Analysis Run

019b3844-add3-72bb-ad14-c505fd2a9fe6

complete

Chain ID

1

Address

0x85f1da85e5fe047b946417cb5466f9b5f0e382c0

Block Number

—

Created

Fri, Dec 19, 2025 8:19 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Bytecode only

Review Backing

Not yet

Best current signal

Untrusted DELEGATECALL target reachable

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
17677	artifact.fetch	complete	1 / 3	3 months ago
17678	tool.cast_disasm	complete	1 / 3	3 months ago
86744	analysis.bundle	complete	1 / 3	2 weeks ago
86745	capability.graph	complete	1 / 3	2 weeks ago
86746	detector.run	complete	1 / 3	2 weeks ago
86747	validation.fork	complete	1 / 3	2 weeks ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

2

Selfdestruct

0

CREATE2

1

CALL-family (heavy)

0

EXT*/BALANCE

1

Total opcodes

663

Flags

delegatecall_present create_opcodes_present

View cast disassembly output

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x0043
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x3659cfe6
00000019: EQ
0000001a: PUSH2 0x005a
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0x4f1ef286
00000024: EQ
00000025: PUSH2 0x009a
00000028: JUMPI
00000029: DUP1
0000002a: PUSH4 0x5c60da1b
0000002f: EQ
00000030: PUSH2 0x0127
00000033: JUMPI
00000034: DUP1
00000035: PUSH4 0xf851a440
0000003a: EQ
0000003b: PUSH2 0x0165
0000003e: JUMPI
0000003f: PUSH2 0x0052
00000042: JUMP
00000043: JUMPDEST
00000044: CALLDATASIZE
00000045: PUSH2 0x0052
00000048: JUMPI
00000049: PUSH2 0x0050
0000004c: PUSH2 0x017a
0000004f: JUMP
00000050: JUMPDEST
00000051: STOP
00000052: JUMPDEST
00000053: PUSH2 0x0050
00000056: PUSH2 0x017a
00000059: JUMP
0000005a: JUMPDEST
0000005b: CALLVALUE
0000005c: DUP1
0000005d: ISZERO
0000005e: PUSH2 0x0066
00000061: JUMPI
00000062: PUSH1 0x00
00000064: DUP1
00000065: REVERT
00000066: JUMPDEST
00000067: POP
00000068: PUSH2 0x0050
0000006b: PUSH1 0x04
0000006d: DUP1
0000006e: CALLDATASIZE
0000006f: SUB
00000070: PUSH1 0x20
00000072: DUP2
00000073: LT
00000074: ISZERO
00000075: PUSH2 0x007d
00000078: JUMPI
00000079: PUSH1 0x00
0000007b: DUP1
0000007c: REVERT
0000007d: JUMPDEST
0000007e: POP
0000007f: CALLDATALOAD
00000080: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000095: AND
00000096: PUSH2 0x0194
00000099: JUMP
0000009a: JUMPDEST
0000009b: PUSH2 0x0050
0000009e: PUSH1 0x04
000000a0: DUP1
000000a1: CALLDATASIZE
000000a2: SUB
000000a3: PUSH1 0x40
000000a5: DUP2
000000a6: LT
000000a7: ISZERO
000000a8: PUSH2 0x00b0
000000ab: JUMPI
000000ac: PUSH1 0x00
000000ae: DUP1
000000af: REVERT
000000b0: JUMPDEST
000000b1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000c6: DUP3
000000c7: CALLDATALOAD
000000c8: AND
000000c9: SWAP2
000000ca: SWAP1
000000cb: DUP2
000000cc: ADD
000000cd: SWAP1
000000ce: PUSH1 0x40
000000d0: DUP2
000000d1: ADD
000000d2: PUSH1 0x20
000000d4: DUP3
000000d5: ADD
000000d6: CALLDATALOAD
000000d7: PUSH5 0x0100000000
000000dd: DUP2
000000de: GT
000000df: ISZERO
000000e0: PUSH2 0x00e8
000000e3: JUMPI
000000e4: PUSH1 0x00
000000e6: DUP1
000000e7: REVERT
000000e8: JUMPDEST
000000e9: DUP3
000000ea: ADD
000000eb: DUP4
000000ec: PUSH1 0x20
000000ee: DUP3
000000ef: ADD
000000f0: GT
000000f1: ISZERO
000000f2: PUSH2 0x00fa
000000f5: JUMPI
000000f6: PUSH1 0x00
000000f8: DUP1
000000f9: REVERT
000000fa: JUMPDEST
000000fb: DUP1
000000fc: CALLDATALOAD
000000fd: SWAP1
000000fe: PUSH1 0x20
00000100: ADD
00000101: SWAP2
00000102: DUP5
00000103: PUSH1 0x01
00000105: DUP4
00000106: MUL
00000107: DUP5
00000108: ADD
00000109: GT
0000010a: PUSH5 0x0100000000
00000110: DUP4
00000111: GT
00000112: OR
00000113: ISZERO
00000114: PUSH2 0x011c
00000117: JUMPI
00000118: PUSH1 0x00
0000011a: DUP1
0000011b: REVERT
0000011c: JUMPDEST
0000011d: POP
0000011e: SWAP1
0000011f: SWAP3
00000120: POP
00000121: SWAP1
00000122: POP
00000123: PUSH2 0x01e8
00000126: JUMP
00000127: JUMPDEST
00000128: CALLVALUE
00000129: DUP1
0000012a: ISZERO
0000012b: PUSH2 0x0133
0000012e: JUMPI
0000012f: PUSH1 0x00
00000131: DUP1
00000132: REVERT
00000133: JUMPDEST
00000134: POP
00000135: PUSH2 0x013c
00000138: PUSH2 0x02bc
0000013b: JUMP
0000013c: JUMPDEST
0000013d: PUSH1 0x40
0000013f: DUP1
00000140: MLOAD
00000141: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000156: SWAP1
00000157: SWAP3
00000158: AND
00000159: DUP3
0000015a: MSTORE
0000015b: MLOAD
0000015c: SWAP1
0000015d: DUP2
0000015e: SWAP1
0000015f: SUB
00000160: PUSH1 0x20
00000162: ADD
00000163: SWAP1
00000164: RETURN
00000165: JUMPDEST
00000166: CALLVALUE
00000167: DUP1
00000168: ISZERO
00000169: PUSH2 0x0171
0000016c: JUMPI
0000016d: PUSH1 0x00
0000016f: DUP1
00000170: REVERT
00000171: JUMPDEST
00000172: POP
00000173: PUSH2 0x013c
00000176: PUSH2 0x0313
00000179: JUMP
0000017a: JUMPDEST
0000017b: PUSH2 0x0182
0000017e: PUSH2 0x0394
00000181: JUMP
00000182: JUMPDEST
00000183: PUSH2 0x0192
00000186: PUSH2 0x018d
00000189: PUSH2 0x0428
0000018c: JUMP
0000018d: JUMPDEST
0000018e: PUSH2 0x044d
00000191: JUMP
00000192: JUMPDEST
00000193: JUMP
00000194: JUMPDEST
00000195: PUSH2 0x019c
00000198: PUSH2 0x0471
0000019b: JUMP
0000019c: JUMPDEST
0000019d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000001b2: AND
000001b3: CALLER
000001b4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000001c9: AND
000001ca: EQ
000001cb: ISZERO
000001cc: PUSH2 0x01dd
000001cf: JUMPI
000001d0: PUSH2 0x01d8
000001d3: DUP2
000001d4: PUSH2 0x0495
000001d7: JUMP
000001d8: JUMPDEST
000001d9: PUSH2 0x01e5
000001dc: JUMP
000001dd: JUMPDEST
000001de: PUSH2 0x01e5
000001e1: PUSH2 0x017a
000001e4: JUMP
000001e5: JUMPDEST
000001e6: POP
000001e7: JUMP
000001e8: JUMPDEST
000001e9: PUSH2 0x01f0
000001ec: PUSH2 0x0471
000001ef: JUMP
000001f0: JUMPDEST
000001f1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000206: AND
00000207: CALLER
00000208: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000021d: AND
0000021e: EQ
0000021f: ISZERO
00000220: PUSH2 0x02af
00000223: JUMPI
00000224: PUSH2 0x022c
00000227: DUP4
00000228: PUSH2 0x0495
0000022b: JUMP
0000022c: JUMPDEST
0000022d: PUSH1 0x00
0000022f: DUP4
00000230: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000245: AND
00000246: DUP4
00000247: DUP4
00000248: PUSH1 0x40
0000024a: MLOAD
0000024b: DUP1
0000024c: DUP4
0000024d: DUP4
0000024e: DUP1
0000024f: DUP3
00000250: DUP5
00000251: CALLDATACOPY
00000252: PUSH1 0x40
00000254: MLOAD
00000255: SWAP3
00000256: ADD
00000257: SWAP5
00000258: POP
00000259: PUSH1 0x00
0000025b: SWAP4
0000025c: POP
0000025d: SWAP1
0000025e: SWAP2
0000025f: POP
00000260: POP
00000261: DUP1
00000262: DUP4
00000263: SUB
00000264: DUP2
00000265: DUP6
00000266: GAS
00000267: DELEGATECALL
00000268: SWAP2
00000269: POP
0000026a: POP
0000026b: RETURNDATASIZE
0000026c: DUP1
0000026d: PUSH1 0x00
0000026f: DUP2
00000270: EQ
00000271: PUSH2 0x0296
00000274: JUMPI
00000275: PUSH1 0x40
00000277: MLOAD
00000278: SWAP2
00000279: POP
0000027a: PUSH1 0x1f
0000027c: NOT
0000027d: PUSH1 0x3f
0000027f: RETURNDATASIZE
00000280: ADD
00000281: AND
00000282: DUP3
00000283: ADD
00000284: PUSH1 0x40
00000286: MSTORE
00000287: RETURNDATASIZE
00000288: DUP3
00000289: MSTORE
0000028a: RETURNDATASIZE
0000028b: PUSH1 0x00
0000028d: PUSH1 0x20
0000028f: DUP5
00000290: ADD
00000291: RETURNDATACOPY
00000292: PUSH2 0x029b
00000295: JUMP
00000296: JUMPDEST
00000297: PUSH1 0x60
00000299: SWAP2
0000029a: POP
0000029b: JUMPDEST
0000029c: POP
0000029d: POP
0000029e: SWAP1
0000029f: POP
000002a0: DUP1
000002a1: PUSH2 0x02a9
000002a4: JUMPI
000002a5: PUSH1 0x00
000002a7: DUP1
000002a8: REVERT
000002a9: JUMPDEST
000002aa: POP
000002ab: PUSH2 0x02b7
000002ae: JUMP
000002af: JUMPDEST
000002b0: PUSH2 0x02b7
000002b3: PUSH2 0x017a
000002b6: JUMP
000002b7: JUMPDEST
000002b8: POP
000002b9: POP
000002ba: POP
000002bb: JUMP
000002bc: JUMPDEST
000002bd: PUSH1 0x00
000002bf: PUSH2 0x02c6
000002c2: PUSH2 0x0471
000002c5: JUMP
000002c6: JUMPDEST
000002c7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002dc: AND
000002dd: CALLER
000002de: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002f3: AND
000002f4: EQ
000002f5: ISZERO
000002f6: PUSH2 0x0308
000002f9: JUMPI
000002fa: PUSH2 0x0301
000002fd: PUSH2 0x0428
00000300: JUMP
00000301: JUMPDEST
00000302: SWAP1
00000303: POP
00000304: PUSH2 0x0310
00000307: JUMP
00000308: JUMPDEST
00000309: PUSH2 0x0310
0000030c: PUSH2 0x017a
0000030f: JUMP
00000310: JUMPDEST
00000311: SWAP1
00000312: JUMP
00000313: JUMPDEST
00000314: PUSH1 0x00
00000316: PUSH2 0x031d
00000319: PUSH2 0x0471
0000031c: JUMP
0000031d: JUMPDEST
0000031e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000333: AND
00000334: CALLER
00000335: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000034a: AND
0000034b: EQ
0000034c: ISZERO
0000034d: PUSH2 0x0308
00000350: JUMPI
00000351: PUSH2 0x0301
00000354: PUSH2 0x0471
00000357: JUMP
00000358: JUMPDEST
00000359: PUSH1 0x00
0000035b: DUP2
0000035c: EXTCODEHASH
0000035d: PUSH32 0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470
0000037e: DUP2
0000037f: DUP2
00000380: EQ
00000381: DUP1
00000382: ISZERO
00000383: SWAP1
00000384: PUSH2 0x038c
00000387: JUMPI
00000388: POP
00000389: DUP2
0000038a: ISZERO
0000038b: ISZERO
0000038c: JUMPDEST
0000038d: SWAP5
0000038e: SWAP4
0000038f: POP
00000390: POP
00000391: POP
00000392: POP
00000393: JUMP
00000394: JUMPDEST
00000395: PUSH2 0x039c
00000398: PUSH2 0x0471
0000039b: JUMP
0000039c: JUMPDEST
0000039d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003b2: AND
000003b3: CALLER
000003b4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003c9: AND
000003ca: EQ
000003cb: ISZERO
000003cc: PUSH2 0x0420
000003cf: JUMPI
000003d0: PUSH1 0x40
000003d2: MLOAD
000003d3: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
000003f4: DUP2
000003f5: MSTORE
000003f6: PUSH1 0x04
000003f8: ADD
000003f9: DUP1
000003fa: DUP1
000003fb: PUSH1 0x20
000003fd: ADD
000003fe: DUP3
000003ff: DUP2
00000400: SUB
00000401: DUP3
00000402: MSTORE
00000403: PUSH1 0x42
00000405: DUP2
00000406: MSTORE
00000407: PUSH1 0x20
00000409: ADD
0000040a: DUP1
0000040b: PUSH2 0x059b
0000040e: PUSH1 0x42
00000410: SWAP2
00000411: CODECOPY
00000412: PUSH1 0x60
00000414: ADD
00000415: SWAP2
00000416: POP
00000417: POP
00000418: PUSH1 0x40
0000041a: MLOAD
0000041b: DUP1
0000041c: SWAP2
0000041d: SUB
0000041e: SWAP1
0000041f: REVERT
00000420: JUMPDEST
00000421: PUSH2 0x0192
00000424: PUSH2 0x0192
00000427: JUMP
00000428: JUMPDEST
00000429: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
0000044a: SLOAD
0000044b: SWAP1
0000044c: JUMP
0000044d: JUMPDEST
0000044e: CALLDATASIZE
0000044f: PUSH1 0x00
00000451: DUP1
00000452: CALLDATACOPY
00000453: PUSH1 0x00
00000455: DUP1
00000456: CALLDATASIZE
00000457: PUSH1 0x00
00000459: DUP5
0000045a: GAS
0000045b: DELEGATECALL
0000045c: RETURNDATASIZE
0000045d: PUSH1 0x00
0000045f: DUP1
00000460: RETURNDATACOPY
00000461: DUP1
00000462: DUP1
00000463: ISZERO
00000464: PUSH2 0x046c
00000467: JUMPI
00000468: RETURNDATASIZE
00000469: PUSH1 0x00
0000046b: RETURN
0000046c: JUMPDEST
0000046d: RETURNDATASIZE
0000046e: PUSH1 0x00
00000470: REVERT
00000471: JUMPDEST
00000472: PUSH32 0x000000000000000000000000965b104e250648d01d4b3b72bac751cde809d29e
00000493: SWAP1
00000494: JUMP
00000495: JUMPDEST
00000496: PUSH2 0x049e
00000499: DUP2
0000049a: PUSH2 0x04e2
0000049d: JUMP
0000049e: JUMPDEST
0000049f: PUSH1 0x40
000004a1: MLOAD
000004a2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000004b7: DUP3
000004b8: AND
000004b9: SWAP1
000004ba: PUSH32 0xbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b
000004db: SWAP1
000004dc: PUSH1 0x00
000004de: SWAP1
000004df: LOG2
000004e0: POP
000004e1: JUMP
000004e2: JUMPDEST
000004e3: PUSH2 0x04eb
000004e6: DUP2
000004e7: PUSH2 0x0358
000004ea: JUMP
000004eb: JUMPDEST
000004ec: PUSH2 0x0540
000004ef: JUMPI
000004f0: PUSH1 0x40
000004f2: MLOAD
000004f3: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000514: DUP2
00000515: MSTORE
00000516: PUSH1 0x04
00000518: ADD
00000519: DUP1
0000051a: DUP1
0000051b: PUSH1 0x20
0000051d: ADD
0000051e: DUP3
0000051f: DUP2
00000520: SUB
00000521: DUP3
00000522: MSTORE
00000523: PUSH1 0x36
00000525: DUP2
00000526: MSTORE
00000527: PUSH1 0x20
00000529: ADD
0000052a: DUP1
0000052b: PUSH2 0x0565
0000052e: PUSH1 0x36
00000530: SWAP2
00000531: CODECOPY
00000532: PUSH1 0x40
00000534: ADD
00000535: SWAP2
00000536: POP
00000537: POP
00000538: PUSH1 0x40
0000053a: MLOAD
0000053b: DUP1
0000053c: SWAP2
0000053d: SUB
0000053e: SWAP1
0000053f: REVERT
00000540: JUMPDEST
00000541: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
00000562: SSTORE
00000563: JUMP
00000564: INVALID
00000565: SSTORE
00000566: PUSH17 0x677261646561626c6550726f78793a206e
00000578: PUSH6 0x7720696d706c
0000057f: PUSH6 0x6d656e746174
00000586: PUSH10 0x6f6e206973206e6f7420
00000591: PUSH2 0x2063
00000594: PUSH16 0x6e74726163745472616e73706172656e
000005a5: PUSH21 0x5570677261646561626c6550726f78793a2061646d
000005bb: PUSH10 0x6e2063616e6e6f742066
000005c6: PUSH2 0x6c6c
000005c9: PUSH3 0x61636b
000005cd: KECCAK256
000005ce: PUSH21 0x6f2070726f787920746172676574a2646970667358
000005e4: UNKNOWN(0x22)
000005e5: SLT
000005e6: KECCAK256
000005e7: UNKNOWN(0x0F)
000005e8: TIMESTAMP
000005e9: UNKNOWN(0xFC)
000005ea: SWAP14
000005eb: UNKNOWN(0x1F)
000005ec: SWAP10
000005ed: SLT
000005ee: CALLDATASIZE
000005ef: UNKNOWN(0xAE)
000005f0: UNKNOWN(0x26)
000005f1: UNKNOWN(0xE2)
000005f2: BLOCKHASH
000005f3: UNKNOWN(0xC8)
000005f4: POP
000005f5: TSTORE
000005f6: UNKNOWN(0xEF)
000005f7: SWAP6
000005f8: DUP6
000005f9: UNKNOWN(0x28)
000005fa: SUB
000005fb: AND
000005fc: SSTORE
000005fd: UNKNOWN(0xD7)
000005fe: UNKNOWN(0xDD)
000005ff: CALLER
00000600: TSTORE
00000601: CODECOPY
00000602: DUP9
00000603: UNKNOWN(0xCC)
00000604: UNKNOWN(0x0C)
00000605: DUP9
00000606: CREATE2
00000607: PUSH5 0x736f6c6343
0000060d: STOP
0000060e: SMOD
0000060f: MOD
00000610: STOP
00000611: CALLER

View stderr

Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	upgradeability	detector	Untrusted DELEGATECALL target reachable	55	no	no	view trace_id: 0x5b387b55376811f52f2a60eef44b81102923c3f260e4cb4cba9bb0d6f96c12dc call_targets: 0xda90ff602395cd2bbe3e339c28fa57877a6ede70 target_varies: no classification: constant_target validation_json { "sink": "DELEGATECALL", "errors": 0, "status": "sink_reached", "attempts": 2, "trace_id": "0x5b387b55376811f52f2a60eef44b81102923c3f260e4cb4cba9bb0d6f96c12dc", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0xda90ff602395cd2bbe3e339c28fa57877a6ede70" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x3659cfe6", "selector": "0x3659cfe6", "calldata_variants": [ "0x3659cfe6", "0x3659cfe60000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x4f1ef286", "selector": "0x4f1ef286", "calldata_variants": [ "0x4f1ef286", "0x4f1ef2860000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x5c60da1b", "selector": "0x5c60da1b", "calldata_variants": [ "0x5c60da1b", "0x5c60da1b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xf851a440", "selector": "0xf851a440", "calldata_variants": [ "0xf851a440", "0xf851a4400000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 615, "opcode": "DELEGATECALL", "returndata_checked": null, "value_expression_category": "n/a", "target_expression_category": "computed" }, { "pc": 1115, "opcode": "DELEGATECALL", "returndata_checked": null, "value_expression_category": "n/a", "target_expression_category": "computed" } ], "guards_detected": [ { "pc": 435, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 519, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 733, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 820, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 947, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" } ], "delegatecall_count": 2, "untrusted_delegatecall_count": 2 }
medium	other	detector	CREATE/CREATE2 reachable	45	no	no	view trace_id: 0x2a2111dd8104c758e0975c057b406982a7b1bb6b256120ea38f596c8b8efa3a2 validation_json { "sink": "CREATE", "errors": 0, "status": "unknown", "attempts": 8, "trace_id": "0x2a2111dd8104c758e0975c057b406982a7b1bb6b256120ea38f596c8b8efa3a2", "confirmed": false, "trace_mode": "structLogs", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "no_sink" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x3659cfe6", "selector": "0x3659cfe6", "calldata_variants": [ "0x3659cfe6", "0x3659cfe60000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x4f1ef286", "selector": "0x4f1ef286", "calldata_variants": [ "0x4f1ef286", "0x4f1ef2860000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x5c60da1b", "selector": "0x5c60da1b", "calldata_variants": [ "0x5c60da1b", "0x5c60da1b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xf851a440", "selector": "0xf851a440", "calldata_variants": [ "0xf851a440", "0xf851a4400000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "create_count": 0, "create2_count": 1 }

Severity

Category

Tool

Title

Confidence

Validated

Confirmed

Details

high

upgradeability

detector

Untrusted DELEGATECALL target reachable

55

no

view

trace_id: 0x5b387b55376811f52f2a60eef44b81102923c3f260e4cb4cba9bb0d6f96c12dc

call_targets: 0xda90ff602395cd2bbe3e339c28fa57877a6ede70

target_varies: no

classification: constant_target

validation_json

{
    "sink": "DELEGATECALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 2,
    "trace_id": "0x5b387b55376811f52f2a60eef44b81102923c3f260e4cb4cba9bb0d6f96c12dc",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xda90ff602395cd2bbe3e339c28fa57877a6ede70"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x3659cfe6",
            "selector": "0x3659cfe6",
            "calldata_variants": [
                "0x3659cfe6",
                "0x3659cfe60000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x4f1ef286",
            "selector": "0x4f1ef286",
            "calldata_variants": [
                "0x4f1ef286",
                "0x4f1ef2860000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x5c60da1b",
            "selector": "0x5c60da1b",
            "calldata_variants": [
                "0x5c60da1b",
                "0x5c60da1b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xf851a440",
            "selector": "0xf851a440",
            "calldata_variants": [
                "0xf851a440",
                "0xf851a4400000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "examples": [
        {
            "pc": 615,
            "opcode": "DELEGATECALL",
            "returndata_checked": null,
            "value_expression_category": "n/a",
            "target_expression_category": "computed"
        },
        {
            "pc": 1115,
            "opcode": "DELEGATECALL",
            "returndata_checked": null,
            "value_expression_category": "n/a",
            "target_expression_category": "computed"
        }
    ],
    "guards_detected": [
        {
            "pc": 435,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 519,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 733,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 820,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 947,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        }
    ],
    "delegatecall_count": 2,
    "untrusted_delegatecall_count": 2
}

medium

other

detector

CREATE/CREATE2 reachable

45

no

view

trace_id: 0x2a2111dd8104c758e0975c057b406982a7b1bb6b256120ea38f596c8b8efa3a2

validation_json

{
    "sink": "CREATE",
    "errors": 0,
    "status": "unknown",
    "attempts": 8,
    "trace_id": "0x2a2111dd8104c758e0975c057b406982a7b1bb6b256120ea38f596c8b8efa3a2",
    "confirmed": false,
    "trace_mode": "structLogs",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x3659cfe6",
            "selector": "0x3659cfe6",
            "calldata_variants": [
                "0x3659cfe6",
                "0x3659cfe60000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x4f1ef286",
            "selector": "0x4f1ef286",
            "calldata_variants": [
                "0x4f1ef286",
                "0x4f1ef2860000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x5c60da1b",
            "selector": "0x5c60da1b",
            "calldata_variants": [
                "0x5c60da1b",
                "0x5c60da1b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xf851a440",
            "selector": "0xf851a440",
            "calldata_variants": [
                "0xf851a440",
                "0xf851a4400000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "create_count": 0,
    "create2_count": 1
}