019b477e-a77e-729a-97ee-13a3cb2ec628
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 20259 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 20260 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 88281 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 88282 | capability.graph | complete | 1 / 3 | 1 week ago |
| 88283 | detector.run | complete | 1 / 3 | 1 week ago |
| 88284 | validation.fork | complete | 1 / 3 | 1 week ago |
| 113711 | report.consolidate | complete | 1 / 6 | 1 week ago |
| 113712 | tool.slither | failed | 2 / 2 | 1 week ago |
Traceback (most recent call last):
File "/var/www/tripwire/worker/worker.py", line 198, in main
payload = dispatch_job(job_type, job_id, job_meta, run_data, config, laravel_client)
File "/var/www/tripwire/worker/worker.py", line 114, in dispatch_job
return slither_run.run(job_id, job_meta, run_data, config, log, laravel_client)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/www/tripwire/worker/jobs/slither_run.py", line 1056, in run
solc_path, solc_meta = _prepare_solc(chosen_version, workspace)
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/www/tripwire/worker/jobs/slither_run.py", line 190, in _prepare_solc
raise RuntimeError(f"solc version {default_version} is too old for supported toolchain")
RuntimeError: solc version 0.2.1 is too old for supported toolchain
OpenAI Codex v0.118.0 (research preview) -------- workdir: /tmp/codex-x6p0ri7d model: gpt-5.4 provider: openai approval: never sandbox: read-only reasoning effort: high reasoning summaries: none session id: 019d5c9c-7d05-7670-be82-e039443d0031 -------- user You are a security auditor. Audit this Solidity codebase for exploitable vulnerabilities. Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation, oracle manipulation, accounting/invariant breaks, external call patterns, unchecked return values, and dangerous delegatecall. Scope rules: - You MUST fully read `AUDIT_BUNDLE.txt` before concluding. It contains the complete contents of all first-party Solidity sources in this workspace. - Treat `lib/` and `@openzeppelin/` as third-party dependencies; skip them unless there is a concrete misuse angle in first-party code. - If there are only dependency files and no first-party sources, set no_findings=true and explain in summary. Output MUST be valid JSON matching the provided schema. - If you find nothing meaningful: set no_findings=true and findings=[]. - Otherwise: set no_findings=false and include findings with severity/category/title and file/line locations when possible. Output constraints (IMPORTANT): - severity MUST be exactly one of: info, low, medium, high, critical (lowercase). - category MUST be exactly one of: access_control, reentrancy, math, oracle, upgradeability, auth, other. Keep summary short and concrete. warning: Codex could not find system bubblewrap on PATH. Please install bubblewrap with your package manager. Codex will use the vendored bubblewrap in the meantime. ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM. ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.
{
"codex": {
"ran_at": "2026-04-05T07:47:34.516085+00:00",
"returncode": 1
},
"project": {
"mode": "source",
"file_count": 1,
"import_count": 0,
"first_party_contracts_count": 1
},
"summary": null,
"no_findings": null,
"schema_version": 1
}
00000000: PUSH1 0x60 00000002: PUSH1 0x40 00000004: MSTORE 00000005: CALLDATASIZE 00000006: ISZERO 00000007: PUSH2 0x00b9 0000000a: JUMPI 0000000b: PUSH1 0xe0 0000000d: PUSH1 0x02 0000000f: EXP 00000010: PUSH1 0x00 00000012: CALLDATALOAD 00000013: DIV 00000014: PUSH4 0x09dfdc71 00000019: DUP2 0000001a: EQ 0000001b: PUSH2 0x00dd 0000001e: JUMPI 0000001f: DUP1 00000020: PUSH4 0x253459e3 00000025: EQ 00000026: PUSH2 0x011c 00000029: JUMPI 0000002a: DUP1 0000002b: PUSH4 0x4229616d 00000030: EQ 00000031: PUSH2 0x013d 00000034: JUMPI 00000035: DUP1 00000036: PUSH4 0x57d4021b 0000003b: EQ 0000003c: PUSH2 0x0178 0000003f: JUMPI 00000040: DUP1 00000041: PUSH4 0x67f809e9 00000046: EQ 00000047: PUSH2 0x01b7 0000004a: JUMPI 0000004b: DUP1 0000004c: PUSH4 0x686f2c90 00000051: EQ 00000052: PUSH2 0x01ce 00000055: JUMPI 00000056: DUP1 00000057: PUSH4 0x6fbaaa1e 0000005c: EQ 0000005d: PUSH2 0x01fa 00000060: JUMPI 00000061: DUP1 00000062: PUSH4 0x8a5fb3ca 00000067: EQ 00000068: PUSH2 0x022e 0000006b: JUMPI 0000006c: DUP1 0000006d: PUSH4 0x9dbc4f9b 00000072: EQ 00000073: PUSH2 0x0260 00000076: JUMPI 00000077: DUP1 00000078: PUSH4 0xa26dbf26 0000007d: EQ 0000007e: PUSH2 0x02ed 00000081: JUMPI 00000082: DUP1 00000083: PUSH4 0xa6f9dae1 00000088: EQ 00000089: PUSH2 0x02f5 0000008c: JUMPI 0000008d: DUP1 0000008e: PUSH4 0xb4022950 00000093: EQ 00000094: PUSH2 0x0328 00000097: JUMPI 00000098: DUP1 00000099: PUSH4 0xced92670 0000009e: EQ 0000009f: PUSH2 0x0366 000000a2: JUMPI 000000a3: DUP1 000000a4: PUSH4 0xd11f13df 000000a9: EQ 000000aa: PUSH2 0x039e 000000ad: JUMPI 000000ae: DUP1 000000af: PUSH4 0xfae14192 000000b4: EQ 000000b5: PUSH2 0x03ab 000000b8: JUMPI 000000b9: JUMPDEST 000000ba: PUSH2 0x03d6 000000bd: PUSH2 0x03d8 000000c0: PUSH1 0x00 000000c2: PUSH8 0x0de0b6b3a7640000 000000cb: CALLVALUE 000000cc: LT 000000cd: ISZERO 000000ce: PUSH2 0x0475 000000d1: JUMPI 000000d2: PUSH1 0x01 000000d4: DUP1 000000d5: SLOAD 000000d6: CALLVALUE 000000d7: ADD 000000d8: SWAP1 000000d9: SSTORE 000000da: JUMPDEST 000000db: POP 000000dc: JUMP 000000dd: JUMPDEST 000000de: PUSH1 0x40 000000e0: DUP1 000000e1: MLOAD 000000e2: PUSH1 0x20 000000e4: DUP2 000000e5: DUP2 000000e6: ADD 000000e7: DUP4 000000e8: MSTORE 000000e9: PUSH1 0x00 000000eb: DUP1 000000ec: DUP4 000000ed: MSTORE 000000ee: DUP4 000000ef: MLOAD 000000f0: SWAP1 000000f1: SLOAD 000000f2: PUSH2 0x0100 000000f5: DUP3 000000f6: ADD 000000f7: SWAP1 000000f8: SWAP5 000000f9: MSTORE 000000fa: PUSH1 0xca 000000fc: DUP1 000000fd: DUP3 000000fe: MSTORE 000000ff: PUSH2 0x03da 00000102: SWAP5 00000103: PUSH8 0x0de0b6b3a7640000 0000010c: SWAP1 0000010d: DIV 0000010e: SWAP4 0000010f: SWAP3 00000110: PUSH2 0x07d2 00000113: SWAP1 00000114: DUP4 00000115: ADD 00000116: CODECOPY 00000117: SWAP1 00000118: POP 00000119: SWAP1 0000011a: SWAP2 0000011b: JUMP 0000011c: JUMPDEST 0000011d: PUSH1 0x01 0000011f: SLOAD 00000120: PUSH8 0x0de0b6b3a7640000 00000129: SWAP1 0000012a: DIV 0000012b: JUMPDEST 0000012c: PUSH1 0x40 0000012e: DUP1 0000012f: MLOAD 00000130: SWAP2 00000131: DUP3 00000132: MSTORE 00000133: MLOAD 00000134: SWAP1 00000135: DUP2 00000136: SWAP1 00000137: SUB 00000138: PUSH1 0x20 0000013a: ADD 0000013b: SWAP1 0000013c: RETURN 0000013d: JUMPDEST 0000013e: PUSH2 0x03d6 00000141: PUSH1 0x04 00000143: CALLDATALOAD 00000144: PUSH1 0x05 00000146: SLOAD 00000147: PUSH1 0x00 00000149: SWAP1 0000014a: PUSH1 0x01 0000014c: PUSH1 0xa0 0000014e: PUSH1 0x02 00000150: EXP 00000151: SUB 00000152: SWAP1 00000153: DUP2 00000154: AND 00000155: CALLER 00000156: SWAP1 00000157: SWAP2 00000158: AND 00000159: EQ 0000015a: ISZERO 0000015b: PUSH2 0x0595 0000015e: JUMPI 0000015f: PUSH1 0x01 00000161: SLOAD 00000162: DUP2 00000163: EQ 00000164: DUP1 00000165: PUSH2 0x016e 00000168: JUMPI 00000169: POP 0000016a: PUSH1 0x64 0000016c: DUP3 0000016d: GT 0000016e: JUMPDEST 0000016f: ISZERO 00000170: PUSH2 0x055a 00000173: JUMPI 00000174: PUSH2 0x0002 00000177: JUMP 00000178: JUMPDEST 00000179: PUSH2 0x012b 0000017c: PUSH1 0x00 0000017e: PUSH8 0x0de0b6b3a7640000 00000187: PUSH1 0x06 00000189: PUSH1 0x00 0000018b: POP 0000018c: PUSH1 0x04 0000018e: PUSH1 0x00 00000190: POP 00000191: SLOAD 00000192: DUP2 00000193: SLOAD 00000194: DUP2 00000195: LT 00000196: ISZERO 00000197: PUSH2 0x0002 0000019a: JUMPI 0000019b: SWAP3 0000019c: MSTORE 0000019d: PUSH1 0x02 0000019f: SWAP2 000001a0: SWAP1 000001a1: SWAP2 000001a2: MUL 000001a3: PUSH1 0x00 000001a5: DUP1 000001a6: MLOAD 000001a7: PUSH1 0x20 000001a9: PUSH2 0x09bb 000001ac: DUP4 000001ad: CODECOPY 000001ae: DUP2 000001af: MLOAD 000001b0: SWAP2 000001b1: MSTORE 000001b2: ADD 000001b3: SLOAD 000001b4: DIV 000001b5: SWAP1 000001b6: JUMP 000001b7: JUMPDEST 000001b8: PUSH2 0x03d6 000001bb: PUSH1 0x05 000001bd: DUP1 000001be: SLOAD 000001bf: PUSH1 0x01 000001c1: PUSH1 0xa0 000001c3: PUSH1 0x02 000001c5: EXP 000001c6: SUB 000001c7: NOT 000001c8: AND 000001c9: CALLER 000001ca: OR 000001cb: SWAP1 000001cc: SSTORE 000001cd: JUMP 000001ce: JUMPDEST 000001cf: PUSH2 0x03d6 000001d2: JUMPDEST 000001d3: PUSH1 0x05 000001d5: SLOAD 000001d6: PUSH1 0x01 000001d8: PUSH1 0xa0 000001da: PUSH1 0x02 000001dc: EXP 000001dd: SUB 000001de: SWAP1 000001df: DUP2 000001e0: AND 000001e1: CALLER 000001e2: SWAP1 000001e3: SWAP2 000001e4: AND 000001e5: EQ 000001e6: ISZERO 000001e7: PUSH2 0x03d8 000001ea: JUMPI 000001eb: PUSH1 0x01 000001ed: SLOAD 000001ee: PUSH1 0x00 000001f0: EQ 000001f1: ISZERO 000001f2: PUSH2 0x04ef 000001f5: JUMPI 000001f6: PUSH2 0x0002 000001f9: JUMP 000001fa: JUMPDEST 000001fb: PUSH2 0x03da 000001fe: PUSH1 0x40 00000200: DUP1 00000201: MLOAD 00000202: PUSH1 0x20 00000204: DUP2 00000205: DUP2 00000206: ADD 00000207: DUP4 00000208: MSTORE 00000209: PUSH1 0x00 0000020b: DUP3 0000020c: MSTORE 0000020d: DUP3 0000020e: MLOAD 0000020f: PUSH1 0x03 00000211: SLOAD 00000212: PUSH2 0x0140 00000215: DUP3 00000216: ADD 00000217: SWAP1 00000218: SWAP5 00000219: MSTORE 0000021a: PUSH2 0x011f 0000021d: DUP1 0000021e: DUP3 0000021f: MSTORE 00000220: SWAP1 00000221: SWAP2 00000222: PUSH2 0x089c 00000225: SWAP1 00000226: DUP4 00000227: ADD 00000228: CODECOPY 00000229: SWAP1 0000022a: POP 0000022b: SWAP1 0000022c: SWAP2 0000022d: JUMP 0000022e: JUMPDEST 0000022f: PUSH2 0x03da 00000232: PUSH1 0x40 00000234: DUP1 00000235: MLOAD 00000236: PUSH1 0x20 00000238: DUP2 00000239: DUP2 0000023a: ADD 0000023b: DUP4 0000023c: MSTORE 0000023d: PUSH1 0x00 0000023f: DUP3 00000240: MSTORE 00000241: DUP3 00000242: MLOAD 00000243: PUSH1 0x02 00000245: SLOAD 00000246: PUSH1 0xc0 00000248: DUP3 00000249: ADD 0000024a: SWAP1 0000024b: SWAP5 0000024c: MSTORE 0000024d: PUSH1 0x84 0000024f: DUP1 00000250: DUP3 00000251: MSTORE 00000252: SWAP1 00000253: SWAP2 00000254: PUSH2 0x074e 00000257: SWAP1 00000258: DUP4 00000259: ADD 0000025a: CODECOPY 0000025b: SWAP1 0000025c: POP 0000025d: SWAP1 0000025e: SWAP2 0000025f: JUMP 00000260: JUMPDEST 00000261: PUSH2 0x044f 00000264: PUSH1 0x04 00000266: CALLDATALOAD 00000267: PUSH1 0x06 00000269: SLOAD 0000026a: PUSH1 0x00 0000026c: SWAP1 0000026d: DUP2 0000026e: SWAP1 0000026f: DUP4 00000270: GT 00000271: PUSH2 0x02e8 00000274: JUMPI 00000275: PUSH1 0x06 00000277: DUP1 00000278: SLOAD 00000279: DUP5 0000027a: SWAP1 0000027b: DUP2 0000027c: LT 0000027d: ISZERO 0000027e: PUSH2 0x0002 00000281: JUMPI 00000282: POP 00000283: DUP1 00000284: SLOAD 00000285: DUP2 00000286: DUP4 00000287: MSTORE 00000288: PUSH1 0x02 0000028a: DUP6 0000028b: MUL 0000028c: PUSH32 0xf652222313e28459528d920b65115c16c04f3efc82aaedc97be59f3f377c0d3f 000002ad: ADD 000002ae: SLOAD 000002af: PUSH1 0x01 000002b1: PUSH1 0xa0 000002b3: PUSH1 0x02 000002b5: EXP 000002b6: SUB 000002b7: AND 000002b8: SWAP4 000002b9: POP 000002ba: PUSH8 0x0de0b6b3a7640000 000002c3: SWAP2 000002c4: SWAP1 000002c5: DUP6 000002c6: SWAP1 000002c7: DUP2 000002c8: LT 000002c9: ISZERO 000002ca: PUSH2 0x0002 000002cd: JUMPI 000002ce: POP 000002cf: POP 000002d0: PUSH1 0x02 000002d2: DUP5 000002d3: MUL 000002d4: PUSH1 0x00 000002d6: DUP1 000002d7: MLOAD 000002d8: PUSH1 0x20 000002da: PUSH2 0x09bb 000002dd: DUP4 000002de: CODECOPY 000002df: DUP2 000002e0: MLOAD 000002e1: SWAP2 000002e2: MSTORE 000002e3: ADD 000002e4: SLOAD 000002e5: DIV 000002e6: SWAP1 000002e7: POP 000002e8: JUMPDEST 000002e9: SWAP2 000002ea: POP 000002eb: SWAP2 000002ec: JUMP 000002ed: JUMPDEST 000002ee: PUSH1 0x06 000002f0: SLOAD 000002f1: PUSH2 0x012b 000002f4: JUMP 000002f5: JUMPDEST 000002f6: PUSH2 0x03d6 000002f9: PUSH1 0x04 000002fb: CALLDATALOAD 000002fc: PUSH1 0x05 000002fe: SLOAD 000002ff: PUSH1 0x01 00000301: PUSH1 0xa0 00000303: PUSH1 0x02 00000305: EXP 00000306: SUB 00000307: SWAP1 00000308: DUP2 00000309: AND 0000030a: CALLER 0000030b: SWAP1 0000030c: SWAP2 0000030d: AND 0000030e: EQ 0000030f: ISZERO 00000310: PUSH2 0x00da 00000313: JUMPI 00000314: PUSH1 0x05 00000316: DUP1 00000317: SLOAD 00000318: PUSH1 0x01 0000031a: PUSH1 0xa0 0000031c: PUSH1 0x02 0000031e: EXP 0000031f: SUB 00000320: NOT 00000321: AND 00000322: DUP3 00000323: OR 00000324: SWAP1 00000325: SSTORE 00000326: POP 00000327: JUMP 00000328: JUMPDEST 00000329: PUSH2 0x03d6 0000032c: PUSH1 0x04 0000032e: CALLDATALOAD 0000032f: PUSH1 0x05 00000331: SLOAD 00000332: PUSH1 0x01 00000334: PUSH1 0xa0 00000336: PUSH1 0x02 00000338: EXP 00000339: SUB 0000033a: SWAP1 0000033b: DUP2 0000033c: AND 0000033d: CALLER 0000033e: SWAP1 0000033f: SWAP2 00000340: AND 00000341: EQ 00000342: ISZERO 00000343: PUSH2 0x00da 00000346: JUMPI 00000347: PUSH1 0x01 00000349: SLOAD 0000034a: PUSH8 0x0de0b6b3a7640000 00000353: SWAP2 00000354: SWAP1 00000355: SWAP2 00000356: MUL 00000357: SWAP1 00000358: DUP2 00000359: GT 0000035a: ISZERO 0000035b: PUSH2 0x0519 0000035e: JUMPI 0000035f: PUSH2 0x0519 00000362: PUSH2 0x01d2 00000365: JUMP 00000366: JUMPDEST 00000367: PUSH2 0x03d6 0000036a: PUSH1 0x04 0000036c: CALLDATALOAD 0000036d: PUSH1 0x05 0000036f: SLOAD 00000370: PUSH1 0x01 00000372: PUSH1 0xa0 00000374: PUSH1 0x02 00000376: EXP 00000377: SUB 00000378: SWAP1 00000379: DUP2 0000037a: AND 0000037b: CALLER 0000037c: SWAP1 0000037d: SWAP2 0000037e: AND 0000037f: EQ 00000380: ISZERO 00000381: PUSH2 0x00da 00000384: JUMPI 00000385: PUSH2 0x012c 00000388: DUP2 00000389: GT 0000038a: DUP1 0000038b: PUSH2 0x0394 0000038e: JUMPI 0000038f: POP 00000390: PUSH1 0x78 00000392: DUP2 00000393: LT 00000394: JUMPDEST 00000395: ISZERO 00000396: PUSH2 0x0599 00000399: JUMPI 0000039a: PUSH2 0x0002 0000039d: JUMP 0000039e: JUMPDEST 0000039f: PUSH1 0x06 000003a1: SLOAD 000003a2: PUSH1 0x04 000003a4: SLOAD 000003a5: SWAP1 000003a6: SUB 000003a7: PUSH2 0x012b 000003aa: JUMP 000003ab: JUMPDEST 000003ac: PUSH2 0x03d6 000003af: PUSH1 0x04 000003b1: CALLDATALOAD 000003b2: PUSH1 0x05 000003b4: SLOAD 000003b5: CALLER 000003b6: PUSH1 0x01 000003b8: PUSH1 0xa0 000003ba: PUSH1 0x02 000003bc: EXP 000003bd: SUB 000003be: SWAP1 000003bf: DUP2 000003c0: AND 000003c1: SWAP2 000003c2: AND 000003c3: EQ 000003c4: ISZERO 000003c5: PUSH2 0x00da 000003c8: JUMPI 000003c9: PUSH1 0x0a 000003cb: DUP2 000003cc: GT 000003cd: ISZERO 000003ce: PUSH2 0x059e 000003d1: JUMPI 000003d2: PUSH2 0x0002 000003d5: JUMP 000003d6: JUMPDEST 000003d7: STOP 000003d8: JUMPDEST 000003d9: JUMP 000003da: JUMPDEST 000003db: PUSH1 0x40 000003dd: MLOAD 000003de: DUP1 000003df: DUP4 000003e0: DUP2 000003e1: MSTORE 000003e2: PUSH1 0x20 000003e4: ADD 000003e5: DUP1 000003e6: PUSH1 0x20 000003e8: ADD 000003e9: DUP3 000003ea: DUP2 000003eb: SUB 000003ec: DUP3 000003ed: MSTORE 000003ee: DUP4 000003ef: DUP2 000003f0: DUP2 000003f1: MLOAD 000003f2: DUP2 000003f3: MSTORE 000003f4: PUSH1 0x20 000003f6: ADD 000003f7: SWAP2 000003f8: POP 000003f9: DUP1 000003fa: MLOAD 000003fb: SWAP1 000003fc: PUSH1 0x20 000003fe: ADD 000003ff: SWAP1 00000400: DUP1 00000401: DUP4 00000402: DUP4 00000403: DUP3 00000404: SWAP1 00000405: PUSH1 0x00 00000407: PUSH1 0x04 00000409: PUSH1 0x20 0000040b: DUP5 0000040c: PUSH1 0x1f 0000040e: ADD 0000040f: DIV 00000410: PUSH1 0x0f 00000412: MUL 00000413: PUSH1 0x03 00000415: ADD 00000416: CALL 00000417: POP 00000418: SWAP1 00000419: POP 0000041a: SWAP1 0000041b: DUP2 0000041c: ADD 0000041d: SWAP1 0000041e: PUSH1 0x1f 00000420: AND 00000421: DUP1 00000422: ISZERO 00000423: PUSH2 0x0440 00000426: JUMPI 00000427: DUP1 00000428: DUP3 00000429: SUB 0000042a: DUP1 0000042b: MLOAD 0000042c: PUSH1 0x01 0000042e: DUP4 0000042f: PUSH1 0x20 00000431: SUB 00000432: PUSH2 0x0100 00000435: EXP 00000436: SUB 00000437: NOT 00000438: AND 00000439: DUP2 0000043a: MSTORE 0000043b: PUSH1 0x20 0000043d: ADD 0000043e: SWAP2 0000043f: POP 00000440: JUMPDEST 00000441: POP 00000442: SWAP4 00000443: POP 00000444: POP 00000445: POP 00000446: POP 00000447: PUSH1 0x40 00000449: MLOAD 0000044a: DUP1 0000044b: SWAP2 0000044c: SUB 0000044d: SWAP1 0000044e: RETURN 0000044f: JUMPDEST 00000450: PUSH1 0x40 00000452: MLOAD 00000453: DUP1 00000454: DUP4 00000455: PUSH1 0x01 00000457: PUSH1 0xa0 00000459: PUSH1 0x02 0000045b: EXP 0000045c: SUB 0000045d: AND 0000045e: DUP2 0000045f: MSTORE 00000460: PUSH1 0x20 00000462: ADD 00000463: DUP3 00000464: DUP2 00000465: MSTORE 00000466: PUSH1 0x20 00000468: ADD 00000469: SWAP3 0000046a: POP 0000046b: POP 0000046c: POP 0000046d: PUSH1 0x40 0000046f: MLOAD 00000470: DUP1 00000471: SWAP2 00000472: SUB 00000473: SWAP1 00000474: RETURN 00000475: JUMPDEST 00000476: POP 00000477: PUSH1 0x02 00000479: SLOAD 0000047a: PUSH9 0x02b5e3af16b1880000 00000484: CALLVALUE 00000485: LT 00000486: PUSH2 0x048e 00000489: JUMPI 0000048a: PUSH1 0x02 0000048c: SWAP1 0000048d: DIV 0000048e: JUMPDEST 0000048f: PUSH2 0x00da 00000492: DUP2 00000493: PUSH1 0x00 00000495: PUSH1 0x06 00000497: PUSH1 0x00 00000499: POP 0000049a: DUP1 0000049b: SLOAD 0000049c: DUP1 0000049d: PUSH1 0x01 0000049f: ADD 000004a0: DUP3 000004a1: DUP2 000004a2: DUP2 000004a3: SLOAD 000004a4: DUP2 000004a5: DUP4 000004a6: SSTORE 000004a7: DUP2 000004a8: DUP2 000004a9: ISZERO 000004aa: GT 000004ab: PUSH2 0x05a3 000004ae: JUMPI 000004af: PUSH1 0x02 000004b1: MUL 000004b2: DUP2 000004b3: PUSH1 0x02 000004b5: MUL 000004b6: DUP4 000004b7: PUSH1 0x00 000004b9: MSTORE 000004ba: PUSH1 0x20 000004bc: PUSH1 0x00 000004be: KECCAK256 000004bf: SWAP2 000004c0: DUP3 000004c1: ADD 000004c2: SWAP2 000004c3: ADD 000004c4: PUSH2 0x05a3 000004c7: SWAP2 000004c8: SWAP1 000004c9: JUMPDEST 000004ca: DUP1 000004cb: DUP3 000004cc: GT 000004cd: ISZERO 000004ce: PUSH2 0x0607 000004d1: JUMPI 000004d2: DUP1 000004d3: SLOAD 000004d4: PUSH1 0x01 000004d6: PUSH1 0xa0 000004d8: PUSH1 0x02 000004da: EXP 000004db: SUB 000004dc: NOT 000004dd: AND 000004de: DUP2 000004df: SSTORE 000004e0: PUSH1 0x00 000004e2: PUSH1 0x01 000004e4: SWAP2 000004e5: SWAP1 000004e6: SWAP2 000004e7: ADD 000004e8: SWAP1 000004e9: DUP2 000004ea: SSTORE 000004eb: PUSH2 0x04c9 000004ee: JUMP 000004ef: JUMPDEST 000004f0: PUSH1 0x01 000004f2: SLOAD 000004f3: PUSH1 0x05 000004f5: SLOAD 000004f6: PUSH1 0x40 000004f8: MLOAD 000004f9: PUSH1 0x01 000004fb: PUSH1 0xa0 000004fd: PUSH1 0x02 000004ff: EXP 00000500: SUB 00000501: SWAP2 00000502: SWAP1 00000503: SWAP2 00000504: AND 00000505: SWAP2 00000506: PUSH1 0x00 00000508: SWAP2 00000509: DUP3 0000050a: DUP2 0000050b: DUP2 0000050c: DUP2 0000050d: DUP6 0000050e: DUP9 0000050f: DUP4 00000510: CALL 00000511: POP 00000512: POP 00000513: POP 00000514: PUSH1 0x01 00000516: SSTORE 00000517: POP 00000518: JUMP 00000519: JUMPDEST 0000051a: PUSH1 0x01 0000051c: SLOAD 0000051d: PUSH1 0x00 0000051f: EQ 00000520: ISZERO 00000521: PUSH2 0x0529 00000524: JUMPI 00000525: PUSH2 0x0002 00000528: JUMP 00000529: JUMPDEST 0000052a: PUSH1 0x05 0000052c: SLOAD 0000052d: PUSH1 0x40 0000052f: MLOAD 00000530: PUSH1 0x01 00000532: PUSH1 0xa0 00000534: PUSH1 0x02 00000536: EXP 00000537: SUB 00000538: SWAP2 00000539: SWAP1 0000053a: SWAP2 0000053b: AND 0000053c: SWAP1 0000053d: PUSH1 0x00 0000053f: SWAP1 00000540: DUP4 00000541: SWAP1 00000542: DUP3 00000543: DUP2 00000544: DUP2 00000545: DUP2 00000546: DUP6 00000547: DUP9 00000548: DUP4 00000549: CALL 0000054a: POP 0000054b: POP 0000054c: PUSH1 0x01 0000054e: DUP1 0000054f: SLOAD 00000550: SWAP2 00000551: SWAP1 00000552: SWAP2 00000553: SUB 00000554: SWAP1 00000555: SSTORE 00000556: POP 00000557: POP 00000558: POP 00000559: JUMP 0000055a: JUMPDEST 0000055b: POP 0000055c: PUSH1 0x01 0000055e: SLOAD 0000055f: PUSH1 0x05 00000561: SLOAD 00000562: PUSH1 0x40 00000564: MLOAD 00000565: PUSH1 0x64 00000567: SWAP1 00000568: SWAP3 00000569: DIV 0000056a: DUP4 0000056b: MUL 0000056c: SWAP2 0000056d: PUSH1 0x01 0000056f: PUSH1 0xa0 00000571: PUSH1 0x02 00000573: EXP 00000574: SUB 00000575: SWAP2 00000576: SWAP1 00000577: SWAP2 00000578: AND 00000579: SWAP1 0000057a: PUSH1 0x00 0000057c: SWAP1 0000057d: DUP4 0000057e: SWAP1 0000057f: DUP3 00000580: DUP2 00000581: DUP2 00000582: DUP2 00000583: DUP6 00000584: DUP9 00000585: DUP4 00000586: CALL 00000587: POP 00000588: POP 00000589: PUSH1 0x01 0000058b: DUP1 0000058c: SLOAD 0000058d: SWAP2 0000058e: SWAP1 0000058f: SWAP2 00000590: SUB 00000591: SWAP1 00000592: SSTORE 00000593: POP 00000594: POP 00000595: JUMPDEST 00000596: POP 00000597: POP 00000598: JUMP 00000599: JUMPDEST 0000059a: PUSH1 0x03 0000059c: SSTORE 0000059d: JUMP 0000059e: JUMPDEST 0000059f: PUSH1 0x02 000005a1: SSTORE 000005a2: JUMP 000005a3: JUMPDEST 000005a4: POP 000005a5: POP 000005a6: POP 000005a7: SWAP2 000005a8: SWAP1 000005a9: SWAP1 000005aa: PUSH1 0x00 000005ac: MSTORE 000005ad: PUSH1 0x20 000005af: PUSH1 0x00 000005b1: KECCAK256 000005b2: SWAP1 000005b3: PUSH1 0x02 000005b5: MUL 000005b6: ADD 000005b7: PUSH1 0x00 000005b9: POP 000005ba: PUSH1 0x40 000005bc: DUP1 000005bd: MLOAD 000005be: DUP1 000005bf: DUP3 000005c0: ADD 000005c1: SWAP1 000005c2: SWAP2 000005c3: MSTORE 000005c4: CALLER 000005c5: DUP1 000005c6: DUP3 000005c7: MSTORE 000005c8: PUSH1 0x03 000005ca: SLOAD 000005cb: PUSH1 0x64 000005cd: CALLVALUE 000005ce: SWAP2 000005cf: SWAP1 000005d0: SWAP2 000005d1: MUL 000005d2: DIV 000005d3: PUSH1 0x20 000005d5: SWAP3 000005d6: SWAP1 000005d7: SWAP3 000005d8: ADD 000005d9: DUP3 000005da: SWAP1 000005db: MSTORE 000005dc: DUP3 000005dd: SLOAD 000005de: PUSH1 0x01 000005e0: PUSH1 0xa0 000005e2: PUSH1 0x02 000005e4: EXP 000005e5: SUB 000005e6: NOT 000005e7: AND 000005e8: OR 000005e9: DUP3 000005ea: SSTORE 000005eb: PUSH1 0x01 000005ed: SWAP2 000005ee: SWAP1 000005ef: SWAP2 000005f0: ADD 000005f1: SSTORE 000005f2: POP 000005f3: PUSH1 0x06 000005f5: SLOAD 000005f6: PUSH1 0x0a 000005f8: EQ 000005f9: ISZERO 000005fa: PUSH2 0x060b 000005fd: JUMPI 000005fe: PUSH1 0xc8 00000600: PUSH1 0x03 00000602: SSTORE 00000603: PUSH2 0x061c 00000606: JUMP 00000607: JUMPDEST 00000608: POP 00000609: SWAP1 0000060a: JUMP 0000060b: JUMPDEST 0000060c: PUSH1 0x06 0000060e: SLOAD 0000060f: PUSH1 0x19 00000611: EQ 00000612: ISZERO 00000613: PUSH2 0x061c 00000616: JUMPI 00000617: PUSH1 0x96 00000619: PUSH1 0x03 0000061b: SSTORE 0000061c: JUMPDEST 0000061d: PUSH1 0x00 0000061f: DUP1 00000620: SLOAD 00000621: PUSH1 0x64 00000623: DUP5 00000624: DUP2 00000625: SUB 00000626: CALLVALUE 00000627: SWAP1 00000628: DUP2 00000629: MUL 0000062a: DUP3 0000062b: SWAP1 0000062c: DIV 0000062d: SWAP1 0000062e: SWAP3 0000062f: ADD 00000630: SWAP1 00000631: SWAP3 00000632: SSTORE 00000633: PUSH1 0x01 00000635: DUP1 00000636: SLOAD 00000637: SWAP2 00000638: DUP6 00000639: MUL 0000063a: SWAP3 0000063b: SWAP1 0000063c: SWAP3 0000063d: DIV 0000063e: ADD 0000063f: SWAP1 00000640: SSTORE 00000641: JUMPDEST 00000642: PUSH1 0x04 00000644: SLOAD 00000645: PUSH1 0x06 00000647: DUP1 00000648: SLOAD 00000649: SWAP1 0000064a: SWAP2 0000064b: SWAP1 0000064c: DUP2 0000064d: LT 0000064e: ISZERO 0000064f: PUSH2 0x0002 00000652: JUMPI 00000653: PUSH1 0x00 00000655: SWAP2 00000656: DUP3 00000657: MSTORE 00000658: PUSH1 0x02 0000065a: MUL 0000065b: PUSH32 0xf652222313e28459528d920b65115c16c04f3efc82aaedc97be59f3f377c0d3f 0000067c: ADD 0000067d: SWAP1 0000067e: POP 0000067f: PUSH1 0x01 00000681: ADD 00000682: SLOAD 00000683: PUSH1 0x00 00000685: SLOAD 00000686: GT 00000687: ISZERO 00000688: PUSH2 0x0595 0000068b: JUMPI 0000068c: PUSH1 0x04 0000068e: SLOAD 0000068f: PUSH1 0x06 00000691: DUP1 00000692: SLOAD 00000693: SWAP1 00000694: SWAP2 00000695: SWAP1 00000696: DUP2 00000697: LT 00000698: ISZERO 00000699: PUSH2 0x0002 0000069c: JUMPI 0000069d: PUSH1 0x02 0000069f: MUL 000006a0: PUSH1 0x00 000006a2: DUP1 000006a3: MLOAD 000006a4: PUSH1 0x20 000006a6: PUSH2 0x09bb 000006a9: DUP4 000006aa: CODECOPY 000006ab: DUP2 000006ac: MLOAD 000006ad: SWAP2 000006ae: MSTORE 000006af: ADD 000006b0: SLOAD 000006b1: PUSH1 0x04 000006b3: SLOAD 000006b4: DUP3 000006b5: SLOAD 000006b6: SWAP2 000006b7: SWAP4 000006b8: POP 000006b9: SWAP1 000006ba: DUP2 000006bb: LT 000006bc: ISZERO 000006bd: PUSH2 0x0002 000006c0: JUMPI 000006c1: PUSH1 0x02 000006c3: MUL 000006c4: PUSH32 0xf652222313e28459528d920b65115c16c04f3efc82aaedc97be59f3f377c0d3f 000006e5: ADD 000006e6: SLOAD 000006e7: PUSH1 0x40 000006e9: MLOAD 000006ea: PUSH1 0x01 000006ec: PUSH1 0xa0 000006ee: PUSH1 0x02 000006f0: EXP 000006f1: SUB 000006f2: SWAP2 000006f3: SWAP1 000006f4: SWAP2 000006f5: AND 000006f6: SWAP2 000006f7: POP 000006f8: PUSH1 0x00 000006fa: SWAP1 000006fb: DUP4 000006fc: SWAP1 000006fd: DUP3 000006fe: DUP2 000006ff: DUP2 00000700: DUP2 00000701: DUP6 00000702: DUP9 00000703: DUP4 00000704: CALL 00000705: SWAP4 00000706: POP 00000707: POP 00000708: POP 00000709: POP 0000070a: POP 0000070b: PUSH1 0x06 0000070d: PUSH1 0x00 0000070f: POP 00000710: PUSH1 0x04 00000712: PUSH1 0x00 00000714: POP 00000715: SLOAD 00000716: DUP2 00000717: SLOAD 00000718: DUP2 00000719: LT 0000071a: ISZERO 0000071b: PUSH2 0x0002 0000071e: JUMPI 0000071f: PUSH1 0x00 00000721: SWAP2 00000722: DUP3 00000723: MSTORE 00000724: DUP2 00000725: SLOAD 00000726: PUSH1 0x02 00000728: SWAP2 00000729: SWAP1 0000072a: SWAP2 0000072b: MUL 0000072c: PUSH1 0x00 0000072e: DUP1 0000072f: MLOAD 00000730: PUSH1 0x20 00000732: PUSH2 0x09bb 00000735: DUP4 00000736: CODECOPY 00000737: DUP2 00000738: MLOAD 00000739: SWAP2 0000073a: MSTORE 0000073b: ADD 0000073c: SLOAD 0000073d: SWAP1 0000073e: SUB 0000073f: SWAP1 00000740: SSTORE 00000741: PUSH1 0x04 00000743: DUP1 00000744: SLOAD 00000745: PUSH1 0x01 00000747: ADD 00000748: SWAP1 00000749: SSTORE 0000074a: PUSH2 0x0641 0000074d: JUMP 0000074e: MSTORE8 0000074f: PUSH9 0x6f776e20696e202520 00000759: PUSH7 0x6f726d2e204665 00000761: PUSH6 0x206973206861 00000768: PUSH13 0x766564283530252920666f7220 00000776: PUSH2 0x6d6f 00000779: PUSH22 0x6e747320657175616c206f7220677265617465722074 00000790: PUSH9 0x616e20353020657468 0000079a: PUSH6 0x72732e202846 000007a1: PUSH6 0x65206d617920 000007a8: PUSH4 0x68616e67 000007ad: PUSH6 0x2c2062757420 000007b4: PUSH10 0x73206361707065642074 000007bf: PUSH16 0x2061206d6178696d756d206f66203130 000007d0: UNKNOWN(0x25) 000007d1: UNKNOWN(0x29) 000007d2: COINBASE 000007d3: PUSH13 0x6c2062616c616e63652076616c 000007e1: PUSH22 0x657320617265206d6561737572656420696e20457468 000007f8: PUSH6 0x72732c206e6f 000007ff: PUSH21 0x6520746861742064756520746f206e6f2064656369 00000815: PUSH14 0x616c20706c6163696e672c207468 00000824: PUSH6 0x73652076616c 0000082b: PUSH22 0x65732073686f7720757020617320696e746567657273 00000842: KECCAK256 00000843: PUSH16 0x6e6c792c2077697468696e2074686520 00000854: PUSH4 0x6f6e7472 00000859: PUSH2 0x6374 0000085c: KECCAK256 0000085d: PUSH10 0x7473656c6620796f7520 00000868: PUSH24 0x696c6c206765742074686520657861637420646563696d61 00000881: PUSH13 0x2076616c756520796f75206172 0000088f: PUSH6 0x20737570706f 00000896: PUSH20 0x656420746f54686973206d756c7469706c696572 000008ab: KECCAK256 000008ac: PUSH2 0x7070 000008af: PUSH13 0x69657320746f20796f75206173 000008bd: KECCAK256 000008be: PUSH20 0x6f6f6e206173207472616e73616374696f6e2069 000008d3: PUSH20 0x2072656365697665642c206d6179206265206c6f 000008e8: PUSH24 0x6572656420746f2068617374656e207061796f757473206f 00000901: PUSH19 0x20696e63726561736564206966207061796f75 00000915: PUSH21 0x7320617265206661737420656e6f7567682e204475 0000092b: PUSH6 0x20746f206e6f 00000932: KECCAK256 00000933: PUSH7 0x6c6f6174206f72 0000093b: KECCAK256 0000093c: PUSH5 0x6563696d61 00000942: PUSH13 0x732c206d756c7469706c696572 00000950: KECCAK256 00000951: PUSH10 0x73207831303020666f72 0000095c: KECCAK256 0000095d: PUSH2 0x2066 00000960: PUSH19 0x616374696f6e616c206d756c7469706c696572 00000974: KECCAK256 00000975: PUSH6 0x2e672e203235 0000097c: ADDRESS 0000097d: KECCAK256 0000097e: PUSH10 0x732061637475616c6c79 00000989: KECCAK256 0000098a: PUSH2 0x2032 0000098d: UNKNOWN(0x2E) 0000098e: CALLDATALOAD 0000098f: PUSH25 0x206d756c7469706c6965722e20436170706564206174203378 000009a9: KECCAK256 000009aa: PUSH14 0x617820616e6420312e3278206d69 000009b9: PUSH15 0x2ef652222313e28459528d920b6511 000009c9: TLOAD 000009ca: AND 000009cb: UNKNOWN(0xC0) 000009cc: UNKNOWN(0x4F) 000009cd: RETURNDATACOPY 000009ce: UNKNOWN(0xFC) 000009cf: DUP3 000009d0: UNKNOWN(0xAA) 000009d1: UNKNOWN(0xED) 000009d2: UNKNOWN(0xC9) 000009d3: PUSH28
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | other | detector | Untrusted CALL target/value reachable | 60 | yes | yes |
viewtrace_id: 0xbefe7c29314ee34ce1c3f6a3d9024dd465427dad7624cab430249770d3e123fd
call_targets:
0x0000000000000000000000000000000000000004, 0xe82719202e5965cf5d9b6673b7503a3b92de20be
target_varies:
yes
classification:
target_varies
validation_json{
"sink": "CALL",
"errors": 0,
"status": "confirmed",
"attempts": 1,
"trace_id": "0xbefe7c29314ee34ce1c3f6a3d9024dd465427dad7624cab430249770d3e123fd",
"confirmed": true,
"trace_mode": "callTracer",
"call_targets": [
"0x0000000000000000000000000000000000000004",
"0xe82719202e5965cf5d9b6673b7503a3b92de20be"
],
"matched_probe": null,
"target_varies": true,
"classification": "target_varies"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x09dfdc71",
"selector": "0x09dfdc71",
"calldata_variants": [
"0x09dfdc71",
"0x09dfdc710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x253459e3",
"selector": "0x253459e3",
"calldata_variants": [
"0x253459e3",
"0x253459e30000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4229616d",
"selector": "0x4229616d",
"calldata_variants": [
"0x4229616d",
"0x4229616d0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x57d4021b",
"selector": "0x57d4021b",
"calldata_variants": [
"0x57d4021b",
"0x57d4021b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x67f809e9",
"selector": "0x67f809e9",
"calldata_variants": [
"0x67f809e9",
"0x67f809e90000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x686f2c90",
"selector": "0x686f2c90",
"calldata_variants": [
"0x686f2c90",
"0x686f2c900000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6fbaaa1e",
"selector": "0x6fbaaa1e",
"calldata_variants": [
"0x6fbaaa1e",
"0x6fbaaa1e0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8a5fb3ca",
"selector": "0x8a5fb3ca",
"calldata_variants": [
"0x8a5fb3ca",
"0x8a5fb3ca0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1046,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1296,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1353,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 5,
"guards_detected": [],
"untrusted_call_count": 5
}
|
| high | other | detector | ETH value transfer possible | 55 | yes | yes |
viewtrace_id: 0xbefe7c29314ee34ce1c3f6a3d9024dd465427dad7624cab430249770d3e123fd
call_targets:
0x0000000000000000000000000000000000000004, 0xe82719202e5965cf5d9b6673b7503a3b92de20be
target_varies:
yes
classification:
target_varies
validation_json{
"sink": "CALL",
"errors": 0,
"status": "confirmed",
"attempts": 1,
"trace_id": "0xbefe7c29314ee34ce1c3f6a3d9024dd465427dad7624cab430249770d3e123fd",
"confirmed": true,
"trace_mode": "callTracer",
"call_targets": [
"0x0000000000000000000000000000000000000004",
"0xe82719202e5965cf5d9b6673b7503a3b92de20be"
],
"matched_probe": null,
"target_varies": true,
"classification": "target_varies"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x09dfdc71",
"selector": "0x09dfdc71",
"calldata_variants": [
"0x09dfdc71",
"0x09dfdc710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x253459e3",
"selector": "0x253459e3",
"calldata_variants": [
"0x253459e3",
"0x253459e30000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4229616d",
"selector": "0x4229616d",
"calldata_variants": [
"0x4229616d",
"0x4229616d0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x57d4021b",
"selector": "0x57d4021b",
"calldata_variants": [
"0x57d4021b",
"0x57d4021b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x67f809e9",
"selector": "0x67f809e9",
"calldata_variants": [
"0x67f809e9",
"0x67f809e90000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x686f2c90",
"selector": "0x686f2c90",
"calldata_variants": [
"0x686f2c90",
"0x686f2c900000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6fbaaa1e",
"selector": "0x6fbaaa1e",
"calldata_variants": [
"0x6fbaaa1e",
"0x6fbaaa1e0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8a5fb3ca",
"selector": "0x8a5fb3ca",
"calldata_variants": [
"0x8a5fb3ca",
"0x8a5fb3ca0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1046,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1296,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1353,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 5,
"guards_detected": []
}
|