Analysis Run

019b477e-c843-70b3-b74d-1484dcc1cc0d

complete

Chain ID

1

Address

0x5d2c31ce16924c2a71d317e5bbfd5ce387854039

Block Number

—

Created

Mon, Dec 22, 2025 7:17 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Verified

Review Backing

Not yet

Best current signal

Untrusted DELEGATECALL target reachable

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
26103	artifact.fetch	complete	1 / 3	3 months ago
26104	tool.cast_disasm	complete	1 / 3	3 months ago
113023	analysis.bundle	complete	1 / 3	1 week ago
113024	capability.graph	complete	1 / 3	1 week ago
113025	detector.run	complete	1 / 3	1 week ago
113026	validation.fork	complete	1 / 3	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: yes

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

1

Selfdestruct

0

CREATE2

0

CALL-family (heavy)

0

EXT*/BALANCE

0

Total opcodes

429

Flags

delegatecall_present

View cast disassembly output

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x0043
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x26782247
00000019: EQ
0000001a: PUSH2 0x005a
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0x5c60da1b
00000024: EQ
00000025: PUSH2 0x00b0
00000028: JUMPI
00000029: DUP1
0000002a: PUSH4 0xbb913f41
0000002f: EQ
00000030: PUSH2 0x00dd
00000033: JUMPI
00000034: DUP1
00000035: PUSH4 0xf851a440
0000003a: EQ
0000003b: PUSH2 0x00fd
0000003e: JUMPI
0000003f: PUSH2 0x0052
00000042: JUMP
00000043: JUMPDEST
00000044: CALLDATASIZE
00000045: PUSH2 0x0052
00000048: JUMPI
00000049: PUSH2 0x0050
0000004c: PUSH2 0x012a
0000004f: JUMP
00000050: JUMPDEST
00000051: STOP
00000052: JUMPDEST
00000053: PUSH2 0x0050
00000056: PUSH2 0x012a
00000059: JUMP
0000005a: JUMPDEST
0000005b: CALLVALUE
0000005c: DUP1
0000005d: ISZERO
0000005e: PUSH2 0x0066
00000061: JUMPI
00000062: PUSH1 0x00
00000064: DUP1
00000065: REVERT
00000066: JUMPDEST
00000067: POP
00000068: PUSH1 0x01
0000006a: SLOAD
0000006b: PUSH2 0x0087
0000006e: SWAP1
0000006f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000084: AND
00000085: DUP2
00000086: JUMP
00000087: JUMPDEST
00000088: PUSH1 0x40
0000008a: MLOAD
0000008b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000a0: SWAP1
000000a1: SWAP2
000000a2: AND
000000a3: DUP2
000000a4: MSTORE
000000a5: PUSH1 0x20
000000a7: ADD
000000a8: PUSH1 0x40
000000aa: MLOAD
000000ab: DUP1
000000ac: SWAP2
000000ad: SUB
000000ae: SWAP1
000000af: RETURN
000000b0: JUMPDEST
000000b1: CALLVALUE
000000b2: DUP1
000000b3: ISZERO
000000b4: PUSH2 0x00bc
000000b7: JUMPI
000000b8: PUSH1 0x00
000000ba: DUP1
000000bb: REVERT
000000bc: JUMPDEST
000000bd: POP
000000be: PUSH1 0x02
000000c0: SLOAD
000000c1: PUSH2 0x0087
000000c4: SWAP1
000000c5: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000da: AND
000000db: DUP2
000000dc: JUMP
000000dd: JUMPDEST
000000de: CALLVALUE
000000df: DUP1
000000e0: ISZERO
000000e1: PUSH2 0x00e9
000000e4: JUMPI
000000e5: PUSH1 0x00
000000e7: DUP1
000000e8: REVERT
000000e9: JUMPDEST
000000ea: POP
000000eb: PUSH2 0x0050
000000ee: PUSH2 0x00f8
000000f1: CALLDATASIZE
000000f2: PUSH1 0x04
000000f4: PUSH2 0x03ad
000000f7: JUMP
000000f8: JUMPDEST
000000f9: PUSH2 0x01b2
000000fc: JUMP
000000fd: JUMPDEST
000000fe: CALLVALUE
000000ff: DUP1
00000100: ISZERO
00000101: PUSH2 0x0109
00000104: JUMPI
00000105: PUSH1 0x00
00000107: DUP1
00000108: REVERT
00000109: JUMPDEST
0000010a: POP
0000010b: PUSH1 0x00
0000010d: SLOAD
0000010e: PUSH2 0x0087
00000111: SWAP1
00000112: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000127: AND
00000128: DUP2
00000129: JUMP
0000012a: JUMPDEST
0000012b: PUSH1 0x02
0000012d: SLOAD
0000012e: PUSH1 0x40
00000130: MLOAD
00000131: PUSH1 0x00
00000133: SWAP2
00000134: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000149: AND
0000014a: SWAP1
0000014b: PUSH2 0x0157
0000014e: SWAP1
0000014f: DUP4
00000150: SWAP1
00000151: CALLDATASIZE
00000152: SWAP1
00000153: PUSH2 0x03ea
00000156: JUMP
00000157: JUMPDEST
00000158: PUSH1 0x00
0000015a: PUSH1 0x40
0000015c: MLOAD
0000015d: DUP1
0000015e: DUP4
0000015f: SUB
00000160: DUP2
00000161: DUP6
00000162: GAS
00000163: DELEGATECALL
00000164: SWAP2
00000165: POP
00000166: POP
00000167: RETURNDATASIZE
00000168: DUP1
00000169: PUSH1 0x00
0000016b: DUP2
0000016c: EQ
0000016d: PUSH2 0x0192
00000170: JUMPI
00000171: PUSH1 0x40
00000173: MLOAD
00000174: SWAP2
00000175: POP
00000176: PUSH1 0x1f
00000178: NOT
00000179: PUSH1 0x3f
0000017b: RETURNDATASIZE
0000017c: ADD
0000017d: AND
0000017e: DUP3
0000017f: ADD
00000180: PUSH1 0x40
00000182: MSTORE
00000183: RETURNDATASIZE
00000184: DUP3
00000185: MSTORE
00000186: RETURNDATASIZE
00000187: PUSH1 0x00
00000189: PUSH1 0x20
0000018b: DUP5
0000018c: ADD
0000018d: RETURNDATACOPY
0000018e: PUSH2 0x0197
00000191: JUMP
00000192: JUMPDEST
00000193: PUSH1 0x60
00000195: SWAP2
00000196: POP
00000197: JUMPDEST
00000198: POP
00000199: POP
0000019a: SWAP1
0000019b: POP
0000019c: PUSH1 0x40
0000019e: MLOAD
0000019f: RETURNDATASIZE
000001a0: PUSH1 0x00
000001a2: DUP3
000001a3: RETURNDATACOPY
000001a4: DUP2
000001a5: DUP1
000001a6: ISZERO
000001a7: PUSH2 0x01ae
000001aa: JUMPI
000001ab: RETURNDATASIZE
000001ac: DUP3
000001ad: RETURN
000001ae: JUMPDEST
000001af: RETURNDATASIZE
000001b0: DUP3
000001b1: REVERT
000001b2: JUMPDEST
000001b3: PUSH1 0x00
000001b5: SLOAD
000001b6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000001cb: AND
000001cc: CALLER
000001cd: EQ
000001ce: PUSH2 0x025e
000001d1: JUMPI
000001d2: PUSH1 0x40
000001d4: MLOAD
000001d5: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
000001f6: DUP2
000001f7: MSTORE
000001f8: PUSH1 0x20
000001fa: PUSH1 0x04
000001fc: DUP3
000001fd: ADD
000001fe: MSTORE
000001ff: PUSH1 0x2d
00000201: PUSH1 0x24
00000203: DUP3
00000204: ADD
00000205: MSTORE
00000206: PUSH32 0x4e6f756e7344414f50726f78793a3a5f736574496d706c656d656e746174696f
00000227: PUSH1 0x44
00000229: DUP3
0000022a: ADD
0000022b: MSTORE
0000022c: PUSH32 0x6e3a2061646d696e206f6e6c7900000000000000000000000000000000000000
0000024d: PUSH1 0x64
0000024f: DUP3
00000250: ADD
00000251: MSTORE
00000252: PUSH1 0x84
00000254: ADD
00000255: JUMPDEST
00000256: PUSH1 0x40
00000258: MLOAD
00000259: DUP1
0000025a: SWAP2
0000025b: SUB
0000025c: SWAP1
0000025d: REVERT
0000025e: JUMPDEST
0000025f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000274: DUP2
00000275: AND
00000276: PUSH2 0x0327
00000279: JUMPI
0000027a: PUSH1 0x40
0000027c: MLOAD
0000027d: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
0000029e: DUP2
0000029f: MSTORE
000002a0: PUSH1 0x20
000002a2: PUSH1 0x04
000002a4: DUP3
000002a5: ADD
000002a6: MSTORE
000002a7: PUSH1 0x41
000002a9: PUSH1 0x24
000002ab: DUP3
000002ac: ADD
000002ad: MSTORE
000002ae: PUSH32 0x4e6f756e7344414f50726f78793a3a5f736574496d706c656d656e746174696f
000002cf: PUSH1 0x44
000002d1: DUP3
000002d2: ADD
000002d3: MSTORE
000002d4: PUSH32 0x6e3a20696e76616c696420696d706c656d656e746174696f6e20616464726573
000002f5: PUSH1 0x64
000002f7: DUP3
000002f8: ADD
000002f9: MSTORE
000002fa: PUSH32 0x7300000000000000000000000000000000000000000000000000000000000000
0000031b: PUSH1 0x84
0000031d: DUP3
0000031e: ADD
0000031f: MSTORE
00000320: PUSH1 0xa4
00000322: ADD
00000323: PUSH2 0x0255
00000326: JUMP
00000327: JUMPDEST
00000328: PUSH1 0x02
0000032a: DUP1
0000032b: SLOAD
0000032c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000341: DUP4
00000342: DUP2
00000343: AND
00000344: PUSH32 0xffffffffffffffffffffffff0000000000000000000000000000000000000000
00000365: DUP4
00000366: AND
00000367: DUP2
00000368: OR
00000369: SWAP1
0000036a: SWAP4
0000036b: SSTORE
0000036c: PUSH1 0x40
0000036e: DUP1
0000036f: MLOAD
00000370: SWAP2
00000371: SWAP1
00000372: SWAP3
00000373: AND
00000374: DUP1
00000375: DUP3
00000376: MSTORE
00000377: PUSH1 0x20
00000379: DUP3
0000037a: ADD
0000037b: SWAP4
0000037c: SWAP1
0000037d: SWAP4
0000037e: MSTORE
0000037f: PUSH32 0xd604de94d45953f9138079ec1b82d533cb2160c906d1076d1f7ed54befbca97a
000003a0: SWAP2
000003a1: ADD
000003a2: PUSH1 0x40
000003a4: MLOAD
000003a5: DUP1
000003a6: SWAP2
000003a7: SUB
000003a8: SWAP1
000003a9: LOG1
000003aa: POP
000003ab: POP
000003ac: JUMP
000003ad: JUMPDEST
000003ae: PUSH1 0x00
000003b0: PUSH1 0x20
000003b2: DUP3
000003b3: DUP5
000003b4: SUB
000003b5: SLT
000003b6: ISZERO
000003b7: PUSH2 0x03bf
000003ba: JUMPI
000003bb: PUSH1 0x00
000003bd: DUP1
000003be: REVERT
000003bf: JUMPDEST
000003c0: DUP2
000003c1: CALLDATALOAD
000003c2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003d7: DUP2
000003d8: AND
000003d9: DUP2
000003da: EQ
000003db: PUSH2 0x03e3
000003de: JUMPI
000003df: PUSH1 0x00
000003e1: DUP1
000003e2: REVERT
000003e3: JUMPDEST
000003e4: SWAP4
000003e5: SWAP3
000003e6: POP
000003e7: POP
000003e8: POP
000003e9: JUMP
000003ea: JUMPDEST
000003eb: DUP2
000003ec: DUP4
000003ed: DUP3
000003ee: CALLDATACOPY
000003ef: PUSH1 0x00
000003f1: SWAP2
000003f2: ADD
000003f3: SWAP1
000003f4: DUP2
000003f5: MSTORE
000003f6: SWAP2
000003f7: SWAP1
000003f8: POP
000003f9: JUMP
000003fa: INVALID
000003fb: LOG2
000003fc: PUSH5 0x6970667358
00000402: UNKNOWN(0x22)
00000403: SLT
00000404: KECCAK256
00000405: UNKNOWN(0xA5)
00000406: PUSH26 0x20897432f744adc6e96a28bdc469834f95c60e8dc78679ab4e15
00000421: SELFBALANCE
00000422: GASPRICE
00000423: MOD
00000424: DUP11
00000425: PUSH5 0x736f6c6343
0000042b: STOP
0000042c: ADDMOD
0000042d: MOD
0000042e: STOP
0000042f: CALLER

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
critical	upgradeability	detector	Untrusted DELEGATECALL target reachable	70	no	no	view trace_id: 0xcfc967a88465d1962975434c3afcde2385194a25a0d0a294d19ca7bdd944eae3 validation_json { "sink": "DELEGATECALL", "errors": 0, "status": "unknown", "attempts": 48, "trace_id": "0xcfc967a88465d1962975434c3afcde2385194a25a0d0a294d19ca7bdd944eae3", "confirmed": false, "trace_mode": "callTracer", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "no_sink" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x26782247", "selector": "0x26782247", "calldata_variants": [ "0x26782247", "0x267822470000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x5c60da1b", "selector": "0x5c60da1b", "calldata_variants": [ "0x5c60da1b", "0x5c60da1b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xbb913f41", "selector": "0xbb913f41", "calldata_variants": [ "0xbb913f41", "0xbb913f410000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xf851a440", "selector": "0xf851a440", "calldata_variants": [ "0xf851a440", "0xf851a4400000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 355, "opcode": "DELEGATECALL", "returndata_checked": null, "value_expression_category": "n/a", "target_expression_category": "computed" } ], "guards_detected": [], "delegatecall_count": 1, "untrusted_delegatecall_count": 1 }

Severity