019b477e-b636-7307-8e80-e97430301667
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 23079 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 23080 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 66742 | analysis.bundle | complete | 1 / 3 | 2 weeks ago |
| 66743 | capability.graph | complete | 1 / 3 | 2 weeks ago |
| 66744 | detector.run | complete | 1 / 3 | 2 weeks ago |
| 66745 | validation.fork | complete | 1 / 3 | 2 weeks ago |
No slither job recorded yet.
No codex job recorded yet.
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x001e 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH1 0xe0 00000012: SHR 00000013: DUP1 00000014: PUSH4 0x7de7edef 00000019: EQ 0000001a: PUSH2 0x005d 0000001d: JUMPI 0000001e: JUMPDEST 0000001f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000034: PUSH1 0x00 00000036: SLOAD 00000037: AND 00000038: CALLDATASIZE 00000039: PUSH1 0x00 0000003b: DUP1 0000003c: CALLDATACOPY 0000003d: PUSH1 0x00 0000003f: DUP1 00000040: CALLDATASIZE 00000041: PUSH1 0x00 00000043: DUP5 00000044: GAS 00000045: DELEGATECALL 00000046: RETURNDATASIZE 00000047: PUSH1 0x00 00000049: DUP1 0000004a: RETURNDATACOPY 0000004b: PUSH1 0x00 0000004d: DUP2 0000004e: EQ 0000004f: ISZERO 00000050: PUSH2 0x0058 00000053: JUMPI 00000054: RETURNDATASIZE 00000055: PUSH1 0x00 00000057: REVERT 00000058: JUMPDEST 00000059: RETURNDATASIZE 0000005a: PUSH1 0x00 0000005c: RETURN 0000005d: JUMPDEST 0000005e: CALLVALUE 0000005f: DUP1 00000060: ISZERO 00000061: PUSH2 0x0069 00000064: JUMPI 00000065: PUSH1 0x00 00000067: DUP1 00000068: REVERT 00000069: JUMPDEST 0000006a: POP 0000006b: PUSH2 0x00ac 0000006e: PUSH1 0x04 00000070: DUP1 00000071: CALLDATASIZE 00000072: SUB 00000073: PUSH1 0x20 00000075: DUP2 00000076: LT 00000077: ISZERO 00000078: PUSH2 0x0080 0000007b: JUMPI 0000007c: PUSH1 0x00 0000007e: DUP1 0000007f: REVERT 00000080: JUMPDEST 00000081: DUP2 00000082: ADD 00000083: SWAP1 00000084: DUP1 00000085: DUP1 00000086: CALLDATALOAD 00000087: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000009c: AND 0000009d: SWAP1 0000009e: PUSH1 0x20 000000a0: ADD 000000a1: SWAP1 000000a2: SWAP3 000000a3: SWAP2 000000a4: SWAP1 000000a5: POP 000000a6: POP 000000a7: POP 000000a8: PUSH2 0x00ae 000000ab: JUMP 000000ac: JUMPDEST 000000ad: STOP 000000ae: JUMPDEST 000000af: ADDRESS 000000b0: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000c5: AND 000000c6: CALLER 000000c7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000dc: AND 000000dd: EQ 000000de: PUSH2 0x0132 000000e1: JUMPI 000000e2: PUSH1 0x40 000000e4: MLOAD 000000e5: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000106: DUP2 00000107: MSTORE 00000108: PUSH1 0x04 0000010a: ADD 0000010b: DUP1 0000010c: DUP1 0000010d: PUSH1 0x20 0000010f: ADD 00000110: DUP3 00000111: DUP2 00000112: SUB 00000113: DUP3 00000114: MSTORE 00000115: PUSH1 0x2c 00000117: DUP2 00000118: MSTORE 00000119: PUSH1 0x20 0000011b: ADD 0000011c: DUP1 0000011d: PUSH2 0x0220 00000120: PUSH1 0x2c 00000122: SWAP2 00000123: CODECOPY 00000124: PUSH1 0x40 00000126: ADD 00000127: SWAP2 00000128: POP 00000129: POP 0000012a: PUSH1 0x40 0000012c: MLOAD 0000012d: DUP1 0000012e: SWAP2 0000012f: SUB 00000130: SWAP1 00000131: REVERT 00000132: JUMPDEST 00000133: PUSH1 0x00 00000135: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000014a: AND 0000014b: DUP2 0000014c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000161: AND 00000162: EQ 00000163: ISZERO 00000164: PUSH2 0x01b8 00000167: JUMPI 00000168: PUSH1 0x40 0000016a: MLOAD 0000016b: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 0000018c: DUP2 0000018d: MSTORE 0000018e: PUSH1 0x04 00000190: ADD 00000191: DUP1 00000192: DUP1 00000193: PUSH1 0x20 00000195: ADD 00000196: DUP3 00000197: DUP2 00000198: SUB 00000199: DUP3 0000019a: MSTORE 0000019b: PUSH1 0x24 0000019d: DUP2 0000019e: MSTORE 0000019f: PUSH1 0x20 000001a1: ADD 000001a2: DUP1 000001a3: PUSH2 0x01fc 000001a6: PUSH1 0x24 000001a8: SWAP2 000001a9: CODECOPY 000001aa: PUSH1 0x40 000001ac: ADD 000001ad: SWAP2 000001ae: POP 000001af: POP 000001b0: PUSH1 0x40 000001b2: MLOAD 000001b3: DUP1 000001b4: SWAP2 000001b5: SUB 000001b6: SWAP1 000001b7: REVERT 000001b8: JUMPDEST 000001b9: DUP1 000001ba: PUSH1 0x00 000001bc: DUP1 000001bd: PUSH2 0x0100 000001c0: EXP 000001c1: DUP2 000001c2: SLOAD 000001c3: DUP2 000001c4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001d9: MUL 000001da: NOT 000001db: AND 000001dc: SWAP1 000001dd: DUP4 000001de: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001f3: AND 000001f4: MUL 000001f5: OR 000001f6: SWAP1 000001f7: SSTORE 000001f8: POP 000001f9: POP 000001fa: JUMP 000001fb: INVALID 000001fc: BLOBHASH 000001fd: PUSH15 0x76616c6964206d617374657220636f 0000020d: PUSH17 0x7920616464726573732070726f76696465 0000021f: PUSH5 0x4d6574686f 00000225: PUSH5 0x2063616e20 0000022b: PUSH16 0x6e6c792062652063616c6c6564206672 0000023c: PUSH16 0x6d207468697320636f6e7472616374a2 0000024d: PUSH6 0x627a7a723058 00000254: KECCAK256 00000255: GAS 00000256: CALLDATACOPY 00000257: MUL 00000258: SWAP14 00000259: UNKNOWN(0x26) 0000025a: SWAP13 0000025b: UNKNOWN(0xFB) 0000025c: UNKNOWN(0x27) 0000025d: MSTORE8 0000025e: CALLER 0000025f: LOG2 00000260: UNKNOWN(0xA5) 00000261: CALLDATACOPY 00000262: LT 00000263: UNKNOWN(0xDE) 00000264: UNKNOWN(0xBD) 00000265: DUP6 00000266: CALLDATASIZE 00000267: EXP 00000268: CALLDATACOPY 00000269: SWAP11 0000026a: DUP2 0000026b: SLT 0000026c: LOG4 0000026d: UNKNOWN(0xE4) 0000026e: SLOAD 0000026f: CHAINID 00000270: UNKNOWN(0xD9) 00000271: SWAP14 00000272: SLT 00000273: DUP4 00000274: UNKNOWN(0xC1) 00000275: PUSH5 0x736f6c6343 0000027b: STOP 0000027c: SDIV 0000027d: EXP 0000027e: STOP 0000027f: ORIGIN
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | upgradeability | detector | Untrusted DELEGATECALL target reachable | 55 | no | no |
viewtrace_id: 0x423c6ab9d81088ba73942b57dabac344d90c7084f46df1a4955e2700a585b695
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "unknown",
"attempts": 12,
"trace_id": "0x423c6ab9d81088ba73942b57dabac344d90c7084f46df1a4955e2700a585b695",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": null,
"matched_probe": null,
"target_varies": null,
"classification": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x7de7edef",
"selector": "0x7de7edef",
"calldata_variants": [
"0x7de7edef",
"0x7de7edef0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 69,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [
{
"pc": 198,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 639,
"type": "tx_origin_used"
}
],
"delegatecall_count": 1,
"untrusted_delegatecall_count": 1
}
|
| high | auth | detector | Authorization based on tx.origin | 70 | no | — |
viewvalidation_json{
"reason": "missing sink mapping",
"status": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x7de7edef",
"selector": "0x7de7edef",
"calldata_variants": [
"0x7de7edef",
"0x7de7edef0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"guards_detected": [
{
"pc": 198,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 639,
"type": "tx_origin_used"
}
]
}
|