TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

019b3836-5a6c-70f8-a29c-4db2dab2a610

complete
Chain ID
1
Address
0x9e1e038961b0c70066c2adc5b69367bbe35d38db
Block Number
—
Created
Fri, Dec 19, 2025 8:04 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract
Confirmed
0
Validated
0
Source
Bytecode only
Review Backing
Not yet
Best current signal
Untrusted CALL target/value reachable
crit 0 high 0 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
8913 artifact.fetch complete 1 / 3 4 months ago
8914 tool.cast_disasm complete 1 / 3 4 months ago
51948 analysis.bundle complete 1 / 3 2 weeks ago
51949 capability.graph complete 1 / 3 2 weeks ago
51950 detector.run complete 1 / 3 2 weeks ago
51951 validation.fork complete 1 / 3 2 weeks ago

Artifact

Runtime bytecode: available
Creation TX: —
Deployer: —
Proxy: no
Implementation:
—
Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm
Delegatecall
0
Selfdestruct
2
CREATE2
0
CALL-family (heavy)
1
EXT*/BALANCE
0
Total opcodes
496
Flags
selfdestruct_present create_opcodes_present
View cast disassembly output 
00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x00
00000007: CALLDATALOAD
00000008: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
00000026: SWAP1
00000027: DIV
00000028: DUP1
00000029: PUSH4 0x761610fc
0000002e: EQ
0000002f: PUSH2 0x0039
00000032: JUMPI
00000033: PUSH2 0x0037
00000036: JUMP
00000037: JUMPDEST
00000038: STOP
00000039: JUMPDEST
0000003a: PUSH2 0x004f
0000003d: PUSH1 0x04
0000003f: DUP1
00000040: DUP1
00000041: CALLDATALOAD
00000042: SWAP1
00000043: PUSH1 0x20
00000045: ADD
00000046: SWAP1
00000047: SWAP2
00000048: SWAP1
00000049: POP
0000004a: POP
0000004b: PUSH2 0x0089
0000004e: JUMP
0000004f: JUMPDEST
00000050: PUSH1 0x40
00000052: MLOAD
00000053: DUP1
00000054: DUP5
00000055: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000006a: AND
0000006b: DUP2
0000006c: MSTORE
0000006d: PUSH1 0x20
0000006f: ADD
00000070: DUP4
00000071: DUP2
00000072: MSTORE
00000073: PUSH1 0x20
00000075: ADD
00000076: DUP3
00000077: DUP2
00000078: MSTORE
00000079: PUSH1 0x20
0000007b: ADD
0000007c: SWAP4
0000007d: POP
0000007e: POP
0000007f: POP
00000080: POP
00000081: PUSH1 0x40
00000083: MLOAD
00000084: DUP1
00000085: SWAP2
00000086: SUB
00000087: SWAP1
00000088: RETURN
00000089: JUMPDEST
0000008a: PUSH1 0x00
0000008c: PUSH1 0x00
0000008e: PUSH1 0x00
00000090: PUSH1 0x00
00000092: PUSH1 0x00
00000094: DUP6
00000095: PUSH1 0x03
00000097: PUSH1 0x00
00000099: POP
0000009a: SLOAD
0000009b: GT
0000009c: ISZERO
0000009d: DUP1
0000009e: ISZERO
0000009f: PUSH2 0x00ad
000000a2: JUMPI
000000a3: POP
000000a4: DUP6
000000a5: PUSH1 0x04
000000a7: PUSH1 0x00
000000a9: POP
000000aa: SLOAD
000000ab: LT
000000ac: ISZERO
000000ad: JUMPDEST
000000ae: ISZERO
000000af: PUSH2 0x0211
000000b2: JUMPI
000000b3: DUP6
000000b4: TIMESTAMP
000000b5: ADD
000000b6: SWAP2
000000b7: POP
000000b8: CALLER
000000b9: PUSH1 0x02
000000bb: PUSH1 0x00
000000bd: SWAP1
000000be: SLOAD
000000bf: SWAP1
000000c0: PUSH2 0x0100
000000c3: EXP
000000c4: SWAP1
000000c5: DIV
000000c6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000db: AND
000000dc: PUSH1 0x01
000000de: PUSH1 0x00
000000e0: SWAP1
000000e1: SLOAD
000000e2: SWAP1
000000e3: PUSH2 0x0100
000000e6: EXP
000000e7: SWAP1
000000e8: DIV
000000e9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000fe: AND
000000ff: DUP5
00000100: PUSH1 0x40
00000102: MLOAD
00000103: PUSH2 0x025b
00000106: DUP1
00000107: PUSH2 0x0220
0000010a: DUP4
0000010b: CODECOPY
0000010c: ADD
0000010d: DUP1
0000010e: DUP6
0000010f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000124: AND
00000125: DUP2
00000126: MSTORE
00000127: PUSH1 0x20
00000129: ADD
0000012a: DUP5
0000012b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000140: AND
00000141: DUP2
00000142: MSTORE
00000143: PUSH1 0x20
00000145: ADD
00000146: DUP4
00000147: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000015c: AND
0000015d: DUP2
0000015e: MSTORE
0000015f: PUSH1 0x20
00000161: ADD
00000162: DUP3
00000163: DUP2
00000164: MSTORE
00000165: PUSH1 0x20
00000167: ADD
00000168: SWAP5
00000169: POP
0000016a: POP
0000016b: POP
0000016c: POP
0000016d: POP
0000016e: PUSH1 0x40
00000170: MLOAD
00000171: DUP1
00000172: SWAP2
00000173: SUB
00000174: SWAP1
00000175: PUSH1 0x00
00000177: CREATE
00000178: SWAP1
00000179: POP
0000017a: DUP1
0000017b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000190: AND
00000191: PUSH1 0x00
00000193: CALLVALUE
00000194: PUSH1 0x02
00000196: MUL
00000197: PUSH1 0x40
00000199: MLOAD
0000019a: DUP1
0000019b: SWAP1
0000019c: POP
0000019d: PUSH1 0x00
0000019f: PUSH1 0x40
000001a1: MLOAD
000001a2: DUP1
000001a3: DUP4
000001a4: SUB
000001a5: DUP2
000001a6: DUP6
000001a7: DUP9
000001a8: DUP9
000001a9: CALL
000001aa: SWAP4
000001ab: POP
000001ac: POP
000001ad: POP
000001ae: POP
000001af: POP
000001b0: PUSH32 0xb1261a34e2cd3426db3474d1205ad1d88b31c83a25260009ae85e10f0f01b880
000001d1: DUP2
000001d2: PUSH1 0x40
000001d4: MLOAD
000001d5: DUP1
000001d6: DUP3
000001d7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000001ec: AND
000001ed: DUP2
000001ee: MSTORE
000001ef: PUSH1 0x20
000001f1: ADD
000001f2: SWAP2
000001f3: POP
000001f4: POP
000001f5: PUSH1 0x40
000001f7: MLOAD
000001f8: DUP1
000001f9: SWAP2
000001fa: SUB
000001fb: SWAP1
000001fc: LOG1
000001fd: DUP1
000001fe: TIMESTAMP
000001ff: DUP4
00000200: DUP3
00000201: SWAP3
00000202: POP
00000203: SWAP5
00000204: POP
00000205: SWAP5
00000206: POP
00000207: SWAP5
00000208: POP
00000209: PUSH2 0x0217
0000020c: JUMP
0000020d: PUSH2 0x0216
00000210: JUMP
00000211: JUMPDEST
00000212: PUSH2 0x0002
00000215: JUMP
00000216: JUMPDEST
00000217: JUMPDEST
00000218: POP
00000219: POP
0000021a: SWAP2
0000021b: SWAP4
0000021c: SWAP1
0000021d: SWAP3
0000021e: POP
0000021f: JUMP
00000220: PUSH1 0x60
00000222: PUSH1 0x40
00000224: MSTORE
00000225: PUSH1 0x40
00000227: MLOAD
00000228: PUSH1 0x80
0000022a: DUP1
0000022b: PUSH2 0x025b
0000022e: DUP4
0000022f: CODECOPY
00000230: DUP2
00000231: ADD
00000232: PUSH1 0x40
00000234: MSTORE
00000235: DUP1
00000236: DUP1
00000237: MLOAD
00000238: SWAP1
00000239: PUSH1 0x20
0000023b: ADD
0000023c: SWAP1
0000023d: SWAP2
0000023e: SWAP1
0000023f: DUP1
00000240: MLOAD
00000241: SWAP1
00000242: PUSH1 0x20
00000244: ADD
00000245: SWAP1
00000246: SWAP2
00000247: SWAP1
00000248: DUP1
00000249: MLOAD
0000024a: SWAP1
0000024b: PUSH1 0x20
0000024d: ADD
0000024e: SWAP1
0000024f: SWAP2
00000250: SWAP1
00000251: DUP1
00000252: MLOAD
00000253: SWAP1
00000254: PUSH1 0x20
00000256: ADD
00000257: SWAP1
00000258: SWAP2
00000259: SWAP1
0000025a: POP
0000025b: POP
0000025c: JUMPDEST
0000025d: DUP4
0000025e: PUSH1 0x00
00000260: PUSH1 0x00
00000262: PUSH2 0x0100
00000265: EXP
00000266: DUP2
00000267: SLOAD
00000268: DUP2
00000269: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000027e: MUL
0000027f: NOT
00000280: AND
00000281: SWAP1
00000282: DUP4
00000283: MUL
00000284: OR
00000285: SWAP1
00000286: SSTORE
00000287: POP
00000288: DUP3
00000289: PUSH1 0x01
0000028b: PUSH1 0x00
0000028d: PUSH2 0x0100
00000290: EXP
00000291: DUP2
00000292: SLOAD
00000293: DUP2
00000294: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002a9: MUL
000002aa: NOT
000002ab: AND
000002ac: SWAP1
000002ad: DUP4
000002ae: MUL
000002af: OR
000002b0: SWAP1
000002b1: SSTORE
000002b2: POP
000002b3: DUP2
000002b4: PUSH1 0x02
000002b6: PUSH1 0x00
000002b8: PUSH2 0x0100
000002bb: EXP
000002bc: DUP2
000002bd: SLOAD
000002be: DUP2
000002bf: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002d4: MUL
000002d5: NOT
000002d6: AND
000002d7: SWAP1
000002d8: DUP4
000002d9: MUL
000002da: OR
000002db: SWAP1
000002dc: SSTORE
000002dd: POP
000002de: DUP1
000002df: PUSH1 0x03
000002e1: PUSH1 0x00
000002e3: POP
000002e4: DUP2
000002e5: SWAP1
000002e6: SSTORE
000002e7: POP
000002e8: JUMPDEST
000002e9: POP
000002ea: POP
000002eb: POP
000002ec: POP
000002ed: PUSH2 0x0181
000002f0: DUP1
000002f1: PUSH2 0x00da
000002f4: PUSH1 0x00
000002f6: CODECOPY
000002f7: PUSH1 0x00
000002f9: RETURN
000002fa: PUSH1 0x60
000002fc: PUSH1 0x40
000002fe: MSTORE
000002ff: PUSH1 0x00
00000301: CALLDATALOAD
00000302: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
00000320: SWAP1
00000321: DIV
00000322: DUP1
00000323: PUSH4 0xc2052403
00000328: EQ
00000329: PUSH2 0x0039
0000032c: JUMPI
0000032d: PUSH2 0x0037
00000330: JUMP
00000331: JUMPDEST
00000332: STOP
00000333: JUMPDEST
00000334: PUSH2 0x0046
00000337: PUSH1 0x04
00000339: DUP1
0000033a: POP
0000033b: POP
0000033c: PUSH2 0x0048
0000033f: JUMP
00000340: JUMPDEST
00000341: STOP
00000342: JUMPDEST
00000343: PUSH1 0x02
00000345: PUSH1 0x00
00000347: SWAP1
00000348: SLOAD
00000349: SWAP1
0000034a: PUSH2 0x0100
0000034d: EXP
0000034e: SWAP1
0000034f: DIV
00000350: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000365: AND
00000366: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000037b: AND
0000037c: CALLER
0000037d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000392: AND
00000393: EQ
00000394: DUP1
00000395: PUSH2 0x00f1
00000398: JUMPI
00000399: POP
0000039a: PUSH1 0x00
0000039c: PUSH1 0x00
0000039e: SWAP1
0000039f: SLOAD
000003a0: SWAP1
000003a1: PUSH2 0x0100
000003a4: EXP
000003a5: SWAP1
000003a6: DIV
000003a7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003bc: AND
000003bd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003d2: AND
000003d3: CALLER
000003d4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003e9: AND
000003ea: EQ
000003eb: JUMPDEST
000003ec: ISZERO
000003ed: PUSH2 0x017e
000003f0: JUMPI
000003f1: PUSH1 0x03
000003f3: PUSH1 0x00
000003f5: POP
000003f6: SLOAD
000003f7: TIMESTAMP
000003f8: GT
000003f9: ISZERO
000003fa: PUSH2 0x0142
000003fd: JUMPI
000003fe: PUSH1 0x02
00000400: PUSH1 0x00
00000402: SWAP1
00000403: SLOAD
00000404: SWAP1
00000405: PUSH2 0x0100
00000408: EXP
00000409: SWAP1
0000040a: DIV
0000040b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000420: AND
00000421: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000436: AND
00000437: SELFDESTRUCT
00000438: PUSH2 0x017d
0000043b: JUMP
0000043c: JUMPDEST
0000043d: PUSH1 0x01
0000043f: PUSH1 0x00
00000441: SWAP1
00000442: SLOAD
00000443: SWAP1
00000444: PUSH2 0x0100
00000447: EXP
00000448: SWAP1
00000449: DIV
0000044a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000045f: AND
00000460: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000475: AND
00000476: SELFDESTRUCT
00000477: JUMPDEST
00000478: JUMPDEST
00000479: JUMPDEST
0000047a: JUMP
View stderr 
Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
medium other detector Untrusted CALL target/value reachable 45 no no
view
trace_id: 0x87623461f1ffa18ab03b8c7c1ab7ab609cc016636e067cf2323fbe545887d7be
call_targets: 0x9e1e038961b0c70066c2adc5b69367bbe35d38db
target_varies: no
classification: constant_target
validation_json 
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x87623461f1ffa18ab03b8c7c1ab7ab609cc016636e067cf2323fbe545887d7be",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x9e1e038961b0c70066c2adc5b69367bbe35d38db"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x761610fc",
            "selector": "0x761610fc",
            "calldata_variants": [
                "0x761610fc",
                "0x761610fc0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xc2052403",
            "selector": "0xc2052403",
            "calldata_variants": [
                "0xc2052403",
                "0xc20524030000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 425,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 1,
    "guards_detected": [
        {
            "pc": 892,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 979,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        }
    ],
    "untrusted_call_count": 1
}
medium other detector ETH value transfer possible 40 no no
view
trace_id: 0x87623461f1ffa18ab03b8c7c1ab7ab609cc016636e067cf2323fbe545887d7be
call_targets: 0x9e1e038961b0c70066c2adc5b69367bbe35d38db
target_varies: no
classification: constant_target
validation_json 
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x87623461f1ffa18ab03b8c7c1ab7ab609cc016636e067cf2323fbe545887d7be",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x9e1e038961b0c70066c2adc5b69367bbe35d38db"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x761610fc",
            "selector": "0x761610fc",
            "calldata_variants": [
                "0x761610fc",
                "0x761610fc0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xc2052403",
            "selector": "0xc2052403",
            "calldata_variants": [
                "0xc2052403",
                "0xc20524030000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 425,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 1,
    "guards_detected": [
        {
            "pc": 892,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 979,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        }
    ]
}
medium other detector SELFDESTRUCT reachable 45 no no
view
trace_id: 0x62eff91585633355a36e481bf07f0b7f9e33e186cd70e98c111a783f304ddcdb
validation_json 
{
    "sink": "SELFDESTRUCT",
    "errors": 0,
    "status": "unknown",
    "attempts": 4,
    "trace_id": "0x62eff91585633355a36e481bf07f0b7f9e33e186cd70e98c111a783f304ddcdb",
    "confirmed": false,
    "trace_mode": "structLogs",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x761610fc",
            "selector": "0x761610fc",
            "calldata_variants": [
                "0x761610fc",
                "0x761610fc0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xc2052403",
            "selector": "0xc2052403",
            "calldata_variants": [
                "0xc2052403",
                "0xc20524030000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "guards_detected": [
        {
            "pc": 892,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 979,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        }
    ],
    "selfdestruct_count": 2
}
medium other detector CREATE/CREATE2 reachable 45 no no
view
trace_id: 0x62eff91585633355a36e481bf07f0b7f9e33e186cd70e98c111a783f304ddcdb
validation_json 
{
    "sink": "CREATE",
    "errors": 0,
    "status": "unknown",
    "attempts": 4,
    "trace_id": "0x62eff91585633355a36e481bf07f0b7f9e33e186cd70e98c111a783f304ddcdb",
    "confirmed": false,
    "trace_mode": "structLogs",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x761610fc",
            "selector": "0x761610fc",
            "calldata_variants": [
                "0x761610fc",
                "0x761610fc0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xc2052403",
            "selector": "0xc2052403",
            "calldata_variants": [
                "0xc2052403",
                "0xc20524030000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "create_count": 1,
    "create2_count": 0
}