Analysis Run

019b477e-db0b-73b5-93e4-c49488390821

complete

Chain ID

1

Address

0x60abb4a83a782a6a4b07d8e1b86b258aae820953

Block Number

—

Created

Mon, Dec 22, 2025 7:17 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Bytecode only

Review Backing

Not yet

Best current signal

Untrusted CALL target/value reachable

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
29573	artifact.fetch	complete	1 / 3	3 months ago
29574	tool.cast_disasm	complete	1 / 3	3 months ago
108485	analysis.bundle	complete	1 / 3	1 week ago
108486	capability.graph	complete	1 / 3	1 week ago
108487	detector.run	complete	1 / 3	1 week ago
108488	validation.fork	complete	1 / 3	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

0

Selfdestruct

0

CREATE2

0

CALL-family (heavy)

2

EXT*/BALANCE

0

Total opcodes

563

Flags

No heuristic flags raised.

View cast disassembly output

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x0041
0000000c: JUMPI
0000000d: PUSH0
0000000e: CALLDATALOAD
0000000f: PUSH1 0xe0
00000011: SHR
00000012: DUP1
00000013: PUSH4 0x81f1a65f
00000018: EQ
00000019: PUSH2 0x004c
0000001c: JUMPI
0000001d: DUP1
0000001e: PUSH4 0x853828b6
00000023: EQ
00000024: PUSH2 0x0080
00000027: JUMPI
00000028: DUP1
00000029: PUSH4 0x8da5cb5b
0000002e: EQ
0000002f: PUSH2 0x0096
00000032: JUMPI
00000033: DUP1
00000034: PUSH4 0xd0e30db0
00000039: EQ
0000003a: PUSH2 0x0094
0000003d: JUMPI
0000003e: PUSH0
0000003f: DUP1
00000040: REVERT
00000041: JUMPDEST
00000042: CALLDATASIZE
00000043: PUSH2 0x0048
00000046: JUMPI
00000047: STOP
00000048: JUMPDEST
00000049: PUSH0
0000004a: DUP1
0000004b: REVERT
0000004c: JUMPDEST
0000004d: CALLVALUE
0000004e: DUP1
0000004f: ISZERO
00000050: PUSH2 0x0057
00000053: JUMPI
00000054: PUSH0
00000055: DUP1
00000056: REVERT
00000057: JUMPDEST
00000058: POP
00000059: PUSH2 0x006b
0000005c: PUSH2 0x0066
0000005f: CALLDATASIZE
00000060: PUSH1 0x04
00000062: PUSH2 0x032b
00000065: JUMP
00000066: JUMPDEST
00000067: PUSH2 0x00cc
0000006a: JUMP
0000006b: JUMPDEST
0000006c: PUSH1 0x40
0000006e: MLOAD
0000006f: SWAP1
00000070: ISZERO
00000071: ISZERO
00000072: DUP2
00000073: MSTORE
00000074: PUSH1 0x20
00000076: ADD
00000077: JUMPDEST
00000078: PUSH1 0x40
0000007a: MLOAD
0000007b: DUP1
0000007c: SWAP2
0000007d: SUB
0000007e: SWAP1
0000007f: RETURN
00000080: JUMPDEST
00000081: CALLVALUE
00000082: DUP1
00000083: ISZERO
00000084: PUSH2 0x008b
00000087: JUMPI
00000088: PUSH0
00000089: DUP1
0000008a: REVERT
0000008b: JUMPDEST
0000008c: POP
0000008d: PUSH2 0x0094
00000090: PUSH2 0x0204
00000093: JUMP
00000094: JUMPDEST
00000095: STOP
00000096: JUMPDEST
00000097: CALLVALUE
00000098: DUP1
00000099: ISZERO
0000009a: PUSH2 0x00a1
0000009d: JUMPI
0000009e: PUSH0
0000009f: DUP1
000000a0: REVERT
000000a1: JUMPDEST
000000a2: POP
000000a3: PUSH0
000000a4: SLOAD
000000a5: PUSH2 0x00b4
000000a8: SWAP1
000000a9: PUSH1 0x01
000000ab: PUSH1 0x01
000000ad: PUSH1 0xa0
000000af: SHL
000000b0: SUB
000000b1: AND
000000b2: DUP2
000000b3: JUMP
000000b4: JUMPDEST
000000b5: PUSH1 0x40
000000b7: MLOAD
000000b8: PUSH1 0x01
000000ba: PUSH1 0x01
000000bc: PUSH1 0xa0
000000be: SHL
000000bf: SUB
000000c0: SWAP1
000000c1: SWAP2
000000c2: AND
000000c3: DUP2
000000c4: MSTORE
000000c5: PUSH1 0x20
000000c7: ADD
000000c8: PUSH2 0x0077
000000cb: JUMP
000000cc: JUMPDEST
000000cd: PUSH0
000000ce: DUP1
000000cf: SLOAD
000000d0: PUSH1 0x01
000000d2: PUSH1 0x01
000000d4: PUSH1 0xa0
000000d6: SHL
000000d7: SUB
000000d8: AND
000000d9: CALLER
000000da: EQ
000000db: PUSH2 0x011c
000000de: JUMPI
000000df: PUSH1 0x40
000000e1: MLOAD
000000e2: PUSH3 0x461bcd
000000e6: PUSH1 0xe5
000000e8: SHL
000000e9: DUP2
000000ea: MSTORE
000000eb: PUSH1 0x20
000000ed: PUSH1 0x04
000000ef: DUP3
000000f0: ADD
000000f1: MSTORE
000000f2: PUSH1 0x0e
000000f4: PUSH1 0x24
000000f6: DUP3
000000f7: ADD
000000f8: MSTORE
000000f9: PUSH14 0x139bdd08185d5d1a1bdc9a5e9959
00000108: PUSH1 0x92
0000010a: SHL
0000010b: PUSH1 0x44
0000010d: DUP3
0000010e: ADD
0000010f: MSTORE
00000110: PUSH1 0x64
00000112: ADD
00000113: JUMPDEST
00000114: PUSH1 0x40
00000116: MLOAD
00000117: DUP1
00000118: SWAP2
00000119: SUB
0000011a: SWAP1
0000011b: REVERT
0000011c: JUMPDEST
0000011d: DUP2
0000011e: SELFBALANCE
0000011f: LT
00000120: ISZERO
00000121: PUSH2 0x016c
00000124: JUMPI
00000125: PUSH1 0x40
00000127: MLOAD
00000128: PUSH3 0x461bcd
0000012c: PUSH1 0xe5
0000012e: SHL
0000012f: DUP2
00000130: MSTORE
00000131: PUSH1 0x20
00000133: PUSH1 0x04
00000135: DUP3
00000136: ADD
00000137: DUP2
00000138: SWAP1
00000139: MSTORE
0000013a: PUSH1 0x24
0000013c: DUP3
0000013d: ADD
0000013e: MSTORE
0000013f: PUSH32 0x496e73756666696369656e742062616c616e636520696e20636f6e7472616374
00000160: PUSH1 0x44
00000162: DUP3
00000163: ADD
00000164: MSTORE
00000165: PUSH1 0x64
00000167: ADD
00000168: PUSH2 0x0113
0000016b: JUMP
0000016c: JUMPDEST
0000016d: PUSH0
0000016e: DUP4
0000016f: PUSH1 0x01
00000171: PUSH1 0x01
00000173: PUSH1 0xa0
00000175: SHL
00000176: SUB
00000177: AND
00000178: DUP4
00000179: PUSH1 0x40
0000017b: MLOAD
0000017c: PUSH0
0000017d: PUSH1 0x40
0000017f: MLOAD
00000180: DUP1
00000181: DUP4
00000182: SUB
00000183: DUP2
00000184: DUP6
00000185: DUP8
00000186: GAS
00000187: CALL
00000188: SWAP3
00000189: POP
0000018a: POP
0000018b: POP
0000018c: RETURNDATASIZE
0000018d: DUP1
0000018e: PUSH0
0000018f: DUP2
00000190: EQ
00000191: PUSH2 0x01b5
00000194: JUMPI
00000195: PUSH1 0x40
00000197: MLOAD
00000198: SWAP2
00000199: POP
0000019a: PUSH1 0x1f
0000019c: NOT
0000019d: PUSH1 0x3f
0000019f: RETURNDATASIZE
000001a0: ADD
000001a1: AND
000001a2: DUP3
000001a3: ADD
000001a4: PUSH1 0x40
000001a6: MSTORE
000001a7: RETURNDATASIZE
000001a8: DUP3
000001a9: MSTORE
000001aa: RETURNDATASIZE
000001ab: PUSH0
000001ac: PUSH1 0x20
000001ae: DUP5
000001af: ADD
000001b0: RETURNDATACOPY
000001b1: PUSH2 0x01ba
000001b4: JUMP
000001b5: JUMPDEST
000001b6: PUSH1 0x60
000001b8: SWAP2
000001b9: POP
000001ba: JUMPDEST
000001bb: POP
000001bc: POP
000001bd: SWAP1
000001be: POP
000001bf: DUP1
000001c0: PUSH2 0x01fd
000001c3: JUMPI
000001c4: PUSH1 0x40
000001c6: MLOAD
000001c7: PUSH3 0x461bcd
000001cb: PUSH1 0xe5
000001cd: SHL
000001ce: DUP2
000001cf: MSTORE
000001d0: PUSH1 0x20
000001d2: PUSH1 0x04
000001d4: DUP3
000001d5: ADD
000001d6: MSTORE
000001d7: PUSH1 0x0f
000001d9: PUSH1 0x24
000001db: DUP3
000001dc: ADD
000001dd: MSTORE
000001de: PUSH15 0x151c985b9cd9995c8819985a5b1959
000001ee: PUSH1 0x8a
000001f0: SHL
000001f1: PUSH1 0x44
000001f3: DUP3
000001f4: ADD
000001f5: MSTORE
000001f6: PUSH1 0x64
000001f8: ADD
000001f9: PUSH2 0x0113
000001fc: JUMP
000001fd: JUMPDEST
000001fe: SWAP4
000001ff: SWAP3
00000200: POP
00000201: POP
00000202: POP
00000203: JUMP
00000204: JUMPDEST
00000205: PUSH0
00000206: SLOAD
00000207: PUSH1 0x01
00000209: PUSH1 0x01
0000020b: PUSH1 0xa0
0000020d: SHL
0000020e: SUB
0000020f: AND
00000210: CALLER
00000211: EQ
00000212: PUSH2 0x024e
00000215: JUMPI
00000216: PUSH1 0x40
00000218: MLOAD
00000219: PUSH3 0x461bcd
0000021d: PUSH1 0xe5
0000021f: SHL
00000220: DUP2
00000221: MSTORE
00000222: PUSH1 0x20
00000224: PUSH1 0x04
00000226: DUP3
00000227: ADD
00000228: MSTORE
00000229: PUSH1 0x0e
0000022b: PUSH1 0x24
0000022d: DUP3
0000022e: ADD
0000022f: MSTORE
00000230: PUSH14 0x139bdd08185d5d1a1bdc9a5e9959
0000023f: PUSH1 0x92
00000241: SHL
00000242: PUSH1 0x44
00000244: DUP3
00000245: ADD
00000246: MSTORE
00000247: PUSH1 0x64
00000249: ADD
0000024a: PUSH2 0x0113
0000024d: JUMP
0000024e: JUMPDEST
0000024f: SELFBALANCE
00000250: DUP1
00000251: PUSH2 0x0293
00000254: JUMPI
00000255: PUSH1 0x40
00000257: MLOAD
00000258: PUSH3 0x461bcd
0000025c: PUSH1 0xe5
0000025e: SHL
0000025f: DUP2
00000260: MSTORE
00000261: PUSH1 0x20
00000263: PUSH1 0x04
00000265: DUP3
00000266: ADD
00000267: MSTORE
00000268: PUSH1 0x14
0000026a: PUSH1 0x24
0000026c: DUP3
0000026d: ADD
0000026e: MSTORE
0000026f: PUSH20 0x4e6f2066756e647320746f207769746864726177
00000284: PUSH1 0x60
00000286: SHL
00000287: PUSH1 0x44
00000289: DUP3
0000028a: ADD
0000028b: MSTORE
0000028c: PUSH1 0x64
0000028e: ADD
0000028f: PUSH2 0x0113
00000292: JUMP
00000293: JUMPDEST
00000294: PUSH0
00000295: DUP1
00000296: SLOAD
00000297: PUSH1 0x40
00000299: MLOAD
0000029a: PUSH1 0x01
0000029c: PUSH1 0x01
0000029e: PUSH1 0xa0
000002a0: SHL
000002a1: SUB
000002a2: SWAP1
000002a3: SWAP2
000002a4: AND
000002a5: SWAP1
000002a6: DUP4
000002a7: SWAP1
000002a8: DUP4
000002a9: DUP2
000002aa: DUP2
000002ab: DUP2
000002ac: DUP6
000002ad: DUP8
000002ae: GAS
000002af: CALL
000002b0: SWAP3
000002b1: POP
000002b2: POP
000002b3: POP
000002b4: RETURNDATASIZE
000002b5: DUP1
000002b6: PUSH0
000002b7: DUP2
000002b8: EQ
000002b9: PUSH2 0x02dd
000002bc: JUMPI
000002bd: PUSH1 0x40
000002bf: MLOAD
000002c0: SWAP2
000002c1: POP
000002c2: PUSH1 0x1f
000002c4: NOT
000002c5: PUSH1 0x3f
000002c7: RETURNDATASIZE
000002c8: ADD
000002c9: AND
000002ca: DUP3
000002cb: ADD
000002cc: PUSH1 0x40
000002ce: MSTORE
000002cf: RETURNDATASIZE
000002d0: DUP3
000002d1: MSTORE
000002d2: RETURNDATASIZE
000002d3: PUSH0
000002d4: PUSH1 0x20
000002d6: DUP5
000002d7: ADD
000002d8: RETURNDATACOPY
000002d9: PUSH2 0x02e2
000002dc: JUMP
000002dd: JUMPDEST
000002de: PUSH1 0x60
000002e0: SWAP2
000002e1: POP
000002e2: JUMPDEST
000002e3: POP
000002e4: POP
000002e5: SWAP1
000002e6: POP
000002e7: DUP1
000002e8: PUSH2 0x0327
000002eb: JUMPI
000002ec: PUSH1 0x40
000002ee: MLOAD
000002ef: PUSH3 0x461bcd
000002f3: PUSH1 0xe5
000002f5: SHL
000002f6: DUP2
000002f7: MSTORE
000002f8: PUSH1 0x20
000002fa: PUSH1 0x04
000002fc: DUP3
000002fd: ADD
000002fe: MSTORE
000002ff: PUSH1 0x11
00000301: PUSH1 0x24
00000303: DUP3
00000304: ADD
00000305: MSTORE
00000306: PUSH17 0x15da5d1a191c985dd85b0819985a5b1959
00000318: PUSH1 0x7a
0000031a: SHL
0000031b: PUSH1 0x44
0000031d: DUP3
0000031e: ADD
0000031f: MSTORE
00000320: PUSH1 0x64
00000322: ADD
00000323: PUSH2 0x0113
00000326: JUMP
00000327: JUMPDEST
00000328: POP
00000329: POP
0000032a: JUMP
0000032b: JUMPDEST
0000032c: PUSH0
0000032d: DUP1
0000032e: PUSH1 0x40
00000330: DUP4
00000331: DUP6
00000332: SUB
00000333: SLT
00000334: ISZERO
00000335: PUSH2 0x033c
00000338: JUMPI
00000339: PUSH0
0000033a: DUP1
0000033b: REVERT
0000033c: JUMPDEST
0000033d: DUP3
0000033e: CALLDATALOAD
0000033f: PUSH1 0x01
00000341: PUSH1 0x01
00000343: PUSH1 0xa0
00000345: SHL
00000346: SUB
00000347: DUP2
00000348: AND
00000349: DUP2
0000034a: EQ
0000034b: PUSH2 0x0352
0000034e: JUMPI
0000034f: PUSH0
00000350: DUP1
00000351: REVERT
00000352: JUMPDEST
00000353: SWAP5
00000354: PUSH1 0x20
00000356: SWAP4
00000357: SWAP1
00000358: SWAP4
00000359: ADD
0000035a: CALLDATALOAD
0000035b: SWAP4
0000035c: POP
0000035d: POP
0000035e: POP
0000035f: JUMP
00000360: INVALID
00000361: LOG2
00000362: PUSH5 0x6970667358
00000368: UNKNOWN(0x22)
00000369: SLT
0000036a: KECCAK256
0000036b: DUP3
0000036c: PUSH16 0xa14c379533373ee543240ebb80525698
0000037d: UNKNOWN(0xC8)
0000037e: UNKNOWN(0x4C)
0000037f: DUP5
00000380: PUSH19 0x2e9a465c3e2524b1d0bd64736f6c6343000818
00000394: STOP
00000395: CALLER

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	other	detector	Untrusted CALL target/value reachable	60	no	no	view trace_id: 0xf9bc4663bcf4725a775a009a6f447e0fe33075bdf99a2994c7d95e6c6eae400e call_targets: 0x60abb4a83a782a6a4b07d8e1b86b258aae820953 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xf9bc4663bcf4725a775a009a6f447e0fe33075bdf99a2994c7d95e6c6eae400e", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0x60abb4a83a782a6a4b07d8e1b86b258aae820953" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x81f1a65f", "selector": "0x81f1a65f", "calldata_variants": [ "0x81f1a65f", "0x81f1a65f0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x853828b6", "selector": "0x853828b6", "calldata_variants": [ "0x853828b6", "0x853828b60000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xd0e30db0", "selector": "0xd0e30db0", "calldata_variants": [ "0xd0e30db0", "0xd0e30db00000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 391, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" }, { "pc": 687, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "call_count": 2, "guards_detected": [], "untrusted_call_count": 2 }
high	other	detector	ETH value transfer possible	55	no	no	view trace_id: 0xf9bc4663bcf4725a775a009a6f447e0fe33075bdf99a2994c7d95e6c6eae400e call_targets: 0x60abb4a83a782a6a4b07d8e1b86b258aae820953 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xf9bc4663bcf4725a775a009a6f447e0fe33075bdf99a2994c7d95e6c6eae400e", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0x60abb4a83a782a6a4b07d8e1b86b258aae820953" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x81f1a65f", "selector": "0x81f1a65f", "calldata_variants": [ "0x81f1a65f", "0x81f1a65f0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x853828b6", "selector": "0x853828b6", "calldata_variants": [ "0x853828b6", "0x853828b60000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x8da5cb5b", "selector": "0x8da5cb5b", "calldata_variants": [ "0x8da5cb5b", "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0xd0e30db0", "selector": "0xd0e30db0", "calldata_variants": [ "0xd0e30db0", "0xd0e30db00000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 391, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" }, { "pc": 687, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "eth_value_calls": 2, "guards_detected": [] }

Severity

Category

Tool

Title

Confidence

Validated

Confirmed

Details

high

other

detector

Untrusted CALL target/value reachable

60

no

view

trace_id: 0xf9bc4663bcf4725a775a009a6f447e0fe33075bdf99a2994c7d95e6c6eae400e

call_targets: 0x60abb4a83a782a6a4b07d8e1b86b258aae820953

target_varies: no

classification: constant_target

validation_json

{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0xf9bc4663bcf4725a775a009a6f447e0fe33075bdf99a2994c7d95e6c6eae400e",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x60abb4a83a782a6a4b07d8e1b86b258aae820953"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}

witness_json

{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x81f1a65f",
            "selector": "0x81f1a65f",
            "calldata_variants": [
                "0x81f1a65f",
                "0x81f1a65f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x853828b6",
            "selector": "0x853828b6",
            "calldata_variants": [
                "0x853828b6",
                "0x853828b60000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x8da5cb5b",
            "selector": "0x8da5cb5b",
            "calldata_variants": [
                "0x8da5cb5b",
                "0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xd0e30db0",
            "selector": "0xd0e30db0",
            "calldata_variants": [
                "0xd0e30db0",
                "0xd0e30db00000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}

evidence_json

{
    "examples": [
        {
            "pc": 391,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 687,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 2,
    "guards_detected": [],
    "untrusted_call_count": 2
}