019ba8f8-3f44-7130-8048-1aab00f38f78
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 33711 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 33712 | proxy.resolve | complete | 1 / 3 | 3 months ago |
| 33713 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 33714 | analysis.bundle | complete | 1 / 3 | 3 months ago |
| 33715 | capability.graph | complete | 1 / 3 | 3 months ago |
| 33716 | detector.run | complete | 1 / 3 | 3 months ago |
| 33717 | validation.fork | complete | 1 / 3 | 3 months ago |
{
"method": "minimal_proxy",
"status": "onchain_only",
"implementation": "0x1ef0159071b2a5898024cef4b4f78c171b7f48a8",
"onchain_method": "minimal_proxy"
}
No slither job recorded yet.
No codex job recorded yet.
00000000: CALLDATASIZE 00000001: RETURNDATASIZE 00000002: RETURNDATASIZE 00000003: CALLDATACOPY 00000004: RETURNDATASIZE 00000005: RETURNDATASIZE 00000006: RETURNDATASIZE 00000007: CALLDATASIZE 00000008: RETURNDATASIZE 00000009: PUSH20 0x1ef0159071b2a5898024cef4b4f78c171b7f48a8 0000001e: GAS 0000001f: DELEGATECALL 00000020: RETURNDATASIZE 00000021: DUP3 00000022: DUP1 00000023: RETURNDATACOPY 00000024: SWAP1 00000025: RETURNDATASIZE 00000026: SWAP2 00000027: PUSH1 0x2b 00000029: JUMPI 0000002a: REVERT 0000002b: JUMPDEST 0000002c: RETURN
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | upgradeability | detector | Untrusted DELEGATECALL target reachable | 70 | no | no |
viewtrace_id: 0xffc5e11f1016a228205c262e85efbb660960944a2b5acdc09d9d949c8869d0e6
call_targets:
0x1ef0159071b2a5898024cef4b4f78c171b7f48a8
target_varies:
no
classification:
constant_target
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0xffc5e11f1016a228205c262e85efbb660960944a2b5acdc09d9d949c8869d0e6",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x1ef0159071b2a5898024cef4b4f78c171b7f48a8"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x",
"selector": "fallback",
"calldata_variants": [
"0x"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 31,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [],
"delegatecall_count": 1,
"untrusted_delegatecall_count": 1
}
|
| medium | upgradeability | cast | DELEGATECALL present | 80 | no | — |
viewevidence_json{
"notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
"delegatecall_count": 1
}
|