019b477e-d070-7253-8692-6f2b18f3a8f0
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 27569 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 27570 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 102820 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 102821 | capability.graph | complete | 1 / 3 | 1 week ago |
| 102822 | detector.run | complete | 1 / 3 | 1 week ago |
| 102823 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
No codex job recorded yet.
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: CALLDATASIZE 00000006: PUSH2 0x0013 00000009: JUMPI 0000000a: PUSH2 0x0011 0000000d: PUSH2 0x0017 00000010: JUMP 00000011: JUMPDEST 00000012: STOP 00000013: JUMPDEST 00000014: PUSH2 0x0011 00000017: JUMPDEST 00000018: PUSH2 0x0027 0000001b: PUSH2 0x0022 0000001e: PUSH2 0x00ee 00000021: JUMP 00000022: JUMPDEST 00000023: PUSH2 0x0133 00000026: JUMP 00000027: JUMPDEST 00000028: JUMP 00000029: JUMPDEST 0000002a: PUSH1 0x60 0000002c: DUP3 0000002d: EXTCODESIZE 0000002e: PUSH2 0x0063 00000031: JUMPI 00000032: PUSH1 0x40 00000034: MLOAD 00000035: PUSH32 0x37f2022900000000000000000000000000000000000000000000000000000000 00000056: DUP2 00000057: MSTORE 00000058: PUSH1 0x04 0000005a: ADD 0000005b: PUSH1 0x40 0000005d: MLOAD 0000005e: DUP1 0000005f: SWAP2 00000060: SUB 00000061: SWAP1 00000062: REVERT 00000063: JUMPDEST 00000064: PUSH1 0x00 00000066: DUP1 00000067: DUP5 00000068: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000007d: AND 0000007e: DUP5 0000007f: PUSH1 0x40 00000081: MLOAD 00000082: PUSH2 0x008b 00000085: SWAP2 00000086: SWAP1 00000087: PUSH2 0x01a8 0000008a: JUMP 0000008b: JUMPDEST 0000008c: PUSH1 0x00 0000008e: PUSH1 0x40 00000090: MLOAD 00000091: DUP1 00000092: DUP4 00000093: SUB 00000094: DUP2 00000095: DUP6 00000096: GAS 00000097: DELEGATECALL 00000098: SWAP2 00000099: POP 0000009a: POP 0000009b: RETURNDATASIZE 0000009c: DUP1 0000009d: PUSH1 0x00 0000009f: DUP2 000000a0: EQ 000000a1: PUSH2 0x00c6 000000a4: JUMPI 000000a5: PUSH1 0x40 000000a7: MLOAD 000000a8: SWAP2 000000a9: POP 000000aa: PUSH1 0x1f 000000ac: NOT 000000ad: PUSH1 0x3f 000000af: RETURNDATASIZE 000000b0: ADD 000000b1: AND 000000b2: DUP3 000000b3: ADD 000000b4: PUSH1 0x40 000000b6: MSTORE 000000b7: RETURNDATASIZE 000000b8: DUP3 000000b9: MSTORE 000000ba: RETURNDATASIZE 000000bb: PUSH1 0x00 000000bd: PUSH1 0x20 000000bf: DUP5 000000c0: ADD 000000c1: RETURNDATACOPY 000000c2: PUSH2 0x00cb 000000c5: JUMP 000000c6: JUMPDEST 000000c7: PUSH1 0x60 000000c9: SWAP2 000000ca: POP 000000cb: JUMPDEST 000000cc: POP 000000cd: SWAP2 000000ce: POP 000000cf: SWAP2 000000d0: POP 000000d1: PUSH2 0x00da 000000d4: DUP3 000000d5: DUP3 000000d6: PUSH2 0x0157 000000d9: JUMP 000000da: JUMPDEST 000000db: SWAP3 000000dc: POP 000000dd: POP 000000de: POP 000000df: JUMPDEST 000000e0: SWAP3 000000e1: SWAP2 000000e2: POP 000000e3: POP 000000e4: JUMP 000000e5: JUMPDEST 000000e6: EXTCODESIZE 000000e7: ISZERO 000000e8: ISZERO 000000e9: SWAP1 000000ea: JUMP 000000eb: JUMPDEST 000000ec: SWAP1 000000ed: JUMP 000000ee: JUMPDEST 000000ef: PUSH1 0x00 000000f1: PUSH2 0x012e 000000f4: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc 00000115: SLOAD 00000116: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000012b: AND 0000012c: SWAP1 0000012d: JUMP 0000012e: JUMPDEST 0000012f: SWAP1 00000130: POP 00000131: SWAP1 00000132: JUMP 00000133: JUMPDEST 00000134: CALLDATASIZE 00000135: PUSH1 0x00 00000137: DUP1 00000138: CALLDATACOPY 00000139: PUSH1 0x00 0000013b: DUP1 0000013c: CALLDATASIZE 0000013d: PUSH1 0x00 0000013f: DUP5 00000140: GAS 00000141: DELEGATECALL 00000142: RETURNDATASIZE 00000143: PUSH1 0x00 00000145: DUP1 00000146: RETURNDATACOPY 00000147: DUP1 00000148: DUP1 00000149: ISZERO 0000014a: PUSH2 0x0152 0000014d: JUMPI 0000014e: RETURNDATASIZE 0000014f: PUSH1 0x00 00000151: RETURN 00000152: JUMPDEST 00000153: RETURNDATASIZE 00000154: PUSH1 0x00 00000156: REVERT 00000157: JUMPDEST 00000158: PUSH1 0x60 0000015a: DUP3 0000015b: ISZERO 0000015c: PUSH2 0x0166 0000015f: JUMPI 00000160: POP 00000161: DUP1 00000162: PUSH2 0x00df 00000165: JUMP 00000166: JUMPDEST 00000167: DUP2 00000168: MLOAD 00000169: ISZERO 0000016a: PUSH2 0x0176 0000016d: JUMPI 0000016e: DUP2 0000016f: MLOAD 00000170: DUP1 00000171: DUP4 00000172: PUSH1 0x20 00000174: ADD 00000175: REVERT 00000176: JUMPDEST 00000177: PUSH1 0x40 00000179: MLOAD 0000017a: PUSH32 0x62536b1000000000000000000000000000000000000000000000000000000000 0000019b: DUP2 0000019c: MSTORE 0000019d: PUSH1 0x04 0000019f: ADD 000001a0: PUSH1 0x40 000001a2: MLOAD 000001a3: DUP1 000001a4: SWAP2 000001a5: SUB 000001a6: SWAP1 000001a7: REVERT 000001a8: JUMPDEST 000001a9: PUSH1 0x00 000001ab: DUP3 000001ac: MLOAD 000001ad: PUSH1 0x00 000001af: JUMPDEST 000001b0: DUP2 000001b1: DUP2 000001b2: LT 000001b3: ISZERO 000001b4: PUSH2 0x01c9 000001b7: JUMPI 000001b8: PUSH1 0x20 000001ba: DUP2 000001bb: DUP7 000001bc: ADD 000001bd: DUP2 000001be: ADD 000001bf: MLOAD 000001c0: DUP6 000001c1: DUP4 000001c2: ADD 000001c3: MSTORE 000001c4: ADD 000001c5: PUSH2 0x01af 000001c8: JUMP 000001c9: JUMPDEST 000001ca: POP 000001cb: PUSH1 0x00 000001cd: SWAP3 000001ce: ADD 000001cf: SWAP2 000001d0: DUP3 000001d1: MSTORE 000001d2: POP 000001d3: SWAP2 000001d4: SWAP1 000001d5: POP 000001d6: JUMP 000001d7: INVALID 000001d8: LOG2 000001d9: PUSH5 0x6970667358 000001df: UNKNOWN(0x22) 000001e0: SLT 000001e1: KECCAK256 000001e2: UNKNOWN(0xDC) 000001e3: UNKNOWN(0x4D) 000001e4: EXTCODEHASH 000001e5: STOP 000001e6: SWAP7 000001e7: UNKNOWN(0xEF) 000001e8: PUSH21 0x6736792d21828a33955017294e8f127fdabcf6bf06 000001fe: ADDMOD 000001ff: UNKNOWN(0x2A) 00000200: POP 00000201: EQ 00000202: PUSH5 0x736f6c6343 00000208: STOP 00000209: ADDMOD 0000020a: LT 0000020b: STOP 0000020c: CALLER
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | upgradeability | detector | Untrusted DELEGATECALL target reachable | 70 | no | no |
viewtrace_id: 0x5388ee1bc0de3eccbaa87c897b1fd51eaacf5886ca0156580e59f99f40619414
call_targets:
0x3bdafe0d299168f6ebb6e1b4e1e9702a30f6364d
target_varies:
no
classification:
constant_target
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x5388ee1bc0de3eccbaa87c897b1fd51eaacf5886ca0156580e59f99f40619414",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x3bdafe0d299168f6ebb6e1b4e1e9702a30f6364d"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x",
"selector": "fallback",
"calldata_variants": [
"0x"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 151,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
},
{
"pc": 321,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [],
"delegatecall_count": 2,
"untrusted_delegatecall_count": 2
}
|