Analysis Run

019b3844-a6b3-7109-9cb6-28b7b57c86e1

complete

Chain ID

1

Address

0x6329004e903b7f420245e7af3f355186f2432466

Block Number

—

Created

Fri, Dec 19, 2025 8:19 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Bytecode only

Review Backing

Not yet

Best current signal

Untrusted CALL target/value reachable

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
16417	artifact.fetch	complete	1 / 3	3 months ago
16418	tool.cast_disasm	complete	1 / 3	3 months ago
86524	analysis.bundle	complete	1 / 3	1 week ago
86525	capability.graph	complete	1 / 3	1 week ago
86526	detector.run	complete	1 / 3	1 week ago
86527	validation.fork	complete	1 / 3	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

0

Selfdestruct

0

CREATE2

0

CALL-family (heavy)

1

EXT*/BALANCE

0

Total opcodes

529

Flags

No heuristic flags raised.

View cast disassembly output

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x0042
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH3 0xf714ce
00000018: EQ
00000019: PUSH2 0x004e
0000001c: JUMPI
0000001d: DUP1
0000001e: PUSH4 0x715018a6
00000023: EQ
00000024: PUSH2 0x0070
00000027: JUMPI
00000028: DUP1
00000029: PUSH4 0x8da5cb5b
0000002e: EQ
0000002f: PUSH2 0x0085
00000032: JUMPI
00000033: DUP1
00000034: PUSH4 0xf2fde38b
00000039: EQ
0000003a: PUSH2 0x00be
0000003d: JUMPI
0000003e: PUSH1 0x00
00000040: DUP1
00000041: REVERT
00000042: JUMPDEST
00000043: CALLDATASIZE
00000044: PUSH2 0x0049
00000047: JUMPI
00000048: STOP
00000049: JUMPDEST
0000004a: PUSH1 0x00
0000004c: DUP1
0000004d: REVERT
0000004e: JUMPDEST
0000004f: CALLVALUE
00000050: DUP1
00000051: ISZERO
00000052: PUSH2 0x005a
00000055: JUMPI
00000056: PUSH1 0x00
00000058: DUP1
00000059: REVERT
0000005a: JUMPDEST
0000005b: POP
0000005c: PUSH2 0x006e
0000005f: PUSH2 0x0069
00000062: CALLDATASIZE
00000063: PUSH1 0x04
00000065: PUSH2 0x04b1
00000068: JUMP
00000069: JUMPDEST
0000006a: PUSH2 0x00de
0000006d: JUMP
0000006e: JUMPDEST
0000006f: STOP
00000070: JUMPDEST
00000071: CALLVALUE
00000072: DUP1
00000073: ISZERO
00000074: PUSH2 0x007c
00000077: JUMPI
00000078: PUSH1 0x00
0000007a: DUP1
0000007b: REVERT
0000007c: JUMPDEST
0000007d: POP
0000007e: PUSH2 0x006e
00000081: PUSH2 0x02c7
00000084: JUMP
00000085: JUMPDEST
00000086: CALLVALUE
00000087: DUP1
00000088: ISZERO
00000089: PUSH2 0x0091
0000008c: JUMPI
0000008d: PUSH1 0x00
0000008f: DUP1
00000090: REVERT
00000091: JUMPDEST
00000092: POP
00000093: PUSH1 0x00
00000095: SLOAD
00000096: PUSH1 0x40
00000098: DUP1
00000099: MLOAD
0000009a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000af: SWAP1
000000b0: SWAP3
000000b1: AND
000000b2: DUP3
000000b3: MSTORE
000000b4: MLOAD
000000b5: SWAP1
000000b6: DUP2
000000b7: SWAP1
000000b8: SUB
000000b9: PUSH1 0x20
000000bb: ADD
000000bc: SWAP1
000000bd: RETURN
000000be: JUMPDEST
000000bf: CALLVALUE
000000c0: DUP1
000000c1: ISZERO
000000c2: PUSH2 0x00ca
000000c5: JUMPI
000000c6: PUSH1 0x00
000000c8: DUP1
000000c9: REVERT
000000ca: JUMPDEST
000000cb: POP
000000cc: PUSH2 0x006e
000000cf: PUSH2 0x00d9
000000d2: CALLDATASIZE
000000d3: PUSH1 0x04
000000d5: PUSH2 0x04dd
000000d8: JUMP
000000d9: JUMPDEST
000000da: PUSH2 0x02db
000000dd: JUMP
000000de: JUMPDEST
000000df: PUSH2 0x00e6
000000e2: PUSH2 0x0392
000000e5: JUMP
000000e6: JUMPDEST
000000e7: SELFBALANCE
000000e8: DUP3
000000e9: GT
000000ea: ISZERO
000000eb: PUSH2 0x017b
000000ee: JUMPI
000000ef: PUSH1 0x40
000000f1: MLOAD
000000f2: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000113: DUP2
00000114: MSTORE
00000115: PUSH1 0x20
00000117: PUSH1 0x04
00000119: DUP3
0000011a: ADD
0000011b: MSTORE
0000011c: PUSH1 0x2e
0000011e: PUSH1 0x24
00000120: DUP3
00000121: ADD
00000122: MSTORE
00000123: PUSH32 0x7468652062616c616e6365206973206c6f776572207468616e20746865207265
00000144: PUSH1 0x44
00000146: DUP3
00000147: ADD
00000148: MSTORE
00000149: PUSH32 0x7175657374656420616d6f756e74000000000000000000000000000000000000
0000016a: PUSH1 0x64
0000016c: DUP3
0000016d: ADD
0000016e: MSTORE
0000016f: PUSH1 0x84
00000171: ADD
00000172: JUMPDEST
00000173: PUSH1 0x40
00000175: MLOAD
00000176: DUP1
00000177: SWAP2
00000178: SUB
00000179: SWAP1
0000017a: REVERT
0000017b: JUMPDEST
0000017c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000191: DUP2
00000192: AND
00000193: PUSH2 0x01f8
00000196: JUMPI
00000197: PUSH1 0x40
00000199: MLOAD
0000019a: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
000001bb: DUP2
000001bc: MSTORE
000001bd: PUSH1 0x20
000001bf: PUSH1 0x04
000001c1: DUP3
000001c2: ADD
000001c3: MSTORE
000001c4: PUSH1 0x1b
000001c6: PUSH1 0x24
000001c8: DUP3
000001c9: ADD
000001ca: MSTORE
000001cb: PUSH32 0x6e756c6c2061646472657373206973206e6f7420616c6c6f7765640000000000
000001ec: PUSH1 0x44
000001ee: DUP3
000001ef: ADD
000001f0: MSTORE
000001f1: PUSH1 0x64
000001f3: ADD
000001f4: PUSH2 0x0172
000001f7: JUMP
000001f8: JUMPDEST
000001f9: PUSH1 0x00
000001fb: DUP2
000001fc: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000211: AND
00000212: DUP4
00000213: PUSH1 0x40
00000215: MLOAD
00000216: PUSH1 0x00
00000218: PUSH1 0x40
0000021a: MLOAD
0000021b: DUP1
0000021c: DUP4
0000021d: SUB
0000021e: DUP2
0000021f: DUP6
00000220: DUP8
00000221: GAS
00000222: CALL
00000223: SWAP3
00000224: POP
00000225: POP
00000226: POP
00000227: RETURNDATASIZE
00000228: DUP1
00000229: PUSH1 0x00
0000022b: DUP2
0000022c: EQ
0000022d: PUSH2 0x0252
00000230: JUMPI
00000231: PUSH1 0x40
00000233: MLOAD
00000234: SWAP2
00000235: POP
00000236: PUSH1 0x1f
00000238: NOT
00000239: PUSH1 0x3f
0000023b: RETURNDATASIZE
0000023c: ADD
0000023d: AND
0000023e: DUP3
0000023f: ADD
00000240: PUSH1 0x40
00000242: MSTORE
00000243: RETURNDATASIZE
00000244: DUP3
00000245: MSTORE
00000246: RETURNDATASIZE
00000247: PUSH1 0x00
00000249: PUSH1 0x20
0000024b: DUP5
0000024c: ADD
0000024d: RETURNDATACOPY
0000024e: PUSH2 0x0257
00000251: JUMP
00000252: JUMPDEST
00000253: PUSH1 0x60
00000255: SWAP2
00000256: POP
00000257: JUMPDEST
00000258: POP
00000259: POP
0000025a: SWAP1
0000025b: POP
0000025c: DUP1
0000025d: PUSH2 0x02c2
00000260: JUMPI
00000261: PUSH1 0x40
00000263: MLOAD
00000264: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000285: DUP2
00000286: MSTORE
00000287: PUSH1 0x20
00000289: PUSH1 0x04
0000028b: DUP3
0000028c: ADD
0000028d: MSTORE
0000028e: PUSH1 0x14
00000290: PUSH1 0x24
00000292: DUP3
00000293: ADD
00000294: MSTORE
00000295: PUSH32 0x4661696c656420746f2073656e64204574686572000000000000000000000000
000002b6: PUSH1 0x44
000002b8: DUP3
000002b9: ADD
000002ba: MSTORE
000002bb: PUSH1 0x64
000002bd: ADD
000002be: PUSH2 0x0172
000002c1: JUMP
000002c2: JUMPDEST
000002c3: POP
000002c4: POP
000002c5: POP
000002c6: JUMP
000002c7: JUMPDEST
000002c8: PUSH2 0x02cf
000002cb: PUSH2 0x0392
000002ce: JUMP
000002cf: JUMPDEST
000002d0: PUSH2 0x02d9
000002d3: PUSH1 0x00
000002d5: PUSH2 0x0413
000002d8: JUMP
000002d9: JUMPDEST
000002da: JUMP
000002db: JUMPDEST
000002dc: PUSH2 0x02e3
000002df: PUSH2 0x0392
000002e2: JUMP
000002e3: JUMPDEST
000002e4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002f9: DUP2
000002fa: AND
000002fb: PUSH2 0x0386
000002fe: JUMPI
000002ff: PUSH1 0x40
00000301: MLOAD
00000302: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000323: DUP2
00000324: MSTORE
00000325: PUSH1 0x20
00000327: PUSH1 0x04
00000329: DUP3
0000032a: ADD
0000032b: MSTORE
0000032c: PUSH1 0x26
0000032e: PUSH1 0x24
00000330: DUP3
00000331: ADD
00000332: MSTORE
00000333: PUSH32 0x4f776e61626c653a206e6577206f776e657220697320746865207a65726f2061
00000354: PUSH1 0x44
00000356: DUP3
00000357: ADD
00000358: MSTORE
00000359: PUSH32 0x6464726573730000000000000000000000000000000000000000000000000000
0000037a: PUSH1 0x64
0000037c: DUP3
0000037d: ADD
0000037e: MSTORE
0000037f: PUSH1 0x84
00000381: ADD
00000382: PUSH2 0x0172
00000385: JUMP
00000386: JUMPDEST
00000387: PUSH2 0x038f
0000038a: DUP2
0000038b: PUSH2 0x0413
0000038e: JUMP
0000038f: JUMPDEST
00000390: POP
00000391: JUMP
00000392: JUMPDEST
00000393: PUSH1 0x00
00000395: SLOAD
00000396: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003ab: AND
000003ac: CALLER
000003ad: EQ
000003ae: PUSH2 0x02d9
000003b1: JUMPI
000003b2: PUSH1 0x40
000003b4: MLOAD
000003b5: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
000003d6: DUP2
000003d7: MSTORE
000003d8: PUSH1 0x20
000003da: PUSH1 0x04
000003dc: DUP3
000003dd: ADD
000003de: DUP2
000003df: SWAP1
000003e0: MSTORE
000003e1: PUSH1 0x24
000003e3: DUP3
000003e4: ADD
000003e5: MSTORE
000003e6: PUSH32 0x4f776e61626c653a2063616c6c6572206973206e6f7420746865206f776e6572
00000407: PUSH1 0x44
00000409: DUP3
0000040a: ADD
0000040b: MSTORE
0000040c: PUSH1 0x64
0000040e: ADD
0000040f: PUSH2 0x0172
00000412: JUMP
00000413: JUMPDEST
00000414: PUSH1 0x00
00000416: DUP1
00000417: SLOAD
00000418: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000042d: DUP4
0000042e: DUP2
0000042f: AND
00000430: PUSH32 0xffffffffffffffffffffffff0000000000000000000000000000000000000000
00000451: DUP4
00000452: AND
00000453: DUP2
00000454: OR
00000455: DUP5
00000456: SSTORE
00000457: PUSH1 0x40
00000459: MLOAD
0000045a: SWAP2
0000045b: SWAP1
0000045c: SWAP3
0000045d: AND
0000045e: SWAP3
0000045f: DUP4
00000460: SWAP2
00000461: PUSH32 0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0
00000482: SWAP2
00000483: SWAP1
00000484: LOG3
00000485: POP
00000486: POP
00000487: JUMP
00000488: JUMPDEST
00000489: DUP1
0000048a: CALLDATALOAD
0000048b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000004a0: DUP2
000004a1: AND
000004a2: DUP2
000004a3: EQ
000004a4: PUSH2 0x04ac
000004a7: JUMPI
000004a8: PUSH1 0x00
000004aa: DUP1
000004ab: REVERT
000004ac: JUMPDEST
000004ad: SWAP2
000004ae: SWAP1
000004af: POP
000004b0: JUMP
000004b1: JUMPDEST
000004b2: PUSH1 0x00
000004b4: DUP1
000004b5: PUSH1 0x40
000004b7: DUP4
000004b8: DUP6
000004b9: SUB
000004ba: SLT
000004bb: ISZERO
000004bc: PUSH2 0x04c4
000004bf: JUMPI
000004c0: PUSH1 0x00
000004c2: DUP1
000004c3: REVERT
000004c4: JUMPDEST
000004c5: DUP3
000004c6: CALLDATALOAD
000004c7: SWAP2
000004c8: POP
000004c9: PUSH2 0x04d4
000004cc: PUSH1 0x20
000004ce: DUP5
000004cf: ADD
000004d0: PUSH2 0x0488
000004d3: JUMP
000004d4: JUMPDEST
000004d5: SWAP1
000004d6: POP
000004d7: SWAP3
000004d8: POP
000004d9: SWAP3
000004da: SWAP1
000004db: POP
000004dc: JUMP
000004dd: JUMPDEST
000004de: PUSH1 0x00
000004e0: PUSH1 0x20
000004e2: DUP3
000004e3: DUP5
000004e4: SUB
000004e5: SLT
000004e6: ISZERO
000004e7: PUSH2 0x04ef
000004ea: JUMPI
000004eb: PUSH1 0x00
000004ed: DUP1
000004ee: REVERT
000004ef: JUMPDEST
000004f0: PUSH2 0x04f8
000004f3: DUP3
000004f4: PUSH2 0x0488
000004f7: JUMP
000004f8: JUMPDEST
000004f9: SWAP4
000004fa: SWAP3
000004fb: POP
000004fc: POP
000004fd: POP
000004fe: JUMP
000004ff: INVALID
00000500: LOG2
00000501: PUSH5 0x6970667358
00000507: UNKNOWN(0x22)
00000508: SLT
00000509: KECCAK256
0000050a: UNKNOWN(0xC7)
0000050b: SWAP5
0000050c: UNKNOWN(0xE3)
0000050d: CALLDATALOAD
0000050e: DUP6
0000050f: UNKNOWN(0xF6)
00000510: DUP1
00000511: UNKNOWN(0x4F)
00000512: UNKNOWN(0xDC)
00000513: STOP
00000514: UNKNOWN(0xE6)
00000515: EQ
00000516: SSTORE
00000517: TIMESTAMP
00000518: UNKNOWN(0x22)
00000519: LT
0000051a: UNKNOWN(0x28)
0000051b: UNKNOWN(0xD0)
0000051c: DUP8
0000051d: PUSH31

View stderr

Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	other	detector	Untrusted CALL target/value reachable	60	no	no	view trace_id: 0xe0bab037cbfcb7eb142ef60696d7f06e88856c8255606d4cfe1912047d73667b call_targets: 0x6329004e903b7f420245e7af3f355186f2432466 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xe0bab037cbfcb7eb142ef60696d7f06e88856c8255606d4cfe1912047d73667b", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0x6329004e903b7f420245e7af3f355186f2432466" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x715018a6", "selector": "0x715018a6", "calldata_variants": [ "0x715018a6", "0x715018a60000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xf2fde38b", "selector": "0xf2fde38b", "calldata_variants": [ "0xf2fde38b", "0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 546, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "call_count": 1, "guards_detected": [], "untrusted_call_count": 1 }
high	other	detector	ETH value transfer possible	55	no	no	view trace_id: 0xe0bab037cbfcb7eb142ef60696d7f06e88856c8255606d4cfe1912047d73667b call_targets: 0x6329004e903b7f420245e7af3f355186f2432466 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xe0bab037cbfcb7eb142ef60696d7f06e88856c8255606d4cfe1912047d73667b", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0x6329004e903b7f420245e7af3f355186f2432466" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x715018a6", "selector": "0x715018a6", "calldata_variants": [ "0x715018a6", "0x715018a60000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xf2fde38b", "selector": "0xf2fde38b", "calldata_variants": [ "0xf2fde38b", "0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 546, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "eth_value_calls": 1, "guards_detected": [] }

Severity

Category

Tool

Title

Confidence

Validated

Confirmed

Details

high

other

detector

Untrusted CALL target/value reachable

60

no

view

trace_id: 0xe0bab037cbfcb7eb142ef60696d7f06e88856c8255606d4cfe1912047d73667b

call_targets: 0x6329004e903b7f420245e7af3f355186f2432466

target_varies: no

classification: constant_target

validation_json

{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0xe0bab037cbfcb7eb142ef60696d7f06e88856c8255606d4cfe1912047d73667b",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x6329004e903b7f420245e7af3f355186f2432466"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x715018a6",
            "selector": "0x715018a6",
            "calldata_variants": [
                "0x715018a6",
                "0x715018a60000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xf2fde38b",
            "selector": "0xf2fde38b",
            "calldata_variants": [
                "0xf2fde38b",
                "0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "examples": [
        {
            "pc": 546,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 1,
    "guards_detected": [],
    "untrusted_call_count": 1
}