019ba940-898c-70bb-a65a-ef94c50ed761
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 36623 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 36624 | proxy.resolve | complete | 1 / 3 | 3 months ago |
| 36625 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 36626 | analysis.bundle | complete | 1 / 3 | 3 months ago |
| 36627 | capability.graph | complete | 1 / 3 | 3 months ago |
| 36628 | detector.run | complete | 1 / 3 | 3 months ago |
| 36629 | validation.fork | complete | 1 / 3 | 3 months ago |
{
"status": "not_proxy"
}
No slither job recorded yet.
No codex job recorded yet.
00000000: PUSH1 0x60 00000002: PUSH1 0x40 00000004: MSTORE 00000005: CALLDATASIZE 00000006: ISZERO 00000007: PUSH2 0x0055 0000000a: JUMPI 0000000b: PUSH1 0x00 0000000d: CALLDATALOAD 0000000e: PUSH29 0x0100000000000000000000000000000000000000000000000000000000 0000002c: SWAP1 0000002d: DIV 0000002e: PUSH4 0xffffffff 00000033: AND 00000034: DUP1 00000035: PUSH4 0x66117276 0000003a: EQ 0000003b: PUSH2 0x0148 0000003e: JUMPI 0000003f: DUP1 00000040: PUSH4 0x82c90ac0 00000045: EQ 00000046: PUSH2 0x017e 00000049: JUMPI 0000004a: DUP1 0000004b: PUSH4 0xb76ea962 00000050: EQ 00000051: PUSH2 0x01b4 00000054: JUMPI 00000055: JUMPDEST 00000056: PUSH2 0x0146 00000059: JUMPDEST 0000005a: PUSH1 0x00 0000005c: PUSH1 0x00 0000005e: SWAP1 0000005f: SLOAD 00000060: SWAP1 00000061: PUSH2 0x0100 00000064: EXP 00000065: SWAP1 00000066: DIV 00000067: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000007c: AND 0000007d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000092: AND 00000093: CALLVALUE 00000094: PUSH1 0x40 00000096: MLOAD 00000097: DUP1 00000098: SWAP1 00000099: POP 0000009a: PUSH1 0x00 0000009c: PUSH1 0x40 0000009e: MLOAD 0000009f: DUP1 000000a0: DUP4 000000a1: SUB 000000a2: DUP2 000000a3: DUP6 000000a4: DUP8 000000a5: PUSH2 0x8796 000000a8: GAS 000000a9: SUB 000000aa: CALL 000000ab: SWAP3 000000ac: POP 000000ad: POP 000000ae: POP 000000af: ISZERO 000000b0: PUSH2 0x013d 000000b3: JUMPI 000000b4: PUSH32 0x23919512b2162ddc59b67a65e3b03c419d4105366f7d4a632f5d3c3bee9b1cff 000000d5: PUSH1 0x00 000000d7: PUSH1 0x00 000000d9: SWAP1 000000da: SLOAD 000000db: SWAP1 000000dc: PUSH2 0x0100 000000df: EXP 000000e0: SWAP1 000000e1: DIV 000000e2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000f7: AND 000000f8: PUSH1 0x40 000000fa: MLOAD 000000fb: DUP1 000000fc: DUP3 000000fd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000112: AND 00000113: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000128: AND 00000129: DUP2 0000012a: MSTORE 0000012b: PUSH1 0x20 0000012d: ADD 0000012e: SWAP2 0000012f: POP 00000130: POP 00000131: PUSH1 0x40 00000133: MLOAD 00000134: DUP1 00000135: SWAP2 00000136: SUB 00000137: SWAP1 00000138: LOG1 00000139: PUSH2 0x0143 0000013c: JUMP 0000013d: JUMPDEST 0000013e: PUSH1 0x00 00000140: PUSH1 0x00 00000142: REVERT 00000143: JUMPDEST 00000144: JUMPDEST 00000145: JUMP 00000146: JUMPDEST 00000147: STOP 00000148: JUMPDEST 00000149: CALLVALUE 0000014a: ISZERO 0000014b: PUSH2 0x0150 0000014e: JUMPI 0000014f: INVALID 00000150: JUMPDEST 00000151: PUSH2 0x017c 00000154: PUSH1 0x04 00000156: DUP1 00000157: DUP1 00000158: CALLDATALOAD 00000159: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000016e: AND 0000016f: SWAP1 00000170: PUSH1 0x20 00000172: ADD 00000173: SWAP1 00000174: SWAP2 00000175: SWAP1 00000176: POP 00000177: POP 00000178: PUSH2 0x0225 0000017b: JUMP 0000017c: JUMPDEST 0000017d: STOP 0000017e: JUMPDEST 0000017f: CALLVALUE 00000180: ISZERO 00000181: PUSH2 0x0186 00000184: JUMPI 00000185: INVALID 00000186: JUMPDEST 00000187: PUSH2 0x01b2 0000018a: PUSH1 0x04 0000018c: DUP1 0000018d: DUP1 0000018e: CALLDATALOAD 0000018f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001a4: AND 000001a5: SWAP1 000001a6: PUSH1 0x20 000001a8: ADD 000001a9: SWAP1 000001aa: SWAP2 000001ab: SWAP1 000001ac: POP 000001ad: POP 000001ae: PUSH2 0x02c8 000001b1: JUMP 000001b2: JUMPDEST 000001b3: STOP 000001b4: JUMPDEST 000001b5: PUSH2 0x0223 000001b8: PUSH1 0x04 000001ba: DUP1 000001bb: DUP1 000001bc: CALLDATALOAD 000001bd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001d2: AND 000001d3: SWAP1 000001d4: PUSH1 0x20 000001d6: ADD 000001d7: SWAP1 000001d8: SWAP2 000001d9: SWAP1 000001da: DUP1 000001db: CALLDATALOAD 000001dc: SWAP1 000001dd: PUSH1 0x20 000001df: ADD 000001e0: SWAP1 000001e1: DUP3 000001e2: ADD 000001e3: DUP1 000001e4: CALLDATALOAD 000001e5: SWAP1 000001e6: PUSH1 0x20 000001e8: ADD 000001e9: SWAP1 000001ea: DUP1 000001eb: DUP1 000001ec: PUSH1 0x1f 000001ee: ADD 000001ef: PUSH1 0x20 000001f1: DUP1 000001f2: SWAP2 000001f3: DIV 000001f4: MUL 000001f5: PUSH1 0x20 000001f7: ADD 000001f8: PUSH1 0x40 000001fa: MLOAD 000001fb: SWAP1 000001fc: DUP2 000001fd: ADD 000001fe: PUSH1 0x40 00000200: MSTORE 00000201: DUP1 00000202: SWAP4 00000203: SWAP3 00000204: SWAP2 00000205: SWAP1 00000206: DUP2 00000207: DUP2 00000208: MSTORE 00000209: PUSH1 0x20 0000020b: ADD 0000020c: DUP4 0000020d: DUP4 0000020e: DUP1 0000020f: DUP3 00000210: DUP5 00000211: CALLDATACOPY 00000212: DUP3 00000213: ADD 00000214: SWAP2 00000215: POP 00000216: POP 00000217: POP 00000218: POP 00000219: POP 0000021a: POP 0000021b: SWAP2 0000021c: SWAP1 0000021d: POP 0000021e: POP 0000021f: PUSH2 0x036b 00000222: JUMP 00000223: JUMPDEST 00000224: STOP 00000225: JUMPDEST 00000226: PUSH1 0x01 00000228: PUSH1 0x00 0000022a: SWAP1 0000022b: SLOAD 0000022c: SWAP1 0000022d: PUSH2 0x0100 00000230: EXP 00000231: SWAP1 00000232: DIV 00000233: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000248: AND 00000249: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000025e: AND 0000025f: CALLER 00000260: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000275: AND 00000276: EQ 00000277: ISZERO 00000278: ISZERO 00000279: PUSH2 0x0282 0000027c: JUMPI 0000027d: PUSH1 0x00 0000027f: PUSH1 0x00 00000281: REVERT 00000282: JUMPDEST 00000283: DUP1 00000284: PUSH1 0x01 00000286: PUSH1 0x00 00000288: PUSH2 0x0100 0000028b: EXP 0000028c: DUP2 0000028d: SLOAD 0000028e: DUP2 0000028f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002a4: MUL 000002a5: NOT 000002a6: AND 000002a7: SWAP1 000002a8: DUP4 000002a9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002be: AND 000002bf: MUL 000002c0: OR 000002c1: SWAP1 000002c2: SSTORE 000002c3: POP 000002c4: JUMPDEST 000002c5: JUMPDEST 000002c6: POP 000002c7: JUMP 000002c8: JUMPDEST 000002c9: PUSH1 0x01 000002cb: PUSH1 0x00 000002cd: SWAP1 000002ce: SLOAD 000002cf: SWAP1 000002d0: PUSH2 0x0100 000002d3: EXP 000002d4: SWAP1 000002d5: DIV 000002d6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002eb: AND 000002ec: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000301: AND 00000302: CALLER 00000303: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000318: AND 00000319: EQ 0000031a: ISZERO 0000031b: ISZERO 0000031c: PUSH2 0x0325 0000031f: JUMPI 00000320: PUSH1 0x00 00000322: PUSH1 0x00 00000324: REVERT 00000325: JUMPDEST 00000326: DUP1 00000327: PUSH1 0x00 00000329: PUSH1 0x00 0000032b: PUSH2 0x0100 0000032e: EXP 0000032f: DUP2 00000330: SLOAD 00000331: DUP2 00000332: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000347: MUL 00000348: NOT 00000349: AND 0000034a: SWAP1 0000034b: DUP4 0000034c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000361: AND 00000362: MUL 00000363: OR 00000364: SWAP1 00000365: SSTORE 00000366: POP 00000367: JUMPDEST 00000368: JUMPDEST 00000369: POP 0000036a: JUMP 0000036b: JUMPDEST 0000036c: PUSH1 0x01 0000036e: PUSH1 0x00 00000370: SWAP1 00000371: SLOAD 00000372: SWAP1 00000373: PUSH2 0x0100 00000376: EXP 00000377: SWAP1 00000378: DIV 00000379: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000038e: AND 0000038f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003a4: AND 000003a5: CALLER 000003a6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003bb: AND 000003bc: EQ 000003bd: ISZERO 000003be: ISZERO 000003bf: PUSH2 0x03c8 000003c2: JUMPI 000003c3: PUSH1 0x00 000003c5: PUSH1 0x00 000003c7: REVERT 000003c8: JUMPDEST 000003c9: DUP2 000003ca: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003df: AND 000003e0: CALLVALUE 000003e1: DUP3 000003e2: PUSH1 0x40 000003e4: MLOAD 000003e5: DUP1 000003e6: DUP3 000003e7: DUP1 000003e8: MLOAD 000003e9: SWAP1 000003ea: PUSH1 0x20 000003ec: ADD 000003ed: SWAP1 000003ee: DUP1 000003ef: DUP4 000003f0: DUP4 000003f1: PUSH1 0x00 000003f3: DUP4 000003f4: EQ 000003f5: PUSH2 0x041d 000003f8: JUMPI 000003f9: JUMPDEST 000003fa: DUP1 000003fb: MLOAD 000003fc: DUP3 000003fd: MSTORE 000003fe: PUSH1 0x20 00000400: DUP4 00000401: GT 00000402: ISZERO 00000403: PUSH2 0x041d 00000406: JUMPI 00000407: PUSH1 0x20 00000409: DUP3 0000040a: ADD 0000040b: SWAP2 0000040c: POP 0000040d: PUSH1 0x20 0000040f: DUP2 00000410: ADD 00000411: SWAP1 00000412: POP 00000413: PUSH1 0x20 00000415: DUP4 00000416: SUB 00000417: SWAP3 00000418: POP 00000419: PUSH2 0x03f9 0000041c: JUMP 0000041d: JUMPDEST 0000041e: POP 0000041f: POP 00000420: POP 00000421: SWAP1 00000422: POP 00000423: SWAP1 00000424: DUP2 00000425: ADD 00000426: SWAP1 00000427: PUSH1 0x1f 00000429: AND 0000042a: DUP1 0000042b: ISZERO 0000042c: PUSH2 0x0449 0000042f: JUMPI 00000430: DUP1 00000431: DUP3 00000432: SUB 00000433: DUP1 00000434: MLOAD 00000435: PUSH1 0x01 00000437: DUP4 00000438: PUSH1 0x20 0000043a: SUB 0000043b: PUSH2 0x0100 0000043e: EXP 0000043f: SUB 00000440: NOT 00000441: AND 00000442: DUP2 00000443: MSTORE 00000444: PUSH1 0x20 00000446: ADD 00000447: SWAP2 00000448: POP 00000449: JUMPDEST 0000044a: POP 0000044b: SWAP2 0000044c: POP 0000044d: POP 0000044e: PUSH1 0x00 00000450: PUSH1 0x40 00000452: MLOAD 00000453: DUP1 00000454: DUP4 00000455: SUB 00000456: DUP2 00000457: DUP6 00000458: DUP8 00000459: PUSH2 0x8796 0000045c: GAS 0000045d: SUB 0000045e: CALL 0000045f: SWAP3 00000460: POP 00000461: POP 00000462: POP 00000463: ISZERO 00000464: ISZERO 00000465: PUSH2 0x046e 00000468: JUMPI 00000469: PUSH1 0x00 0000046b: PUSH1 0x00 0000046d: REVERT 0000046e: JUMPDEST 0000046f: JUMPDEST 00000470: JUMPDEST 00000471: POP 00000472: POP 00000473: JUMP 00000474: STOP 00000475: LOG1 00000476: PUSH6 0x627a7a723058 0000047d: KECCAK256 0000047e: ISZERO 0000047f: UNKNOWN(0xDD) 00000480: DUP11 00000481: ADDRESS 00000482: UNKNOWN(0xED) 00000483: UNKNOWN(0xC4) 00000484: UNKNOWN(0xD2) 00000485: UNKNOWN(0xB8) 00000486: DUP15 00000487: MLOAD 00000488: UNKNOWN(0xC1) 00000489: UNKNOWN(0xE2) 0000048a: MSTORE 0000048b: UNKNOWN(0xCD) 0000048c: UNKNOWN(0xC5) 0000048d: LOG0 0000048e: DUP13 0000048f: UNKNOWN(0xD0) 00000490: ISZERO 00000491: SWAP13 00000492: UNKNOWN(0x2D) 00000493: TSTORE 00000494: PUSH28
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| medium | other | detector | Untrusted CALL target/value reachable | 45 | yes | yes |
viewtrace_id: 0x505a8ec68b120507d6e40c2d63a397ba5954cc518bd35d3f34e08949e2e7b233
call_targets:
0x209c4784ab1e8183cf58ca33cb740efbf3fc18ef, 0x32be343b94f860124dc4fee278fdcbd38c102d88, 0xb43e7dd71cce3f82af2aa9c9ce72cf4f350d1505
target_varies:
yes
classification:
target_varies
validation_json{
"sink": "CALL",
"errors": 0,
"status": "confirmed",
"attempts": 1,
"trace_id": "0x505a8ec68b120507d6e40c2d63a397ba5954cc518bd35d3f34e08949e2e7b233",
"confirmed": true,
"trace_mode": "callTracer",
"call_targets": [
"0x209c4784ab1e8183cf58ca33cb740efbf3fc18ef",
"0x32be343b94f860124dc4fee278fdcbd38c102d88",
"0xb43e7dd71cce3f82af2aa9c9ce72cf4f350d1505"
],
"matched_probe": null,
"target_varies": true,
"classification": "target_varies"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xffffffff",
"selector": "0xffffffff",
"calldata_variants": [
"0xffffffff",
"0xffffffff0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x66117276",
"selector": "0x66117276",
"calldata_variants": [
"0x66117276",
"0x661172760000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x82c90ac0",
"selector": "0x82c90ac0",
"calldata_variants": [
"0x82c90ac0",
"0x82c90ac00000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xb76ea962",
"selector": "0xb76ea962",
"calldata_variants": [
"0xb76ea962",
"0xb76ea9620000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 170,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1118,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 2,
"guards_detected": [
{
"pc": 607,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 770,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 933,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
}
],
"untrusted_call_count": 2
}
|
| medium | other | detector | ETH value transfer possible | 40 | yes | yes |
viewtrace_id: 0x505a8ec68b120507d6e40c2d63a397ba5954cc518bd35d3f34e08949e2e7b233
call_targets:
0x209c4784ab1e8183cf58ca33cb740efbf3fc18ef, 0x32be343b94f860124dc4fee278fdcbd38c102d88, 0xb43e7dd71cce3f82af2aa9c9ce72cf4f350d1505
target_varies:
yes
classification:
target_varies
validation_json{
"sink": "CALL",
"errors": 0,
"status": "confirmed",
"attempts": 1,
"trace_id": "0x505a8ec68b120507d6e40c2d63a397ba5954cc518bd35d3f34e08949e2e7b233",
"confirmed": true,
"trace_mode": "callTracer",
"call_targets": [
"0x209c4784ab1e8183cf58ca33cb740efbf3fc18ef",
"0x32be343b94f860124dc4fee278fdcbd38c102d88",
"0xb43e7dd71cce3f82af2aa9c9ce72cf4f350d1505"
],
"matched_probe": null,
"target_varies": true,
"classification": "target_varies"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xffffffff",
"selector": "0xffffffff",
"calldata_variants": [
"0xffffffff",
"0xffffffff0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x66117276",
"selector": "0x66117276",
"calldata_variants": [
"0x66117276",
"0x661172760000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x82c90ac0",
"selector": "0x82c90ac0",
"calldata_variants": [
"0x82c90ac0",
"0x82c90ac00000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xb76ea962",
"selector": "0xb76ea962",
"calldata_variants": [
"0xb76ea962",
"0xb76ea9620000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 170,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1118,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 2,
"guards_detected": [
{
"pc": 607,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 770,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 933,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
}
]
}
|