed", "attempts": 5, "trace_id": "0x83fda4976b2cd2ddc71a893f1e46dc86f867dc5b8ca35ed5ddc98a8df008f6ea", "confirmed": true, "trace_mode": "structLogs", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "sink_reached" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x090f4465", "selector": "0x090f4465", "calldata_variants": [ "0x090f4465", "0x090f44650000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x66d003ac", "selector": "0x66d003ac", "calldata_variants": [ "0x66d003ac", "0x66d003ac0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xbfe8462b", "selector": "0xbfe8462b", "calldata_variants": [ "0xbfe8462b", "0xbfe8462b0000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "guards_detected": [], "selfdestruct_count": 1 }

Severity