Analysis Run

019b477e-d6bf-70a3-aebf-e74dffd5eaae

complete

Chain ID

1

Address

0x327bbdeab664640a1688f03445ce06e035809b42

Block Number

—

Created

Mon, Dec 22, 2025 7:17 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

1

Validated

1

Source

Verified

Review Backing

Not yet

Best current signal

Untrusted DELEGATECALL target reachable

crit 0 high 1 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
28759	artifact.fetch	complete	1 / 3	3 months ago
28760	tool.cast_disasm	complete	1 / 3	3 months ago
71932	analysis.bundle	complete	1 / 3	1 week ago
71933	capability.graph	complete	1 / 3	1 week ago
71934	detector.run	complete	1 / 3	1 week ago
71935	validation.fork	complete	1 / 3	1 week ago
113553	report.consolidate	complete	1 / 6	1 week ago
113554	tool.slither	complete	1 / 2	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: yes

Slither

tool.slither

Status

complete

Attempts

1 / 2

Findings

0

Solc

0.8.9 (solc-select)

View stderr

'forge clean' running (wd: /tmp/slither-nxyn25wr)
'forge config --json' running
'forge build --build-info --skip ./test/** ./script/** --force' running (wd: /tmp/slither-nxyn25wr)

BLChugSplashProxy.setCode(bytes) (contracts/chugsplash/BLChugSplashProxy.sol#123-151) calls BLChugSplashProxy.proxyCallIfNotOwner() (contracts/chugsplash/BLChugSplashProxy.sol#92-99) which halt the execution return(uint256,uint256)(0x0,returndatasize()()) (contracts/chugsplash/BLChugSplashProxy.sol#282)
BLChugSplashProxy.setStorage(bytes32,bytes32) (contracts/chugsplash/BLChugSplashProxy.sol#160-164) calls BLChugSplashProxy.proxyCallIfNotOwner() (contracts/chugsplash/BLChugSplashProxy.sol#92-99) which halt the execution return(uint256,uint256)(0x0,returndatasize()()) (contracts/chugsplash/BLChugSplashProxy.sol#282)
BLChugSplashProxy.setOwner(address) (contracts/chugsplash/BLChugSplashProxy.sol#171-173) calls BLChugSplashProxy.proxyCallIfNotOwner() (contracts/chugsplash/BLChugSplashProxy.sol#92-99) which halt the execution return(uint256,uint256)(0x0,returndatasize()()) (contracts/chugsplash/BLChugSplashProxy.sol#282)
BLChugSplashProxy.getOwner() (contracts/chugsplash/BLChugSplashProxy.sol#181-183) calls BLChugSplashProxy.proxyCallIfNotOwner() (contracts/chugsplash/BLChugSplashProxy.sol#92-99) which halt the execution return(uint256,uint256)(0x0,returndatasize()()) (contracts/chugsplash/BLChugSplashProxy.sol#282)
BLChugSplashProxy.getImplementation() (contracts/chugsplash/BLChugSplashProxy.sol#191-193) calls BLChugSplashProxy.proxyCallIfNotOwner() (contracts/chugsplash/BLChugSplashProxy.sol#92-99) which halt the execution return(uint256,uint256)(0x0,returndatasize()()) (contracts/chugsplash/BLChugSplashProxy.sol#282)
BLChugSplashProxy.proxyCallIfNotOwner() (contracts/chugsplash/BLChugSplashProxy.sol#92-99) calls BLChugSplashProxy._doProxyCall() (contracts/chugsplash/BLChugSplashProxy.sol#259-284) which halt the execution return(uint256,uint256)(0x0,returndatasize()()) (contracts/chugsplash/BLChugSplashProxy.sol#282)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-return-in-assembly

BLChugSplashProxy.setCode(bytes) (contracts/chugsplash/BLChugSplashProxy.sol#123-151) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#137-139)
BLChugSplashProxy.setStorage(bytes32,bytes32) (contracts/chugsplash/BLChugSplashProxy.sol#160-164) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#161-163)
BLChugSplashProxy._setImplementation(address) (contracts/chugsplash/BLChugSplashProxy.sol#203-207) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#204-206)
BLChugSplashProxy._getImplementation() (contracts/chugsplash/BLChugSplashProxy.sol#213-219) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#215-217)
BLChugSplashProxy._setOwner(address) (contracts/chugsplash/BLChugSplashProxy.sol#225-229) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#226-228)
BLChugSplashProxy._getOwner() (contracts/chugsplash/BLChugSplashProxy.sol#235-241) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#237-239)
BLChugSplashProxy._getAccountCodeHash(address) (contracts/chugsplash/BLChugSplashProxy.sol#248-254) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#250-252)
BLChugSplashProxy._doProxyCall() (contracts/chugsplash/BLChugSplashProxy.sol#259-284) uses assembly
	- INLINE ASM (contracts/chugsplash/BLChugSplashProxy.sol#264-283)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#assembly-usage

Version constraint ^0.8.9 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)
	- VerbatimInvalidDeduplication
	- FullInlinerNonExpressionSplitArgumentEvaluationOrder
	- MissingSideEffectsOnSelectorAccess
	- AbiReencodingHeadOverflowWithStaticArrayCleanup
	- DirtyBytesArrayToStorage
	- DataLocationChangeInInternalOverride
	- NestedCalldataArrayAbiReencodingSizeValidation.
It is used by:
	- ^0.8.9 (contracts/chugsplash/BLChugSplashProxy.sol#2)
	- ^0.8.9 (contracts/chugsplash/interfaces/iBLChugSplashDeployer.sol#2)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity

Parameter BLChugSplashProxy.setCode(bytes)._code (contracts/chugsplash/BLChugSplashProxy.sol#123) is not in mixedCase
Parameter BLChugSplashProxy.setStorage(bytes32,bytes32)._key (contracts/chugsplash/BLChugSplashProxy.sol#160) is not in mixedCase
Parameter BLChugSplashProxy.setStorage(bytes32,bytes32)._value (contracts/chugsplash/BLChugSplashProxy.sol#160) is not in mixedCase
Parameter BLChugSplashProxy.setOwner(address)._owner (contracts/chugsplash/BLChugSplashProxy.sol#171) is not in mixedCase
Contract iBLChugSplashDeployer (contracts/chugsplash/interfaces/iBLChugSplashDeployer.sol#7-9) is not in CapWords
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#conformance-to-solidity-naming-conventions
. analyzed (2 contracts with 100 detectors), 20 result(s) found

Metadata

{
    "solc": {
        "status": "ok",
        "use_rc": 0,
        "version": "0.8.9",
        "strategy": "solc-select",
        "solc_path": "/var/www/tripwire/.venv/bin/solc",
        "install_rc": 0,
        "use_stderr": null,
        "use_stdout": "Switched global version to 0.8.9",
        "install_stderr": null,
        "install_stdout": "Version '0.8.9' is already installed, skipping..."
    },
    "solc_args": "--base-path /tmp/slither-nxyn25wr --allow-paths /tmp/slither-nxyn25wr,/tmp/slither-nxyn25wr/lib,/tmp/slither-nxyn25wr/src",
    "remappings": [],
    "source_files": [
        "contracts/chugsplash/BLChugSplashProxy.sol",
        "contracts/chugsplash/interfaces/iBLChugSplashDeployer.sol"
    ],
    "contract_count": 0,
    "contract_names": [],
    "detector_count": 20,
    "workspace_hash": "2dd99a35204423d6bff6e04657fb30c352f0e46356a1f1bc6e4231f17088118c",
    "duration_seconds": 0.3560044765472412,
    "solc_version_requested": "0.8.19"
}

Codex

report.consolidate

Job Status

complete

Attempts

1 / 6

Findings

0

No findings?

—

View stderr

OpenAI Codex v0.118.0 (research preview)
--------
workdir: /tmp/codex-naskgt20
model: gpt-5.4
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: none
session id: 019d5c97-60c1-7f50-8cf4-a61e986bbae2
--------
user
You are a security auditor. Audit this Solidity codebase for exploitable vulnerabilities.
Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation, oracle manipulation,
accounting/invariant breaks, external call patterns, unchecked return values, and dangerous delegatecall.

Scope rules:
- You MUST fully read `AUDIT_BUNDLE.txt` before concluding. It contains the complete contents of all first-party Solidity sources in this workspace.
- Treat `lib/` and `@openzeppelin/` as third-party dependencies; skip them unless there is a concrete misuse angle in first-party code.
- If there are only dependency files and no first-party sources, set no_findings=true and explain in summary.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title and file/line locations when possible.

Output constraints (IMPORTANT):
- severity MUST be exactly one of: info, low, medium, high, critical (lowercase).
- category MUST be exactly one of: access_control, reentrancy, math, oracle, upgradeability, auth, other.
Keep summary short and concrete.
warning: Codex could not find system bubblewrap on PATH. Please install bubblewrap with your package manager. Codex will use the vendored bubblewrap in the meantime.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.
ERROR: You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Apr 8th, 2026 9:11 AM.

Metadata

{
    "codex": {
        "ran_at": "2026-04-05T07:41:59.429111+00:00",
        "returncode": 1
    },
    "project": {
        "mode": "source",
        "file_count": 2,
        "import_count": 1,
        "first_party_contracts_count": 2
    },
    "summary": null,
    "no_findings": null,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm

Delegatecall

1

Selfdestruct

1

CREATE2

0

CALL-family (heavy)

1

EXT*/BALANCE

2

Total opcodes

989

Flags

delegatecall_present selfdestruct_present create_opcodes_present

View cast disassembly output

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x005a
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x893d20e8
00000019: GT
0000001a: PUSH2 0x0043
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0x893d20e8
00000024: EQ
00000025: PUSH2 0x00a4
00000028: JUMPI
00000029: DUP1
0000002a: PUSH4 0x9b0b0fda
0000002f: EQ
00000030: PUSH2 0x00e2
00000033: JUMPI
00000034: DUP1
00000035: PUSH4 0xaaf10f42
0000003a: EQ
0000003b: PUSH2 0x0102
0000003e: JUMPI
0000003f: PUSH2 0x005a
00000042: JUMP
00000043: JUMPDEST
00000044: DUP1
00000045: PUSH4 0x13af4035
0000004a: EQ
0000004b: PUSH2 0x0064
0000004e: JUMPI
0000004f: DUP1
00000050: PUSH4 0x6c5d4ad0
00000055: EQ
00000056: PUSH2 0x0084
00000059: JUMPI
0000005a: JUMPDEST
0000005b: PUSH2 0x0062
0000005e: PUSH2 0x0117
00000061: JUMP
00000062: JUMPDEST
00000063: STOP
00000064: JUMPDEST
00000065: CALLVALUE
00000066: DUP1
00000067: ISZERO
00000068: PUSH2 0x0070
0000006b: JUMPI
0000006c: PUSH1 0x00
0000006e: DUP1
0000006f: REVERT
00000070: JUMPDEST
00000071: POP
00000072: PUSH2 0x0062
00000075: PUSH2 0x007f
00000078: CALLDATASIZE
00000079: PUSH1 0x04
0000007b: PUSH2 0x0791
0000007e: JUMP
0000007f: JUMPDEST
00000080: PUSH2 0x03ba
00000083: JUMP
00000084: JUMPDEST
00000085: CALLVALUE
00000086: DUP1
00000087: ISZERO
00000088: PUSH2 0x0090
0000008b: JUMPI
0000008c: PUSH1 0x00
0000008e: DUP1
0000008f: REVERT
00000090: JUMPDEST
00000091: POP
00000092: PUSH2 0x0062
00000095: PUSH2 0x009f
00000098: CALLDATASIZE
00000099: PUSH1 0x04
0000009b: PUSH2 0x07fd
0000009e: JUMP
0000009f: JUMPDEST
000000a0: PUSH2 0x044b
000000a3: JUMP
000000a4: JUMPDEST
000000a5: CALLVALUE
000000a6: DUP1
000000a7: ISZERO
000000a8: PUSH2 0x00b0
000000ab: JUMPI
000000ac: PUSH1 0x00
000000ae: DUP1
000000af: REVERT
000000b0: JUMPDEST
000000b1: POP
000000b2: PUSH2 0x00b9
000000b5: PUSH2 0x0600
000000b8: JUMP
000000b9: JUMPDEST
000000ba: PUSH1 0x40
000000bc: MLOAD
000000bd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000d2: SWAP1
000000d3: SWAP2
000000d4: AND
000000d5: DUP2
000000d6: MSTORE
000000d7: PUSH1 0x20
000000d9: ADD
000000da: PUSH1 0x40
000000dc: MLOAD
000000dd: DUP1
000000de: SWAP2
000000df: SUB
000000e0: SWAP1
000000e1: RETURN
000000e2: JUMPDEST
000000e3: CALLVALUE
000000e4: DUP1
000000e5: ISZERO
000000e6: PUSH2 0x00ee
000000e9: JUMPI
000000ea: PUSH1 0x00
000000ec: DUP1
000000ed: REVERT
000000ee: JUMPDEST
000000ef: POP
000000f0: PUSH2 0x0062
000000f3: PUSH2 0x00fd
000000f6: CALLDATASIZE
000000f7: PUSH1 0x04
000000f9: PUSH2 0x08cc
000000fc: JUMP
000000fd: JUMPDEST
000000fe: PUSH2 0x0697
00000101: JUMP
00000102: JUMPDEST
00000103: CALLVALUE
00000104: DUP1
00000105: ISZERO
00000106: PUSH2 0x010e
00000109: JUMPI
0000010a: PUSH1 0x00
0000010c: DUP1
0000010d: REVERT
0000010e: JUMPDEST
0000010f: POP
00000110: PUSH2 0x00b9
00000113: PUSH2 0x0705
00000116: JUMP
00000117: JUMPDEST
00000118: PUSH1 0x00
0000011a: PUSH2 0x0141
0000011d: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
0000013e: SLOAD
0000013f: SWAP1
00000140: JUMP
00000141: JUMPDEST
00000142: PUSH1 0x40
00000144: DUP1
00000145: MLOAD
00000146: PUSH1 0x04
00000148: DUP2
00000149: MSTORE
0000014a: PUSH1 0x24
0000014c: DUP2
0000014d: ADD
0000014e: DUP3
0000014f: MSTORE
00000150: PUSH1 0x20
00000152: DUP2
00000153: ADD
00000154: DUP1
00000155: MLOAD
00000156: PUSH28 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff
00000173: AND
00000174: PUSH32 0xb794726200000000000000000000000000000000000000000000000000000000
00000195: OR
00000196: SWAP1
00000197: MSTORE
00000198: SWAP1
00000199: MLOAD
0000019a: SWAP2
0000019b: SWAP3
0000019c: POP
0000019d: PUSH1 0x00
0000019f: SWAP2
000001a0: DUP3
000001a1: SWAP2
000001a2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000001b7: DUP6
000001b8: AND
000001b9: SWAP2
000001ba: PUSH2 0x01c3
000001bd: SWAP2
000001be: SWAP1
000001bf: PUSH2 0x091e
000001c2: JUMP
000001c3: JUMPDEST
000001c4: PUSH1 0x00
000001c6: PUSH1 0x40
000001c8: MLOAD
000001c9: DUP1
000001ca: DUP4
000001cb: SUB
000001cc: DUP2
000001cd: DUP6
000001ce: GAS
000001cf: STATICCALL
000001d0: SWAP2
000001d1: POP
000001d2: POP
000001d3: RETURNDATASIZE
000001d4: DUP1
000001d5: PUSH1 0x00
000001d7: DUP2
000001d8: EQ
000001d9: PUSH2 0x01fe
000001dc: JUMPI
000001dd: PUSH1 0x40
000001df: MLOAD
000001e0: SWAP2
000001e1: POP
000001e2: PUSH1 0x1f
000001e4: NOT
000001e5: PUSH1 0x3f
000001e7: RETURNDATASIZE
000001e8: ADD
000001e9: AND
000001ea: DUP3
000001eb: ADD
000001ec: PUSH1 0x40
000001ee: MSTORE
000001ef: RETURNDATASIZE
000001f0: DUP3
000001f1: MSTORE
000001f2: RETURNDATASIZE
000001f3: PUSH1 0x00
000001f5: PUSH1 0x20
000001f7: DUP5
000001f8: ADD
000001f9: RETURNDATACOPY
000001fa: PUSH2 0x0203
000001fd: JUMP
000001fe: JUMPDEST
000001ff: PUSH1 0x60
00000201: SWAP2
00000202: POP
00000203: JUMPDEST
00000204: POP
00000205: SWAP2
00000206: POP
00000207: SWAP2
00000208: POP
00000209: DUP2
0000020a: DUP1
0000020b: ISZERO
0000020c: PUSH2 0x0216
0000020f: JUMPI
00000210: POP
00000211: DUP1
00000212: MLOAD
00000213: PUSH1 0x20
00000215: EQ
00000216: JUMPDEST
00000217: ISZERO
00000218: PUSH2 0x02c8
0000021b: JUMPI
0000021c: PUSH1 0x00
0000021e: DUP2
0000021f: DUP1
00000220: PUSH1 0x20
00000222: ADD
00000223: SWAP1
00000224: MLOAD
00000225: DUP2
00000226: ADD
00000227: SWAP1
00000228: PUSH2 0x0231
0000022b: SWAP2
0000022c: SWAP1
0000022d: PUSH2 0x092a
00000230: JUMP
00000231: JUMPDEST
00000232: SWAP1
00000233: POP
00000234: DUP1
00000235: ISZERO
00000236: PUSH2 0x02c6
00000239: JUMPI
0000023a: PUSH1 0x40
0000023c: MLOAD
0000023d: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
0000025e: DUP2
0000025f: MSTORE
00000260: PUSH1 0x20
00000262: PUSH1 0x04
00000264: DUP3
00000265: ADD
00000266: MSTORE
00000267: PUSH1 0x35
00000269: PUSH1 0x24
0000026b: DUP3
0000026c: ADD
0000026d: MSTORE
0000026e: PUSH32 0x424c4368756753706c61736850726f78793a2073797374656d20697320637572
0000028f: PUSH1 0x44
00000291: DUP3
00000292: ADD
00000293: MSTORE
00000294: PUSH32 0x72656e746c79206265696e672075706772616465640000000000000000000000
000002b5: PUSH1 0x64
000002b7: DUP3
000002b8: ADD
000002b9: MSTORE
000002ba: PUSH1 0x84
000002bc: ADD
000002bd: JUMPDEST
000002be: PUSH1 0x40
000002c0: MLOAD
000002c1: DUP1
000002c2: SWAP2
000002c3: SUB
000002c4: SWAP1
000002c5: REVERT
000002c6: JUMPDEST
000002c7: POP
000002c8: JUMPDEST
000002c9: PUSH1 0x00
000002cb: PUSH2 0x02f2
000002ce: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
000002ef: SLOAD
000002f0: SWAP1
000002f1: JUMP
000002f2: JUMPDEST
000002f3: SWAP1
000002f4: POP
000002f5: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000030a: DUP2
0000030b: AND
0000030c: PUSH2 0x0397
0000030f: JUMPI
00000310: PUSH1 0x40
00000312: MLOAD
00000313: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000334: DUP2
00000335: MSTORE
00000336: PUSH1 0x20
00000338: PUSH1 0x04
0000033a: DUP3
0000033b: ADD
0000033c: MSTORE
0000033d: PUSH1 0x30
0000033f: PUSH1 0x24
00000341: DUP3
00000342: ADD
00000343: MSTORE
00000344: PUSH32 0x424c4368756753706c61736850726f78793a20696d706c656d656e746174696f
00000365: PUSH1 0x44
00000367: DUP3
00000368: ADD
00000369: MSTORE
0000036a: PUSH32 0x6e206973206e6f74207365742079657400000000000000000000000000000000
0000038b: PUSH1 0x64
0000038d: DUP3
0000038e: ADD
0000038f: MSTORE
00000390: PUSH1 0x84
00000392: ADD
00000393: PUSH2 0x02bd
00000396: JUMP
00000397: JUMPDEST
00000398: CALLDATASIZE
00000399: PUSH1 0x00
0000039b: DUP1
0000039c: CALLDATACOPY
0000039d: PUSH1 0x00
0000039f: DUP1
000003a0: CALLDATASIZE
000003a1: PUSH1 0x00
000003a3: DUP5
000003a4: GAS
000003a5: DELEGATECALL
000003a6: RETURNDATASIZE
000003a7: PUSH1 0x00
000003a9: DUP1
000003aa: RETURNDATACOPY
000003ab: DUP1
000003ac: PUSH2 0x03b4
000003af: JUMPI
000003b0: RETURNDATASIZE
000003b1: PUSH1 0x00
000003b3: REVERT
000003b4: JUMPDEST
000003b5: POP
000003b6: RETURNDATASIZE
000003b7: PUSH1 0x00
000003b9: RETURN
000003ba: JUMPDEST
000003bb: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
000003dc: SLOAD
000003dd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003f2: AND
000003f3: CALLER
000003f4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000409: AND
0000040a: EQ
0000040b: DUP1
0000040c: PUSH2 0x0413
0000040f: JUMPI
00000410: POP
00000411: CALLER
00000412: ISZERO
00000413: JUMPDEST
00000414: ISZERO
00000415: PUSH2 0x0443
00000418: JUMPI
00000419: PUSH2 0x0440
0000041c: DUP2
0000041d: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
0000043e: SSTORE
0000043f: JUMP
00000440: JUMPDEST
00000441: POP
00000442: JUMP
00000443: JUMPDEST
00000444: PUSH2 0x0440
00000447: PUSH2 0x0117
0000044a: JUMP
0000044b: JUMPDEST
0000044c: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
0000046d: SLOAD
0000046e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000483: AND
00000484: CALLER
00000485: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000049a: AND
0000049b: EQ
0000049c: DUP1
0000049d: PUSH2 0x04a4
000004a0: JUMPI
000004a1: POP
000004a2: CALLER
000004a3: ISZERO
000004a4: JUMPDEST
000004a5: ISZERO
000004a6: PUSH2 0x0443
000004a9: JUMPI
000004aa: PUSH1 0x00
000004ac: PUSH2 0x04d3
000004af: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
000004d0: SLOAD
000004d1: SWAP1
000004d2: JUMP
000004d3: JUMPDEST
000004d4: SWAP1
000004d5: POP
000004d6: DUP1
000004d7: EXTCODEHASH
000004d8: DUP3
000004d9: MLOAD
000004da: PUSH1 0x20
000004dc: DUP5
000004dd: ADD
000004de: KECCAK256
000004df: SUB
000004e0: PUSH2 0x04e7
000004e3: JUMPI
000004e4: POP
000004e5: POP
000004e6: JUMP
000004e7: JUMPDEST
000004e8: PUSH1 0x40
000004ea: MLOAD
000004eb: PUSH1 0x00
000004ed: SWAP1
000004ee: PUSH2 0x051d
000004f1: SWAP1
000004f2: PUSH32 0x600d380380600d6000396000f300000000000000000000000000000000000000
00000513: SWAP1
00000514: DUP6
00000515: SWAP1
00000516: PUSH1 0x20
00000518: ADD
00000519: PUSH2 0x0943
0000051c: JUMP
0000051d: JUMPDEST
0000051e: PUSH1 0x40
00000520: MLOAD
00000521: PUSH1 0x20
00000523: DUP2
00000524: DUP4
00000525: SUB
00000526: SUB
00000527: DUP2
00000528: MSTORE
00000529: SWAP1
0000052a: PUSH1 0x40
0000052c: MSTORE
0000052d: SWAP1
0000052e: POP
0000052f: PUSH1 0x00
00000531: DUP2
00000532: MLOAD
00000533: PUSH1 0x20
00000535: DUP4
00000536: ADD
00000537: PUSH1 0x00
00000539: CREATE
0000053a: DUP5
0000053b: MLOAD
0000053c: PUSH1 0x20
0000053e: DUP7
0000053f: ADD
00000540: KECCAK256
00000541: SWAP1
00000542: SWAP2
00000543: POP
00000544: DUP2
00000545: EXTCODEHASH
00000546: EQ
00000547: PUSH2 0x05d2
0000054a: JUMPI
0000054b: PUSH1 0x40
0000054d: MLOAD
0000054e: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
0000056f: DUP2
00000570: MSTORE
00000571: PUSH1 0x20
00000573: PUSH1 0x04
00000575: DUP3
00000576: ADD
00000577: MSTORE
00000578: PUSH1 0x33
0000057a: PUSH1 0x24
0000057c: DUP3
0000057d: ADD
0000057e: MSTORE
0000057f: PUSH32 0x424c4368756753706c61736850726f78793a20636f646520776173206e6f7420
000005a0: PUSH1 0x44
000005a2: DUP3
000005a3: ADD
000005a4: MSTORE
000005a5: PUSH32 0x636f72726563746c79206465706c6f7965642e00000000000000000000000000
000005c6: PUSH1 0x64
000005c8: DUP3
000005c9: ADD
000005ca: MSTORE
000005cb: PUSH1 0x84
000005cd: ADD
000005ce: PUSH2 0x02bd
000005d1: JUMP
000005d2: JUMPDEST
000005d3: PUSH2 0x05fa
000005d6: DUP2
000005d7: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
000005f8: SSTORE
000005f9: JUMP
000005fa: JUMPDEST
000005fb: POP
000005fc: POP
000005fd: POP
000005fe: POP
000005ff: JUMP
00000600: JUMPDEST
00000601: PUSH1 0x00
00000603: PUSH2 0x062a
00000606: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
00000627: SLOAD
00000628: SWAP1
00000629: JUMP
0000062a: JUMPDEST
0000062b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000640: AND
00000641: CALLER
00000642: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000657: AND
00000658: EQ
00000659: DUP1
0000065a: PUSH2 0x0661
0000065d: JUMPI
0000065e: POP
0000065f: CALLER
00000660: ISZERO
00000661: JUMPDEST
00000662: ISZERO
00000663: PUSH2 0x068c
00000666: JUMPI
00000667: POP
00000668: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
00000689: SLOAD
0000068a: SWAP1
0000068b: JUMP
0000068c: JUMPDEST
0000068d: PUSH2 0x0694
00000690: PUSH2 0x0117
00000693: JUMP
00000694: JUMPDEST
00000695: SWAP1
00000696: JUMP
00000697: JUMPDEST
00000698: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
000006b9: SLOAD
000006ba: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000006cf: AND
000006d0: CALLER
000006d1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000006e6: AND
000006e7: EQ
000006e8: DUP1
000006e9: PUSH2 0x06f0
000006ec: JUMPI
000006ed: POP
000006ee: CALLER
000006ef: ISZERO
000006f0: JUMPDEST
000006f1: ISZERO
000006f2: PUSH2 0x06f9
000006f5: JUMPI
000006f6: SWAP1
000006f7: SSTORE
000006f8: JUMP
000006f9: JUMPDEST
000006fa: PUSH2 0x0701
000006fd: PUSH2 0x0117
00000700: JUMP
00000701: JUMPDEST
00000702: POP
00000703: POP
00000704: JUMP
00000705: JUMPDEST
00000706: PUSH1 0x00
00000708: PUSH2 0x072f
0000070b: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
0000072c: SLOAD
0000072d: SWAP1
0000072e: JUMP
0000072f: JUMPDEST
00000730: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000745: AND
00000746: CALLER
00000747: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000075c: AND
0000075d: EQ
0000075e: DUP1
0000075f: PUSH2 0x0766
00000762: JUMPI
00000763: POP
00000764: CALLER
00000765: ISZERO
00000766: JUMPDEST
00000767: ISZERO
00000768: PUSH2 0x068c
0000076b: JUMPI
0000076c: POP
0000076d: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
0000078e: SLOAD
0000078f: SWAP1
00000790: JUMP
00000791: JUMPDEST
00000792: PUSH1 0x00
00000794: PUSH1 0x20
00000796: DUP3
00000797: DUP5
00000798: SUB
00000799: SLT
0000079a: ISZERO
0000079b: PUSH2 0x07a3
0000079e: JUMPI
0000079f: PUSH1 0x00
000007a1: DUP1
000007a2: REVERT
000007a3: JUMPDEST
000007a4: DUP2
000007a5: CALLDATALOAD
000007a6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000007bb: DUP2
000007bc: AND
000007bd: DUP2
000007be: EQ
000007bf: PUSH2 0x07c7
000007c2: JUMPI
000007c3: PUSH1 0x00
000007c5: DUP1
000007c6: REVERT
000007c7: JUMPDEST
000007c8: SWAP4
000007c9: SWAP3
000007ca: POP
000007cb: POP
000007cc: POP
000007cd: JUMP
000007ce: JUMPDEST
000007cf: PUSH32 0x4e487b7100000000000000000000000000000000000000000000000000000000
000007f0: PUSH1 0x00
000007f2: MSTORE
000007f3: PUSH1 0x41
000007f5: PUSH1 0x04
000007f7: MSTORE
000007f8: PUSH1 0x24
000007fa: PUSH1 0x00
000007fc: REVERT
000007fd: JUMPDEST
000007fe: PUSH1 0x00
00000800: PUSH1 0x20
00000802: DUP3
00000803: DUP5
00000804: SUB
00000805: SLT
00000806: ISZERO
00000807: PUSH2 0x080f
0000080a: JUMPI
0000080b: PUSH1 0x00
0000080d: DUP1
0000080e: REVERT
0000080f: JUMPDEST
00000810: DUP2
00000811: CALLDATALOAD
00000812: PUSH8 0xffffffffffffffff
0000081b: DUP1
0000081c: DUP3
0000081d: GT
0000081e: ISZERO
0000081f: PUSH2 0x0827
00000822: JUMPI
00000823: PUSH1 0x00
00000825: DUP1
00000826: REVERT
00000827: JUMPDEST
00000828: DUP2
00000829: DUP5
0000082a: ADD
0000082b: SWAP2
0000082c: POP
0000082d: DUP5
0000082e: PUSH1 0x1f
00000830: DUP4
00000831: ADD
00000832: SLT
00000833: PUSH2 0x083b
00000836: JUMPI
00000837: PUSH1 0x00
00000839: DUP1
0000083a: REVERT
0000083b: JUMPDEST
0000083c: DUP2
0000083d: CALLDATALOAD
0000083e: DUP2
0000083f: DUP2
00000840: GT
00000841: ISZERO
00000842: PUSH2 0x084d
00000845: JUMPI
00000846: PUSH2 0x084d
00000849: PUSH2 0x07ce
0000084c: JUMP
0000084d: JUMPDEST
0000084e: PUSH1 0x40
00000850: MLOAD
00000851: PUSH1 0x1f
00000853: DUP3
00000854: ADD
00000855: PUSH32 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0
00000876: SWAP1
00000877: DUP2
00000878: AND
00000879: PUSH1 0x3f
0000087b: ADD
0000087c: AND
0000087d: DUP2
0000087e: ADD
0000087f: SWAP1
00000880: DUP4
00000881: DUP3
00000882: GT
00000883: DUP2
00000884: DUP4
00000885: LT
00000886: OR
00000887: ISZERO
00000888: PUSH2 0x0893
0000088b: JUMPI
0000088c: PUSH2 0x0893
0000088f: PUSH2 0x07ce
00000892: JUMP
00000893: JUMPDEST
00000894: DUP2
00000895: PUSH1 0x40
00000897: MSTORE
00000898: DUP3
00000899: DUP2
0000089a: MSTORE
0000089b: DUP8
0000089c: PUSH1 0x20
0000089e: DUP5
0000089f: DUP8
000008a0: ADD
000008a1: ADD
000008a2: GT
000008a3: ISZERO
000008a4: PUSH2 0x08ac
000008a7: JUMPI
000008a8: PUSH1 0x00
000008aa: DUP1
000008ab: REVERT
000008ac: JUMPDEST
000008ad: DUP3
000008ae: PUSH1 0x20
000008b0: DUP7
000008b1: ADD
000008b2: PUSH1 0x20
000008b4: DUP4
000008b5: ADD
000008b6: CALLDATACOPY
000008b7: PUSH1 0x00
000008b9: SWAP3
000008ba: DUP2
000008bb: ADD
000008bc: PUSH1 0x20
000008be: ADD
000008bf: SWAP3
000008c0: SWAP1
000008c1: SWAP3
000008c2: MSTORE
000008c3: POP
000008c4: SWAP6
000008c5: SWAP5
000008c6: POP
000008c7: POP
000008c8: POP
000008c9: POP
000008ca: POP
000008cb: JUMP
000008cc: JUMPDEST
000008cd: PUSH1 0x00
000008cf: DUP1
000008d0: PUSH1 0x40
000008d2: DUP4
000008d3: DUP6
000008d4: SUB
000008d5: SLT
000008d6: ISZERO
000008d7: PUSH2 0x08df
000008da: JUMPI
000008db: PUSH1 0x00
000008dd: DUP1
000008de: REVERT
000008df: JUMPDEST
000008e0: POP
000008e1: POP
000008e2: DUP1
000008e3: CALLDATALOAD
000008e4: SWAP3
000008e5: PUSH1 0x20
000008e7: SWAP1
000008e8: SWAP2
000008e9: ADD
000008ea: CALLDATALOAD
000008eb: SWAP2
000008ec: POP
000008ed: JUMP
000008ee: JUMPDEST
000008ef: PUSH1 0x00
000008f1: DUP2
000008f2: MLOAD
000008f3: PUSH1 0x00
000008f5: JUMPDEST
000008f6: DUP2
000008f7: DUP2
000008f8: LT
000008f9: ISZERO
000008fa: PUSH2 0x090f
000008fd: JUMPI
000008fe: PUSH1 0x20
00000900: DUP2
00000901: DUP6
00000902: ADD
00000903: DUP2
00000904: ADD
00000905: MLOAD
00000906: DUP7
00000907: DUP4
00000908: ADD
00000909: MSTORE
0000090a: ADD
0000090b: PUSH2 0x08f5
0000090e: JUMP
0000090f: JUMPDEST
00000910: POP
00000911: PUSH1 0x00
00000913: SWAP4
00000914: ADD
00000915: SWAP3
00000916: DUP4
00000917: MSTORE
00000918: POP
00000919: SWAP1
0000091a: SWAP2
0000091b: SWAP1
0000091c: POP
0000091d: JUMP
0000091e: JUMPDEST
0000091f: PUSH1 0x00
00000921: PUSH2 0x07c7
00000924: DUP3
00000925: DUP5
00000926: PUSH2 0x08ee
00000929: JUMP
0000092a: JUMPDEST
0000092b: PUSH1 0x00
0000092d: PUSH1 0x20
0000092f: DUP3
00000930: DUP5
00000931: SUB
00000932: SLT
00000933: ISZERO
00000934: PUSH2 0x093c
00000937: JUMPI
00000938: PUSH1 0x00
0000093a: DUP1
0000093b: REVERT
0000093c: JUMPDEST
0000093d: POP
0000093e: MLOAD
0000093f: SWAP2
00000940: SWAP1
00000941: POP
00000942: JUMP
00000943: JUMPDEST
00000944: PUSH32 0xffffffffffffffffffffffffff00000000000000000000000000000000000000
00000965: DUP4
00000966: AND
00000967: DUP2
00000968: MSTORE
00000969: PUSH1 0x00
0000096b: PUSH2 0x0977
0000096e: PUSH1 0x0d
00000970: DUP4
00000971: ADD
00000972: DUP5
00000973: PUSH2 0x08ee
00000976: JUMP
00000977: JUMPDEST
00000978: SWAP5
00000979: SWAP4
0000097a: POP
0000097b: POP
0000097c: POP
0000097d: POP
0000097e: JUMP
0000097f: INVALID
00000980: LOG2
00000981: PUSH5 0x6970667358
00000987: UNKNOWN(0x22)
00000988: SLT
00000989: KECCAK256
0000098a: SAR
0000098b: RETURN
0000098c: NOT
0000098d: GASLIMIT
0000098e: ADDRESS
0000098f: UNKNOWN(0x0C)
00000990: UNKNOWN(0xC8)
00000991: SLOAD
00000992: UNKNOWN(0x0E)
00000993: BLOBBASEFEE
00000994: SWAP7
00000995: PUSH4 0x2ea4d49d
0000099a: UNKNOWN(0xC8)
0000099b: UNKNOWN(0x29)
0000099c: UNKNOWN(0xEA)
0000099d: UNKNOWN(0xB7)
0000099e: SELFDESTRUCT
0000099f: UNKNOWN(0x2B)
000009a0: LOG2
000009a1: INVALID
000009a2: UNKNOWN(0xFB)
000009a3: UNKNOWN(0x23)
000009a4: UNKNOWN(0xA8)
000009a5: UNKNOWN(0xE5)
000009a6: PUSH0
000009a7: PUSH21

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	upgradeability	detector	Untrusted DELEGATECALL target reachable	55	yes	yes	view trace_id: 0x4cc5822e2742d3dbbe3f55203b44846f67ffc7b93cfc50c4c31156be2a027eab call_targets: 0xa037b01bf218e87144446e9e87dd9dc58033fb57, 0xd9db270c1b5e3bd161e8c8503c55ceabee709552 target_varies: yes classification: target_varies validation_json { "sink": "DELEGATECALL", "errors": 0, "status": "confirmed", "attempts": 1, "trace_id": "0x4cc5822e2742d3dbbe3f55203b44846f67ffc7b93cfc50c4c31156be2a027eab", "confirmed": true, "trace_mode": "callTracer", "call_targets": [ "0xa037b01bf218e87144446e9e87dd9dc58033fb57", "0xd9db270c1b5e3bd161e8c8503c55ceabee709552" ], "matched_probe": null, "target_varies": true, "classification": "target_varies" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x893d20e8", "selector": "0x893d20e8", "calldata_variants": [ "0x893d20e8", "0x893d20e80000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x9b0b0fda", "selector": "0x9b0b0fda", "calldata_variants": [ "0x9b0b0fda", "0x9b0b0fda0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xaaf10f42", "selector": "0xaaf10f42", "calldata_variants": [ "0xaaf10f42", "0xaaf10f420000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x13af4035", "selector": "0x13af4035", "calldata_variants": [ "0x13af4035", "0x13af40350000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x6c5d4ad0", "selector": "0x6c5d4ad0", "calldata_variants": [ "0x6c5d4ad0", "0x6c5d4ad00000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 933, "opcode": "DELEGATECALL", "returndata_checked": null, "value_expression_category": "n/a", "target_expression_category": "computed" } ], "guards_detected": [ { "pc": 1011, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1156, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1601, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1744, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1862, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" } ], "delegatecall_count": 1, "untrusted_delegatecall_count": 1 }
medium	other	detector	SELFDESTRUCT reachable	45	no	no	view trace_id: 0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d validation_json { "sink": "SELFDESTRUCT", "errors": 0, "status": "unknown", "attempts": 10, "trace_id": "0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d", "confirmed": false, "trace_mode": "structLogs", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "no_sink" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x893d20e8", "selector": "0x893d20e8", "calldata_variants": [ "0x893d20e8", "0x893d20e80000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x9b0b0fda", "selector": "0x9b0b0fda", "calldata_variants": [ "0x9b0b0fda", "0x9b0b0fda0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xaaf10f42", "selector": "0xaaf10f42", "calldata_variants": [ "0xaaf10f42", "0xaaf10f420000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x13af4035", "selector": "0x13af4035", "calldata_variants": [ "0x13af4035", "0x13af40350000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x6c5d4ad0", "selector": "0x6c5d4ad0", "calldata_variants": [ "0x6c5d4ad0", "0x6c5d4ad00000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "guards_detected": [ { "pc": 1011, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1156, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1601, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1744, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" }, { "pc": 1862, "type": "msg_sender_eq_const", "value": "0xffffffffffffffffffffffffffffffffffffffff" } ], "selfdestruct_count": 1 }
medium	other	detector	CREATE/CREATE2 reachable	45	no	no	view trace_id: 0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d validation_json { "sink": "CREATE", "errors": 0, "status": "unknown", "attempts": 10, "trace_id": "0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d", "confirmed": false, "trace_mode": "structLogs", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "no_sink" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x893d20e8", "selector": "0x893d20e8", "calldata_variants": [ "0x893d20e8", "0x893d20e80000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x9b0b0fda", "selector": "0x9b0b0fda", "calldata_variants": [ "0x9b0b0fda", "0x9b0b0fda0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xaaf10f42", "selector": "0xaaf10f42", "calldata_variants": [ "0xaaf10f42", "0xaaf10f420000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x13af4035", "selector": "0x13af4035", "calldata_variants": [ "0x13af4035", "0x13af40350000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x6c5d4ad0", "selector": "0x6c5d4ad0", "calldata_variants": [ "0x6c5d4ad0", "0x6c5d4ad00000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "create_count": 1, "create2_count": 0 }

Severity

Category

Tool

Title

Confidence

Validated

Confirmed

Details

high

upgradeability

detector

Untrusted DELEGATECALL target reachable

55

yes

view

trace_id: 0x4cc5822e2742d3dbbe3f55203b44846f67ffc7b93cfc50c4c31156be2a027eab

call_targets: 0xa037b01bf218e87144446e9e87dd9dc58033fb57, 0xd9db270c1b5e3bd161e8c8503c55ceabee709552

target_varies: yes

classification: target_varies

validation_json

{
    "sink": "DELEGATECALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0x4cc5822e2742d3dbbe3f55203b44846f67ffc7b93cfc50c4c31156be2a027eab",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xa037b01bf218e87144446e9e87dd9dc58033fb57",
        "0xd9db270c1b5e3bd161e8c8503c55ceabee709552"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x893d20e8",
            "selector": "0x893d20e8",
            "calldata_variants": [
                "0x893d20e8",
                "0x893d20e80000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9b0b0fda",
            "selector": "0x9b0b0fda",
            "calldata_variants": [
                "0x9b0b0fda",
                "0x9b0b0fda0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xaaf10f42",
            "selector": "0xaaf10f42",
            "calldata_variants": [
                "0xaaf10f42",
                "0xaaf10f420000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x6c5d4ad0",
            "selector": "0x6c5d4ad0",
            "calldata_variants": [
                "0x6c5d4ad0",
                "0x6c5d4ad00000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "examples": [
        {
            "pc": 933,
            "opcode": "DELEGATECALL",
            "returndata_checked": null,
            "value_expression_category": "n/a",
            "target_expression_category": "computed"
        }
    ],
    "guards_detected": [
        {
            "pc": 1011,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1156,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1601,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1744,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1862,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        }
    ],
    "delegatecall_count": 1,
    "untrusted_delegatecall_count": 1
}

medium

other

detector

SELFDESTRUCT reachable

45

no

view

trace_id: 0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d

validation_json

{
    "sink": "SELFDESTRUCT",
    "errors": 0,
    "status": "unknown",
    "attempts": 10,
    "trace_id": "0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d",
    "confirmed": false,
    "trace_mode": "structLogs",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x893d20e8",
            "selector": "0x893d20e8",
            "calldata_variants": [
                "0x893d20e8",
                "0x893d20e80000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9b0b0fda",
            "selector": "0x9b0b0fda",
            "calldata_variants": [
                "0x9b0b0fda",
                "0x9b0b0fda0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xaaf10f42",
            "selector": "0xaaf10f42",
            "calldata_variants": [
                "0xaaf10f42",
                "0xaaf10f420000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x6c5d4ad0",
            "selector": "0x6c5d4ad0",
            "calldata_variants": [
                "0x6c5d4ad0",
                "0x6c5d4ad00000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "guards_detected": [
        {
            "pc": 1011,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1156,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1601,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1744,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        },
        {
            "pc": 1862,
            "type": "msg_sender_eq_const",
            "value": "0xffffffffffffffffffffffffffffffffffffffff"
        }
    ],
    "selfdestruct_count": 1
}

medium

other

detector

CREATE/CREATE2 reachable

45

no

view

trace_id: 0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d

validation_json

{
    "sink": "CREATE",
    "errors": 0,
    "status": "unknown",
    "attempts": 10,
    "trace_id": "0x3bb786260d89b96febfe67c31ccf544c424f45bd2d0cba89ffcafc724f85313d",
    "confirmed": false,
    "trace_mode": "structLogs",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x893d20e8",
            "selector": "0x893d20e8",
            "calldata_variants": [
                "0x893d20e8",
                "0x893d20e80000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x9b0b0fda",
            "selector": "0x9b0b0fda",
            "calldata_variants": [
                "0x9b0b0fda",
                "0x9b0b0fda0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xaaf10f42",
            "selector": "0xaaf10f42",
            "calldata_variants": [
                "0xaaf10f42",
                "0xaaf10f420000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x13af4035",
            "selector": "0x13af4035",
            "calldata_variants": [
                "0x13af4035",
                "0x13af40350000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x6c5d4ad0",
            "selector": "0x6c5d4ad0",
            "calldata_variants": [
                "0x6c5d4ad0",
                "0x6c5d4ad00000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "create_count": 1,
    "create2_count": 0
}