Analysis Run

019b3844-b573-737b-94dc-fadc7bb7b1b8

complete

Chain ID

1

Address

0xcf3efcf158da8017549c963541ba43c08cbe3163

Block Number

—

Created

Fri, Dec 19, 2025 8:19 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Bytecode only

Review Backing

Not yet

Best current signal

Untrusted CALL target/value reachable

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
19109	artifact.fetch	complete	1 / 3	3 months ago
19110	tool.cast_disasm	complete	1 / 3	3 months ago
62674	analysis.bundle	complete	1 / 3	1 week ago
62675	capability.graph	complete	1 / 3	1 week ago
62676	detector.run	complete	1 / 3	1 week ago
62677	validation.fork	complete	1 / 3	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

0

Selfdestruct

0

CREATE2

2

CALL-family (heavy)

3

EXT*/BALANCE

2

Total opcodes

1141

Flags

create_opcodes_present

View cast disassembly output

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: ISZERO
0000000a: PUSH2 0x0012
0000000d: JUMPI
0000000e: PUSH1 0x00
00000010: DUP1
00000011: REVERT
00000012: JUMPDEST
00000013: PUSH1 0x00
00000015: CALLDATALOAD
00000016: PUSH1 0xe0
00000018: SHR
00000019: DUP1
0000001a: PUSH4 0x13af4035
0000001f: EQ
00000020: PUSH2 0x0062
00000023: JUMPI
00000024: DUP1
00000025: PUSH4 0x2e1a7d4d
0000002a: EQ
0000002b: PUSH2 0x005d
0000002e: JUMPI
0000002f: DUP1
00000030: PUSH4 0x8da5cb5b
00000035: EQ
00000036: PUSH2 0x0058
00000039: JUMPI
0000003a: DUP1
0000003b: PUSH4 0x9e281a98
00000040: EQ
00000041: PUSH2 0x0053
00000044: JUMPI
00000045: PUSH4 0xd0e30db0
0000004a: SUB
0000004b: PUSH2 0x0088
0000004e: JUMPI
0000004f: PUSH2 0x01b6
00000052: JUMP
00000053: JUMPDEST
00000054: PUSH2 0x019d
00000057: JUMP
00000058: JUMPDEST
00000059: PUSH2 0x0145
0000005c: JUMP
0000005d: JUMPDEST
0000005e: PUSH2 0x00f8
00000061: JUMP
00000062: JUMPDEST
00000063: PUSH2 0x00b0
00000066: JUMP
00000067: JUMPDEST
00000068: PUSH1 0x01
0000006a: PUSH1 0x01
0000006c: PUSH1 0xa0
0000006e: SHL
0000006f: SUB
00000070: AND
00000071: SWAP1
00000072: JUMP
00000073: JUMPDEST
00000074: SWAP1
00000075: JUMP
00000076: JUMPDEST
00000077: PUSH1 0x01
00000079: PUSH1 0x01
0000007b: PUSH1 0xa0
0000007d: SHL
0000007e: SUB
0000007f: DUP2
00000080: AND
00000081: JUMPDEST
00000082: SUB
00000083: PUSH2 0x0088
00000086: JUMPI
00000087: JUMP
00000088: JUMPDEST
00000089: PUSH1 0x00
0000008b: DUP1
0000008c: REVERT
0000008d: JUMPDEST
0000008e: SWAP1
0000008f: POP
00000090: CALLDATALOAD
00000091: SWAP1
00000092: PUSH2 0x009a
00000095: DUP3
00000096: PUSH2 0x0076
00000099: JUMP
0000009a: JUMPDEST
0000009b: JUMP
0000009c: JUMPDEST
0000009d: SWAP1
0000009e: PUSH1 0x20
000000a0: DUP3
000000a1: DUP3
000000a2: SUB
000000a3: SLT
000000a4: PUSH2 0x0088
000000a7: JUMPI
000000a8: PUSH2 0x0073
000000ab: SWAP2
000000ac: PUSH2 0x008d
000000af: JUMP
000000b0: JUMPDEST
000000b1: CALLVALUE
000000b2: PUSH2 0x0088
000000b5: JUMPI
000000b6: PUSH2 0x00c8
000000b9: PUSH2 0x00c3
000000bc: CALLDATASIZE
000000bd: PUSH1 0x04
000000bf: PUSH2 0x009c
000000c2: JUMP
000000c3: JUMPDEST
000000c4: PUSH2 0x034d
000000c7: JUMP
000000c8: JUMPDEST
000000c9: PUSH1 0x40
000000cb: MLOAD
000000cc: STOP
000000cd: JUMPDEST
000000ce: SUB
000000cf: SWAP1
000000d0: RETURN
000000d1: JUMPDEST
000000d2: DUP1
000000d3: PUSH2 0x0081
000000d6: JUMP
000000d7: JUMPDEST
000000d8: SWAP1
000000d9: POP
000000da: CALLDATALOAD
000000db: SWAP1
000000dc: PUSH2 0x009a
000000df: DUP3
000000e0: PUSH2 0x00d1
000000e3: JUMP
000000e4: JUMPDEST
000000e5: SWAP1
000000e6: PUSH1 0x20
000000e8: DUP3
000000e9: DUP3
000000ea: SUB
000000eb: SLT
000000ec: PUSH2 0x0088
000000ef: JUMPI
000000f0: PUSH2 0x0073
000000f3: SWAP2
000000f4: PUSH2 0x00d7
000000f7: JUMP
000000f8: JUMPDEST
000000f9: CALLVALUE
000000fa: PUSH2 0x0088
000000fd: JUMPI
000000fe: PUSH2 0x00c8
00000101: PUSH2 0x010b
00000104: CALLDATASIZE
00000105: PUSH1 0x04
00000107: PUSH2 0x00e4
0000010a: JUMP
0000010b: JUMPDEST
0000010c: PUSH2 0x0508
0000010f: JUMP
00000110: JUMPDEST
00000111: PUSH1 0x00
00000113: SWAP2
00000114: SUB
00000115: SLT
00000116: PUSH2 0x0088
00000119: JUMPI
0000011a: JUMP
0000011b: JUMPDEST
0000011c: PUSH2 0x0073
0000011f: SWAP2
00000120: PUSH1 0x08
00000122: MUL
00000123: SHR
00000124: PUSH1 0x01
00000126: PUSH1 0x01
00000128: PUSH1 0xa0
0000012a: SHL
0000012b: SUB
0000012c: AND
0000012d: SWAP1
0000012e: JUMP
0000012f: JUMPDEST
00000130: SWAP1
00000131: PUSH2 0x0073
00000134: SWAP2
00000135: SLOAD
00000136: PUSH2 0x011b
00000139: JUMP
0000013a: JUMPDEST
0000013b: PUSH2 0x0073
0000013e: PUSH1 0x00
00000140: DUP1
00000141: PUSH2 0x012f
00000144: JUMP
00000145: JUMPDEST
00000146: CALLVALUE
00000147: PUSH2 0x0088
0000014a: JUMPI
0000014b: PUSH2 0x0155
0000014e: CALLDATASIZE
0000014f: PUSH1 0x04
00000151: PUSH2 0x0110
00000154: JUMP
00000155: JUMPDEST
00000156: PUSH2 0x00cd
00000159: PUSH2 0x0160
0000015c: PUSH2 0x013a
0000015f: JUMP
00000160: JUMPDEST
00000161: PUSH1 0x40
00000163: MLOAD
00000164: SWAP2
00000165: DUP3
00000166: SWAP2
00000167: DUP3
00000168: PUSH1 0x01
0000016a: PUSH1 0x01
0000016c: PUSH1 0xa0
0000016e: SHL
0000016f: SUB
00000170: SWAP1
00000171: SWAP2
00000172: AND
00000173: DUP2
00000174: MSTORE
00000175: PUSH1 0x20
00000177: ADD
00000178: SWAP1
00000179: JUMP
0000017a: JUMPDEST
0000017b: SWAP2
0000017c: SWAP1
0000017d: PUSH1 0x40
0000017f: DUP4
00000180: DUP3
00000181: SUB
00000182: SLT
00000183: PUSH2 0x0088
00000186: JUMPI
00000187: PUSH2 0x0073
0000018a: SWAP1
0000018b: PUSH2 0x0194
0000018e: DUP2
0000018f: DUP6
00000190: PUSH2 0x008d
00000193: JUMP
00000194: JUMPDEST
00000195: SWAP4
00000196: PUSH1 0x20
00000198: ADD
00000199: PUSH2 0x00d7
0000019c: JUMP
0000019d: JUMPDEST
0000019e: CALLVALUE
0000019f: PUSH2 0x0088
000001a2: JUMPI
000001a3: PUSH2 0x00c8
000001a6: PUSH2 0x01b0
000001a9: CALLDATASIZE
000001aa: PUSH1 0x04
000001ac: PUSH2 0x017a
000001af: JUMP
000001b0: JUMPDEST
000001b1: SWAP1
000001b2: PUSH2 0x0542
000001b5: JUMP
000001b6: JUMPDEST
000001b7: PUSH2 0x00c8
000001ba: CALLDATASIZE
000001bb: PUSH1 0x04
000001bd: PUSH2 0x0110
000001c0: JUMP
000001c1: JUMPDEST
000001c2: PUSH2 0x0073
000001c5: SWAP1
000001c6: PUSH2 0x0067
000001c9: JUMP
000001ca: JUMPDEST
000001cb: PUSH2 0x0073
000001ce: SWAP1
000001cf: SLOAD
000001d0: PUSH2 0x01c1
000001d3: JUMP
000001d4: JUMPDEST
000001d5: CALLER
000001d6: PUSH2 0x01f2
000001d9: PUSH2 0x01e5
000001dc: PUSH2 0x0067
000001df: PUSH1 0x00
000001e1: PUSH2 0x01ca
000001e4: JUMP
000001e5: JUMPDEST
000001e6: SWAP2
000001e7: PUSH1 0x01
000001e9: PUSH1 0x01
000001eb: PUSH1 0xa0
000001ed: SHL
000001ee: SUB
000001ef: AND
000001f0: SWAP1
000001f1: JUMP
000001f2: JUMPDEST
000001f3: SUB
000001f4: PUSH2 0x0200
000001f7: JUMPI
000001f8: PUSH2 0x009a
000001fb: SWAP1
000001fc: PUSH2 0x02b5
000001ff: JUMP
00000200: JUMPDEST
00000201: PUSH1 0x40
00000203: MLOAD
00000204: PUSH32 0x2eff610600000000000000000000000000000000000000000000000000000000
00000225: DUP2
00000226: MSTORE
00000227: PUSH1 0x04
00000229: SWAP1
0000022a: REVERT
0000022b: JUMPDEST
0000022c: SUB
0000022d: SWAP1
0000022e: REVERT
0000022f: JUMPDEST
00000230: PUSH2 0x0067
00000233: PUSH2 0x0073
00000236: PUSH2 0x0073
00000239: SWAP3
0000023a: SWAP1
0000023b: JUMP
0000023c: JUMPDEST
0000023d: PUSH2 0x0073
00000240: SWAP1
00000241: PUSH2 0x022f
00000244: JUMP
00000245: JUMPDEST
00000246: PUSH2 0x0067
00000249: PUSH2 0x0073
0000024c: PUSH2 0x0073
0000024f: SWAP3
00000250: PUSH1 0x01
00000252: PUSH1 0x01
00000254: PUSH1 0xa0
00000256: SHL
00000257: SUB
00000258: AND
00000259: SWAP1
0000025a: JUMP
0000025b: JUMPDEST
0000025c: PUSH2 0x0073
0000025f: SWAP1
00000260: PUSH2 0x0245
00000263: JUMP
00000264: JUMPDEST
00000265: PUSH2 0x0073
00000268: SWAP1
00000269: PUSH2 0x025b
0000026c: JUMP
0000026d: JUMPDEST
0000026e: SWAP1
0000026f: PUSH2 0x027d
00000272: PUSH2 0x0073
00000275: PUSH2 0x02b1
00000278: SWAP3
00000279: PUSH2 0x0264
0000027c: JUMP
0000027d: JUMPDEST
0000027e: DUP3
0000027f: SLOAD
00000280: PUSH32 0xffffffffffffffffffffffff0000000000000000000000000000000000000000
000002a1: AND
000002a2: PUSH1 0x01
000002a4: PUSH1 0x01
000002a6: PUSH1 0xa0
000002a8: SHL
000002a9: SUB
000002aa: SWAP2
000002ab: SWAP1
000002ac: SWAP2
000002ad: AND
000002ae: OR
000002af: SWAP1
000002b0: JUMP
000002b1: JUMPDEST
000002b2: SWAP1
000002b3: SSTORE
000002b4: JUMP
000002b5: JUMPDEST
000002b6: PUSH1 0x00
000002b8: PUSH2 0x02c3
000002bb: PUSH2 0x0067
000002be: DUP3
000002bf: PUSH2 0x023c
000002c2: JUMP
000002c3: JUMPDEST
000002c4: PUSH1 0x01
000002c6: PUSH1 0x01
000002c8: PUSH1 0xa0
000002ca: SHL
000002cb: SUB
000002cc: DUP4
000002cd: AND
000002ce: EQ
000002cf: PUSH2 0x0322
000002d2: JUMPI
000002d3: DUP2
000002d4: PUSH2 0x02dc
000002d7: SWAP2
000002d8: PUSH2 0x026d
000002db: JUMP
000002dc: JUMPDEST
000002dd: PUSH32 0xea0d4ab0fdff03aed012b3235c41d5b311cbc2625ee3067ca0f0f73b77d65421
000002fe: SWAP1
000002ff: PUSH2 0x0310
00000302: PUSH2 0x030a
00000305: CALLER
00000306: PUSH2 0x0264
00000309: JUMP
0000030a: JUMPDEST
0000030b: SWAP2
0000030c: PUSH2 0x0264
0000030f: JUMP
00000310: JUMPDEST
00000311: SWAP2
00000312: PUSH2 0x031a
00000315: PUSH1 0x40
00000317: MLOAD
00000318: SWAP1
00000319: JUMP
0000031a: JUMPDEST
0000031b: DUP1
0000031c: DUP1
0000031d: JUMPDEST
0000031e: SUB
0000031f: SWAP1
00000320: LOG3
00000321: JUMP
00000322: JUMPDEST
00000323: PUSH1 0x40
00000325: MLOAD
00000326: PUSH32 0x3d75384600000000000000000000000000000000000000000000000000000000
00000347: DUP2
00000348: MSTORE
00000349: PUSH1 0x04
0000034b: SWAP1
0000034c: REVERT
0000034d: JUMPDEST
0000034e: PUSH2 0x009a
00000351: SWAP1
00000352: PUSH2 0x01d4
00000355: JUMP
00000356: JUMPDEST
00000357: CALLER
00000358: PUSH2 0x0367
0000035b: PUSH2 0x01e5
0000035e: PUSH2 0x0067
00000361: PUSH1 0x00
00000363: PUSH2 0x01ca
00000366: JUMP
00000367: JUMPDEST
00000368: SUB
00000369: PUSH2 0x0200
0000036c: JUMPI
0000036d: PUSH2 0x009a
00000370: SWAP1
00000371: PUSH2 0x043f
00000374: JUMP
00000375: JUMPDEST
00000376: PUSH2 0x0073
00000379: PUSH2 0x0073
0000037c: PUSH2 0x0073
0000037f: SWAP3
00000380: SWAP1
00000381: JUMP
00000382: JUMPDEST
00000383: PUSH32 0x4e487b7100000000000000000000000000000000000000000000000000000000
000003a4: PUSH1 0x00
000003a6: MSTORE
000003a7: PUSH1 0x41
000003a9: PUSH1 0x04
000003ab: MSTORE
000003ac: PUSH1 0x24
000003ae: PUSH1 0x00
000003b0: REVERT
000003b1: JUMPDEST
000003b2: SWAP1
000003b3: PUSH1 0x1f
000003b5: ADD
000003b6: PUSH1 0x1f
000003b8: NOT
000003b9: AND
000003ba: DUP2
000003bb: ADD
000003bc: SWAP1
000003bd: DUP2
000003be: LT
000003bf: PUSH8 0xffffffffffffffff
000003c8: DUP3
000003c9: GT
000003ca: OR
000003cb: PUSH2 0x03d3
000003ce: JUMPI
000003cf: PUSH1 0x40
000003d1: MSTORE
000003d2: JUMP
000003d3: JUMPDEST
000003d4: PUSH2 0x0382
000003d7: JUMP
000003d8: JUMPDEST
000003d9: SWAP1
000003da: PUSH2 0x009a
000003dd: PUSH2 0x03e5
000003e0: PUSH1 0x40
000003e2: MLOAD
000003e3: SWAP1
000003e4: JUMP
000003e5: JUMPDEST
000003e6: SWAP3
000003e7: DUP4
000003e8: PUSH2 0x03b1
000003eb: JUMP
000003ec: JUMPDEST
000003ed: PUSH8 0xffffffffffffffff
000003f6: DUP2
000003f7: GT
000003f8: PUSH2 0x03d3
000003fb: JUMPI
000003fc: PUSH1 0x20
000003fe: SWAP1
000003ff: PUSH1 0x1f
00000401: ADD
00000402: PUSH1 0x1f
00000404: NOT
00000405: AND
00000406: ADD
00000407: SWAP1
00000408: JUMP
00000409: JUMPDEST
0000040a: SWAP1
0000040b: PUSH2 0x041b
0000040e: PUSH2 0x0416
00000411: DUP4
00000412: PUSH2 0x03ec
00000415: JUMP
00000416: JUMPDEST
00000417: PUSH2 0x03d8
0000041a: JUMP
0000041b: JUMPDEST
0000041c: SWAP2
0000041d: DUP3
0000041e: MSTORE
0000041f: JUMP
00000420: JUMPDEST
00000421: RETURNDATASIZE
00000422: ISZERO
00000423: PUSH2 0x043a
00000426: JUMPI
00000427: PUSH2 0x042f
0000042a: RETURNDATASIZE
0000042b: PUSH2 0x0409
0000042e: JUMP
0000042f: JUMPDEST
00000430: SWAP1
00000431: RETURNDATASIZE
00000432: PUSH1 0x00
00000434: PUSH1 0x20
00000436: DUP5
00000437: ADD
00000438: RETURNDATACOPY
00000439: JUMP
0000043a: JUMPDEST
0000043b: PUSH1 0x60
0000043d: SWAP1
0000043e: JUMP
0000043f: JUMPDEST
00000440: PUSH1 0x00
00000442: PUSH2 0x044a
00000445: DUP2
00000446: PUSH2 0x0375
00000449: JUMP
0000044a: JUMPDEST
0000044b: DUP3
0000044c: GT
0000044d: PUSH2 0x0454
00000450: JUMPI
00000451: POP
00000452: POP
00000453: JUMP
00000454: JUMPDEST
00000455: CALLER
00000456: SWAP1
00000457: PUSH2 0x0483
0000045a: DUP2
0000045b: DUP1
0000045c: PUSH2 0x046c
0000045f: PUSH2 0x0467
00000462: DUP7
00000463: PUSH2 0x0264
00000466: JUMP
00000467: JUMPDEST
00000468: PUSH2 0x0264
0000046b: JUMP
0000046c: JUMPDEST
0000046d: PUSH1 0x40
0000046f: MLOAD
00000470: PUSH1 0x00
00000472: SWAP2
00000473: DUP9
00000474: SWAP1
00000475: GAS
00000476: CALL
00000477: PUSH2 0x047e
0000047a: PUSH2 0x0420
0000047d: JUMP
0000047e: JUMPDEST
0000047f: POP
00000480: ISZERO
00000481: SWAP1
00000482: JUMP
00000483: JUMPDEST
00000484: PUSH2 0x04dd
00000487: JUMPI
00000488: PUSH2 0x0490
0000048b: SWAP1
0000048c: PUSH2 0x023c
0000048f: JUMP
00000490: JUMPDEST
00000491: PUSH2 0x031d
00000494: PUSH2 0x04c6
00000497: PUSH2 0x04c0
0000049a: PUSH32 0x8210728e7c071f615b840ee026032693858fbcd5e5359e67e438c890f59e5620
000004bb: SWAP4
000004bc: PUSH2 0x0264
000004bf: JUMP
000004c0: JUMPDEST
000004c1: SWAP4
000004c2: PUSH2 0x0264
000004c5: JUMP
000004c6: JUMPDEST
000004c7: SWAP4
000004c8: PUSH2 0x04d0
000004cb: PUSH1 0x40
000004cd: MLOAD
000004ce: SWAP1
000004cf: JUMP
000004d0: JUMPDEST
000004d1: SWAP2
000004d2: DUP3
000004d3: SWAP2
000004d4: DUP3
000004d5: SWAP1
000004d6: DUP2
000004d7: MSTORE
000004d8: PUSH1 0x20
000004da: ADD
000004db: SWAP1
000004dc: JUMP
000004dd: JUMPDEST
000004de: PUSH1 0x40
000004e0: MLOAD
000004e1: PUSH32 0x3ff9ac2100000000000000000000000000000000000000000000000000000000
00000502: DUP2
00000503: MSTORE
00000504: PUSH1 0x04
00000506: SWAP1
00000507: REVERT
00000508: JUMPDEST
00000509: PUSH2 0x009a
0000050c: SWAP1
0000050d: PUSH2 0x0356
00000510: JUMP
00000511: JUMPDEST
00000512: SWAP1
00000513: CALLER
00000514: PUSH2 0x0523
00000517: PUSH2 0x01e5
0000051a: PUSH2 0x0067
0000051d: PUSH1 0x00
0000051f: PUSH2 0x01ca
00000522: JUMP
00000523: JUMPDEST
00000524: SUB
00000525: PUSH2 0x0200
00000528: JUMPI
00000529: PUSH2 0x009a
0000052c: SWAP2
0000052d: PUSH2 0x0535
00000530: DUP2
00000531: PUSH2 0x0264
00000534: JUMP
00000535: JUMPDEST
00000536: SWAP1
00000537: PUSH2 0x0490
0000053a: DUP4
0000053b: CALLER
0000053c: DUP1
0000053d: SWAP5
0000053e: PUSH2 0x05a7
00000541: JUMP
00000542: JUMPDEST
00000543: SWAP1
00000544: PUSH2 0x009a
00000547: SWAP2
00000548: PUSH2 0x0511
0000054b: JUMP
0000054c: JUMPDEST
0000054d: PUSH2 0x0565
00000550: PUSH2 0x055f
00000553: PUSH2 0x0073
00000556: SWAP3
00000557: PUSH4 0xffffffff
0000055c: AND
0000055d: SWAP1
0000055e: JUMP
0000055f: JUMPDEST
00000560: PUSH1 0xe0
00000562: SHL
00000563: SWAP1
00000564: JUMP
00000565: JUMPDEST
00000566: PUSH32 0xffffffff00000000000000000000000000000000000000000000000000000000
00000587: AND
00000588: SWAP1
00000589: JUMP
0000058a: JUMPDEST
0000058b: PUSH1 0x01
0000058d: PUSH1 0x01
0000058f: PUSH1 0xa0
00000591: SHL
00000592: SUB
00000593: SWAP1
00000594: SWAP2
00000595: AND
00000596: DUP2
00000597: MSTORE
00000598: PUSH1 0x40
0000059a: DUP2
0000059b: ADD
0000059c: SWAP3
0000059d: SWAP2
0000059e: PUSH2 0x009a
000005a1: SWAP2
000005a2: PUSH1 0x20
000005a4: ADD
000005a5: MSTORE
000005a6: JUMP
000005a7: JUMPDEST
000005a8: PUSH2 0x05ea
000005ab: PUSH1 0x04
000005ad: SWAP3
000005ae: PUSH2 0x05db
000005b1: PUSH2 0x009a
000005b4: SWAP6
000005b5: PUSH2 0x05c1
000005b8: PUSH4 0xa9059cbb
000005bd: PUSH2 0x054c
000005c0: JUMP
000005c1: JUMPDEST
000005c2: SWAP3
000005c3: PUSH2 0x05cb
000005c6: PUSH1 0x40
000005c8: MLOAD
000005c9: SWAP1
000005ca: JUMP
000005cb: JUMPDEST
000005cc: SWAP7
000005cd: DUP8
000005ce: SWAP5
000005cf: PUSH1 0x20
000005d1: DUP7
000005d2: ADD
000005d3: SWAP1
000005d4: DUP2
000005d5: MSTORE
000005d6: ADD
000005d7: PUSH2 0x058a
000005da: JUMP
000005db: JUMPDEST
000005dc: PUSH1 0x20
000005de: DUP3
000005df: ADD
000005e0: DUP2
000005e1: SUB
000005e2: DUP3
000005e3: MSTORE
000005e4: SUB
000005e5: DUP4
000005e6: PUSH2 0x03b1
000005e9: JUMP
000005ea: JUMPDEST
000005eb: PUSH2 0x0618
000005ee: JUMP
000005ef: JUMPDEST
000005f0: DUP1
000005f1: ISZERO
000005f2: ISZERO
000005f3: PUSH2 0x0081
000005f6: JUMP
000005f7: JUMPDEST
000005f8: SWAP1
000005f9: POP
000005fa: MLOAD
000005fb: SWAP1
000005fc: PUSH2 0x009a
000005ff: DUP3
00000600: PUSH2 0x05ef
00000603: JUMP
00000604: JUMPDEST
00000605: SWAP1
00000606: PUSH1 0x20
00000608: DUP3
00000609: DUP3
0000060a: SUB
0000060b: SLT
0000060c: PUSH2 0x0088
0000060f: JUMPI
00000610: PUSH2 0x0073
00000613: SWAP2
00000614: PUSH2 0x05f7
00000617: JUMP
00000618: JUMPDEST
00000619: PUSH2 0x0624
0000061c: PUSH2 0x062b
0000061f: SWAP2
00000620: PUSH2 0x0264
00000623: JUMP
00000624: JUMPDEST
00000625: SWAP2
00000626: DUP3
00000627: PUSH2 0x06c1
0000062a: JUMP
0000062b: JUMPDEST
0000062c: DUP1
0000062d: MLOAD
0000062e: PUSH2 0x063e
00000631: PUSH2 0x063a
00000634: PUSH1 0x00
00000636: PUSH2 0x0375
00000639: JUMP
0000063a: JUMPDEST
0000063b: SWAP2
0000063c: SWAP1
0000063d: JUMP
0000063e: JUMPDEST
0000063f: EQ
00000640: ISZERO
00000641: SWAP1
00000642: DUP2
00000643: PUSH2 0x0699
00000646: JUMPI
00000647: JUMPDEST
00000648: POP
00000649: PUSH2 0x064f
0000064c: JUMPI
0000064d: POP
0000064e: JUMP
0000064f: JUMPDEST
00000650: PUSH2 0x022b
00000653: SWAP1
00000654: PUSH2 0x065c
00000657: PUSH1 0x40
00000659: MLOAD
0000065a: SWAP1
0000065b: JUMP
0000065c: JUMPDEST
0000065d: SWAP2
0000065e: DUP3
0000065f: SWAP2
00000660: PUSH32 0x5274afe700000000000000000000000000000000000000000000000000000000
00000681: DUP4
00000682: MSTORE
00000683: PUSH1 0x04
00000685: DUP4
00000686: ADD
00000687: PUSH1 0x01
00000689: PUSH1 0x01
0000068b: PUSH1 0xa0
0000068d: SHL
0000068e: SUB
0000068f: SWAP1
00000690: SWAP2
00000691: AND
00000692: DUP2
00000693: MSTORE
00000694: PUSH1 0x20
00000696: ADD
00000697: SWAP1
00000698: JUMP
00000699: JUMPDEST
0000069a: PUSH2 0x06bb
0000069d: SWAP2
0000069e: POP
0000069f: DUP1
000006a0: PUSH1 0x20
000006a2: PUSH2 0x06ac
000006a5: PUSH2 0x06b7
000006a8: SWAP4
000006a9: MLOAD
000006aa: SWAP1
000006ab: JUMP
000006ac: JUMPDEST
000006ad: DUP2
000006ae: DUP4
000006af: ADD
000006b0: ADD
000006b1: SWAP2
000006b2: ADD
000006b3: PUSH2 0x0604
000006b6: JUMP
000006b7: JUMPDEST
000006b8: ISZERO
000006b9: SWAP1
000006ba: JUMP
000006bb: JUMPDEST
000006bc: CODESIZE
000006bd: PUSH2 0x0647
000006c0: JUMP
000006c1: JUMPDEST
000006c2: PUSH2 0x0073
000006c5: SWAP2
000006c6: PUSH2 0x06cf
000006c9: PUSH1 0x00
000006cb: PUSH2 0x0375
000006ce: JUMP
000006cf: JUMPDEST
000006d0: SWAP1
000006d1: PUSH2 0x06d9
000006d4: ADDRESS
000006d5: PUSH2 0x0264
000006d8: JUMP
000006d9: JUMPDEST
000006da: DUP3
000006db: DUP2
000006dc: BALANCE
000006dd: LT
000006de: PUSH2 0x0703
000006e1: JUMPI
000006e2: POP
000006e3: PUSH1 0x00
000006e5: PUSH2 0x0073
000006e8: SWAP4
000006e9: SWAP3
000006ea: DUP3
000006eb: PUSH1 0x20
000006ed: DUP4
000006ee: SWAP5
000006ef: ADD
000006f0: SWAP1
000006f1: MLOAD
000006f2: SWAP2
000006f3: DUP6
000006f4: GAS
000006f5: CALL
000006f6: PUSH2 0x06fd
000006f9: PUSH2 0x0420
000006fc: JUMP
000006fd: JUMPDEST
000006fe: SWAP2
000006ff: PUSH2 0x074d
00000702: JUMP
00000703: JUMPDEST
00000704: PUSH2 0x022b
00000707: SWAP1
00000708: PUSH2 0x0710
0000070b: PUSH1 0x40
0000070d: MLOAD
0000070e: SWAP1
0000070f: JUMP
00000710: JUMPDEST
00000711: SWAP2
00000712: DUP3
00000713: SWAP2
00000714: PUSH32 0xcd78605900000000000000000000000000000000000000000000000000000000
00000735: DUP4
00000736: MSTORE
00000737: PUSH1 0x04
00000739: DUP4
0000073a: ADD
0000073b: PUSH1 0x01
0000073d: PUSH1 0x01
0000073f: PUSH1 0xa0
00000741: SHL
00000742: SUB
00000743: SWAP1
00000744: SWAP2
00000745: AND
00000746: DUP2
00000747: MSTORE
00000748: PUSH1 0x20
0000074a: ADD
0000074b: SWAP1
0000074c: JUMP
0000074d: JUMPDEST
0000074e: SWAP1
0000074f: PUSH2 0x0758
00000752: JUMPI
00000753: POP
00000754: PUSH2 0x07db
00000757: JUMP
00000758: JUMPDEST
00000759: DUP2
0000075a: MLOAD
0000075b: PUSH1 0x00
0000075d: SWAP1
0000075e: PUSH2 0x0769
00000761: PUSH2 0x063a
00000764: DUP4
00000765: PUSH2 0x0375
00000768: JUMP
00000769: JUMPDEST
0000076a: EQ
0000076b: SWAP1
0000076c: DUP2
0000076d: PUSH2 0x07c4
00000770: JUMPI
00000771: JUMPDEST
00000772: POP
00000773: PUSH2 0x077a
00000776: JUMPI
00000777: POP
00000778: SWAP1
00000779: JUMP
0000077a: JUMPDEST
0000077b: PUSH2 0x022b
0000077e: SWAP1
0000077f: PUSH2 0x0787
00000782: PUSH1 0x40
00000784: MLOAD
00000785: SWAP1
00000786: JUMP
00000787: JUMPDEST
00000788: SWAP2
00000789: DUP3
0000078a: SWAP2
0000078b: PUSH32 0x9996b31500000000000000000000000000000000000000000000000000000000
000007ac: DUP4
000007ad: MSTORE
000007ae: PUSH1 0x04
000007b0: DUP4
000007b1: ADD
000007b2: PUSH1 0x01
000007b4: PUSH1 0x01
000007b6: PUSH1 0xa0
000007b8: SHL
000007b9: SUB
000007ba: SWAP1
000007bb: SWAP2
000007bc: AND
000007bd: DUP2
000007be: MSTORE
000007bf: PUSH1 0x20
000007c1: ADD
000007c2: SWAP1
000007c3: JUMP
000007c4: JUMPDEST
000007c5: SWAP1
000007c6: POP
000007c7: PUSH2 0x07d4
000007ca: PUSH2 0x063a
000007cd: DUP4
000007ce: EXTCODESIZE
000007cf: SWAP3
000007d0: PUSH2 0x0375
000007d3: JUMP
000007d4: JUMPDEST
000007d5: EQ
000007d6: CODESIZE
000007d7: PUSH2 0x0771
000007da: JUMP
000007db: JUMPDEST
000007dc: DUP1
000007dd: MLOAD
000007de: PUSH2 0x07ea
000007e1: PUSH2 0x063a
000007e4: PUSH1 0x00
000007e6: PUSH2 0x0375
000007e9: JUMP
000007ea: JUMPDEST
000007eb: GT
000007ec: ISZERO
000007ed: PUSH2 0x07f8
000007f0: JUMPI
000007f1: DUP1
000007f2: MLOAD
000007f3: SWAP1
000007f4: PUSH1 0x20
000007f6: ADD
000007f7: REVERT
000007f8: JUMPDEST
000007f9: PUSH1 0x40
000007fb: MLOAD
000007fc: PUSH32 0x1425ea4200000000000000000000000000000000000000000000000000000000
0000081d: DUP2
0000081e: MSTORE
0000081f: PUSH1 0x04
00000821: SWAP1
00000822: REVERT
00000823: INVALID
00000824: LOG2
00000825: PUSH5 0x6970667358
0000082b: UNKNOWN(0x22)
0000082c: SLT
0000082d: KECCAK256
0000082e: PUSH5 0xd07f88c6ae
00000834: SWAP16
00000835: UNKNOWN(0xDC)
00000836: STATICCALL
00000837: UNKNOWN(0x1F)
00000838: SWAP14
00000839: UNKNOWN(0xB5)
0000083a: UNKNOWN(0xE3)
0000083b: CREATE2
0000083c: MOD
0000083d: SWAP12
0000083e: XOR
0000083f: CREATE2
00000840: UNKNOWN(0xE1)
00000841: EXP
00000842: SLOAD
00000843: UNKNOWN(0x0E)
00000844: SELFBALANCE
00000845: UNKNOWN(0x2E)
00000846: PUSH3 0xe46c4b
0000084a: UNKNOWN(0xC7)
0000084b: SWAP7
0000084c: GT
0000084d: UNKNOWN(0x27)
0000084e: PUSH5 0x736f6c6343
00000854: STOP
00000855: ADDMOD
00000856: EQ
00000857: STOP
00000858: CALLER

View stderr

Warning: This is a nightly build of Foundry. It is recommended to use the latest stable version. To mute this warning set `FOUNDRY_DISABLE_NIGHTLY_WARNING` in your environment.

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	other	detector	Untrusted CALL target/value reachable	60	no	no	view trace_id: 0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b call_targets: 0xcf3efcf158da8017549c963541ba43c08cbe3163 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0xcf3efcf158da8017549c963541ba43c08cbe3163" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x13af4035", "selector": "0x13af4035", "calldata_variants": [ "0x13af4035", "0x13af40350000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x2e1a7d4d", "selector": "0x2e1a7d4d", "calldata_variants": [ "0x2e1a7d4d", "0x2e1a7d4d0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x9e281a98", "selector": "0x9e281a98", "calldata_variants": [ "0x9e281a98", "0x9e281a980000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 1142, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" }, { "pc": 1781, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "call_count": 2, "guards_detected": [], "untrusted_call_count": 2 }
high	other	detector	ETH value transfer possible	55	no	no	view trace_id: 0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b call_targets: 0xcf3efcf158da8017549c963541ba43c08cbe3163 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0xcf3efcf158da8017549c963541ba43c08cbe3163" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x13af4035", "selector": "0x13af4035", "calldata_variants": [ "0x13af4035", "0x13af40350000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x2e1a7d4d", "selector": "0x2e1a7d4d", "calldata_variants": [ "0x2e1a7d4d", "0x2e1a7d4d0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x9e281a98", "selector": "0x9e281a98", "calldata_variants": [ "0x9e281a98", "0x9e281a980000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 1142, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" }, { "pc": 1781, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "eth_value_calls": 2, "guards_detected": [] }
medium	other	detector	CREATE/CREATE2 reachable	45	no	no	view trace_id: 0x41a6d2dd6d8175c46890816b595fb1830f8db95ddc7c13dcfe5a157838ac7e52 validation_json { "sink": "CREATE", "errors": 0, "status": "unknown", "attempts": 8, "trace_id": "0x41a6d2dd6d8175c46890816b595fb1830f8db95ddc7c13dcfe5a157838ac7e52", "confirmed": false, "trace_mode": "structLogs", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "no_sink" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x13af4035", "selector": "0x13af4035", "calldata_variants": [ "0x13af4035", "0x13af40350000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x2e1a7d4d", "selector": "0x2e1a7d4d", "calldata_variants": [ "0x2e1a7d4d", "0x2e1a7d4d0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x9e281a98", "selector": "0x9e281a98", "calldata_variants": [ "0x9e281a98", "0x9e281a980000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "create_count": 0, "create2_count": 2 }

Severity

Category

Tool

Title

Confidence

Validated

Confirmed

Details

high

other

detector

Untrusted CALL target/value reachable

60

no

view

trace_id: 0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b

call_targets: 0xcf3efcf158da8017549c963541ba43c08cbe3163

target_varies: no

classification: constant_target

validation_json

{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xcf3efcf158da8017549c963541ba43c08cbe3163"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x2e1a7d4d",
            "selector": "0x2e1a7d4d",
            "calldata_variants": [
                "0x2e1a7d4d",
                "0x2e1a7d4d0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9e281a98",
            "selector": "0x9e281a98",
            "calldata_variants": [
                "0x9e281a98",
                "0x9e281a980000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "examples": [
        {
            "pc": 1142,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1781,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 2,
    "guards_detected": [],
    "untrusted_call_count": 2
}

high

other

detector

ETH value transfer possible

55

no

view

trace_id: 0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b

call_targets: 0xcf3efcf158da8017549c963541ba43c08cbe3163

target_varies: no

classification: constant_target

validation_json

{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x3d44bf0b51830a2b6f6a3807798296bf2d53251804b0ed43d4d3274c5983aa9b",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xcf3efcf158da8017549c963541ba43c08cbe3163"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x2e1a7d4d",
            "selector": "0x2e1a7d4d",
            "calldata_variants": [
                "0x2e1a7d4d",
                "0x2e1a7d4d0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9e281a98",
            "selector": "0x9e281a98",
            "calldata_variants": [
                "0x9e281a98",
                "0x9e281a980000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "examples": [
        {
            "pc": 1142,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1781,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 2,
    "guards_detected": []
}

medium

other

detector

CREATE/CREATE2 reachable

45

no

view

trace_id: 0x41a6d2dd6d8175c46890816b595fb1830f8db95ddc7c13dcfe5a157838ac7e52

validation_json

{
    "sink": "CREATE",
    "errors": 0,
    "status": "unknown",
    "attempts": 8,
    "trace_id": "0x41a6d2dd6d8175c46890816b595fb1830f8db95ddc7c13dcfe5a157838ac7e52",
    "confirmed": false,
    "trace_mode": "structLogs",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x2e1a7d4d",
            "selector": "0x2e1a7d4d",
            "calldata_variants": [
                "0x2e1a7d4d",
                "0x2e1a7d4d0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9e281a98",
            "selector": "0x9e281a98",
            "calldata_variants": [
                "0x9e281a98",
                "0x9e281a980000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "create_count": 0,
    "create2_count": 2
}