019ba8a5-0033-71fe-bc4e-0ba640586db1
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 32425 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 32426 | proxy.resolve | complete | 1 / 3 | 3 months ago |
| 32427 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 32428 | analysis.bundle | complete | 1 / 3 | 3 months ago |
| 32429 | capability.graph | complete | 1 / 3 | 3 months ago |
| 32430 | detector.run | complete | 1 / 3 | 3 months ago |
| 32431 | validation.fork | complete | 1 / 3 | 3 months ago |
{
"method": "etherscan+onchain",
"status": "confirmed",
"etherscan_hint": {
"source": "etherscan",
"etherscan": {
"proxy_flag": true,
"implementation": "0x1b38a250c3dab104e4299f5be2957dfe0aee5e83"
}
},
"implementation": "0x1b38a250c3dab104e4299f5be2957dfe0aee5e83",
"onchain_method": "eip1967"
}
No slither job recorded yet.
No codex job recorded yet.
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc 00000026: SLOAD 00000027: PUSH0 00000028: SWAP1 00000029: DUP2 0000002a: SWAP1 0000002b: PUSH1 0x01 0000002d: PUSH1 0x01 0000002f: PUSH1 0xa0 00000031: SHL 00000032: SUB 00000033: AND 00000034: CALLDATASIZE 00000035: DUP3 00000036: DUP1 00000037: CALLDATACOPY 00000038: DUP2 00000039: CALLDATASIZE 0000003a: SWAP2 0000003b: GAS 0000003c: DELEGATECALL 0000003d: RETURNDATASIZE 0000003e: PUSH0 0000003f: DUP1 00000040: RETURNDATACOPY 00000041: ISZERO 00000042: PUSH1 0x48 00000044: JUMPI 00000045: RETURNDATASIZE 00000046: PUSH0 00000047: RETURN 00000048: JUMPDEST 00000049: RETURNDATASIZE 0000004a: PUSH0 0000004b: REVERT 0000004c: INVALID 0000004d: LOG1 0000004e: PUSH5 0x736f6c6343 00000054: STOP 00000055: ADDMOD 00000056: BYTE 00000057: STOP 00000058: EXP
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | upgradeability | detector | Untrusted DELEGATECALL target reachable | 70 | no | no |
viewtrace_id: 0x54d20a3497538185eabe6e7ec10c7fefc1ea395e4b1d6b057c77ab566afdb104
call_targets:
0x1b38a250c3dab104e4299f5be2957dfe0aee5e83
target_varies:
no
classification:
constant_target
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x54d20a3497538185eabe6e7ec10c7fefc1ea395e4b1d6b057c77ab566afdb104",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x1b38a250c3dab104e4299f5be2957dfe0aee5e83"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x",
"selector": "fallback",
"calldata_variants": [
"0x"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 60,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [],
"delegatecall_count": 1,
"untrusted_delegatecall_count": 1
}
|
| medium | upgradeability | cast | DELEGATECALL present | 80 | no | — |
viewevidence_json{
"notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
"delegatecall_count": 1
}
|
| info | upgradeability | cast | Likely proxy-like runtime | 60 | no | — |
viewevidence_json{
"notes": "short runtime with SLOAD and DELEGATECALL resembles minimal proxy/upgradeable pattern",
"sload_count": 1,
"total_opcodes": 46,
"delegatecall_count": 1
}
|