Analysis Run

019ba9a5-c596-71aa-9078-29436a591e7c

complete

Chain ID

1

Address

0x1bb28e79f2482df6bf60efc7a33365703bcf1536

Block Number

—

Created

Sat, Jan 10, 2026 8:42 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Verified

Review Backing

Not yet

Best current signal

SELFDESTRUCT present

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
36933	artifact.fetch	complete	1 / 3	3 months ago
36934	proxy.resolve	complete	1 / 3	3 months ago
36935	tool.cast_disasm	complete	1 / 3	3 months ago
36936	analysis.bundle	complete	1 / 3	3 months ago
36937	capability.graph	complete	1 / 3	3 months ago
36938	detector.run	complete	1 / 3	3 months ago
36939	validation.fork	complete	1 / 3	3 months ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no not_proxy

Implementation:

—

Verified Source: yes

Proxy evidence

{
    "status": "not_proxy"
}

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

0

Selfdestruct

1

CREATE2

0

CALL-family (heavy)

1

EXT*/BALANCE

2

Total opcodes

317

Flags

selfdestruct_present

View cast disassembly output

00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: CALLDATASIZE
00000006: ISZERO
00000007: PUSH2 0x004a
0000000a: JUMPI
0000000b: PUSH1 0x00
0000000d: CALLDATALOAD
0000000e: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
0000002c: SWAP1
0000002d: DIV
0000002e: PUSH4 0xffffffff
00000033: AND
00000034: DUP1
00000035: PUSH4 0x354284f2
0000003a: EQ
0000003b: PUSH2 0x00e7
0000003e: JUMPI
0000003f: DUP1
00000040: PUSH4 0x4a3f17e7
00000045: EQ
00000046: PUSH2 0x00f9
00000049: JUMPI
0000004a: JUMPDEST
0000004b: PUSH2 0x00e5
0000004e: JUMPDEST
0000004f: CALLVALUE
00000050: PUSH1 0x00
00000052: PUSH1 0x00
00000054: CALLER
00000055: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000006a: AND
0000006b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000080: AND
00000081: DUP2
00000082: MSTORE
00000083: PUSH1 0x20
00000085: ADD
00000086: SWAP1
00000087: DUP2
00000088: MSTORE
00000089: PUSH1 0x20
0000008b: ADD
0000008c: PUSH1 0x00
0000008e: KECCAK256
0000008f: PUSH1 0x00
00000091: DUP3
00000092: DUP3
00000093: SLOAD
00000094: ADD
00000095: SWAP3
00000096: POP
00000097: POP
00000098: DUP2
00000099: SWAP1
0000009a: SSTORE
0000009b: POP
0000009c: CALLVALUE
0000009d: CALLER
0000009e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000b3: AND
000000b4: PUSH32 0x115522125a340a348d82c36b243d9dcbb357931a24824ddbe1d13179155e3091
000000d5: PUSH1 0x40
000000d7: MLOAD
000000d8: DUP1
000000d9: SWAP1
000000da: POP
000000db: PUSH1 0x40
000000dd: MLOAD
000000de: DUP1
000000df: SWAP2
000000e0: SUB
000000e1: SWAP1
000000e2: LOG3
000000e3: JUMPDEST
000000e4: JUMP
000000e5: JUMPDEST
000000e6: STOP
000000e7: JUMPDEST
000000e8: CALLVALUE
000000e9: ISZERO
000000ea: PUSH2 0x00ef
000000ed: JUMPI
000000ee: INVALID
000000ef: JUMPDEST
000000f0: PUSH2 0x00f7
000000f3: PUSH2 0x0143
000000f6: JUMP
000000f7: JUMPDEST
000000f8: STOP
000000f9: JUMPDEST
000000fa: CALLVALUE
000000fb: ISZERO
000000fc: PUSH2 0x0101
000000ff: JUMPI
00000100: INVALID
00000101: JUMPDEST
00000102: PUSH2 0x012d
00000105: PUSH1 0x04
00000107: DUP1
00000108: DUP1
00000109: CALLDATALOAD
0000010a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000011f: AND
00000120: SWAP1
00000121: PUSH1 0x20
00000123: ADD
00000124: SWAP1
00000125: SWAP2
00000126: SWAP1
00000127: POP
00000128: POP
00000129: PUSH2 0x02b5
0000012c: JUMP
0000012d: JUMPDEST
0000012e: PUSH1 0x40
00000130: MLOAD
00000131: DUP1
00000132: DUP3
00000133: DUP2
00000134: MSTORE
00000135: PUSH1 0x20
00000137: ADD
00000138: SWAP2
00000139: POP
0000013a: POP
0000013b: PUSH1 0x40
0000013d: MLOAD
0000013e: DUP1
0000013f: SWAP2
00000140: SUB
00000141: SWAP1
00000142: RETURN
00000143: JUMPDEST
00000144: PUSH1 0x00
00000146: PUSH4 0x5f220d80
0000014b: TIMESTAMP
0000014c: GT
0000014d: DUP1
0000014e: ISZERO
0000014f: PUSH2 0x0197
00000152: JUMPI
00000153: POP
00000154: PUSH1 0x00
00000156: PUSH1 0x00
00000158: PUSH1 0x00
0000015a: CALLER
0000015b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000170: AND
00000171: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000186: AND
00000187: DUP2
00000188: MSTORE
00000189: PUSH1 0x20
0000018b: ADD
0000018c: SWAP1
0000018d: DUP2
0000018e: MSTORE
0000018f: PUSH1 0x20
00000191: ADD
00000192: PUSH1 0x00
00000194: KECCAK256
00000195: SLOAD
00000196: GT
00000197: JUMPDEST
00000198: ISZERO
00000199: ISZERO
0000019a: PUSH2 0x01a3
0000019d: JUMPI
0000019e: PUSH1 0x00
000001a0: PUSH1 0x00
000001a2: REVERT
000001a3: JUMPDEST
000001a4: PUSH1 0x00
000001a6: PUSH1 0x00
000001a8: CALLER
000001a9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000001be: AND
000001bf: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000001d4: AND
000001d5: DUP2
000001d6: MSTORE
000001d7: PUSH1 0x20
000001d9: ADD
000001da: SWAP1
000001db: DUP2
000001dc: MSTORE
000001dd: PUSH1 0x20
000001df: ADD
000001e0: PUSH1 0x00
000001e2: KECCAK256
000001e3: SLOAD
000001e4: SWAP1
000001e5: POP
000001e6: PUSH1 0x00
000001e8: PUSH1 0x00
000001ea: PUSH1 0x00
000001ec: CALLER
000001ed: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000202: AND
00000203: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000218: AND
00000219: DUP2
0000021a: MSTORE
0000021b: PUSH1 0x20
0000021d: ADD
0000021e: SWAP1
0000021f: DUP2
00000220: MSTORE
00000221: PUSH1 0x20
00000223: ADD
00000224: PUSH1 0x00
00000226: KECCAK256
00000227: DUP2
00000228: SWAP1
00000229: SSTORE
0000022a: POP
0000022b: CALLER
0000022c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000241: AND
00000242: PUSH2 0x08fc
00000245: DUP3
00000246: SWAP1
00000247: DUP2
00000248: ISZERO
00000249: MUL
0000024a: SWAP1
0000024b: PUSH1 0x40
0000024d: MLOAD
0000024e: DUP1
0000024f: SWAP1
00000250: POP
00000251: PUSH1 0x00
00000253: PUSH1 0x40
00000255: MLOAD
00000256: DUP1
00000257: DUP4
00000258: SUB
00000259: DUP2
0000025a: DUP6
0000025b: DUP9
0000025c: DUP9
0000025d: CALL
0000025e: SWAP4
0000025f: POP
00000260: POP
00000261: POP
00000262: POP
00000263: ISZERO
00000264: ISZERO
00000265: PUSH2 0x026a
00000268: JUMPI
00000269: INVALID
0000026a: JUMPDEST
0000026b: DUP1
0000026c: CALLER
0000026d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000282: AND
00000283: PUSH32 0x0dc8f43545dbeec87c6f54e44dac2d8889f2a4b3bf0f62683cd7e1c6346128e7
000002a4: PUSH1 0x40
000002a6: MLOAD
000002a7: DUP1
000002a8: SWAP1
000002a9: POP
000002aa: PUSH1 0x40
000002ac: MLOAD
000002ad: DUP1
000002ae: SWAP2
000002af: SUB
000002b0: SWAP1
000002b1: LOG3
000002b2: JUMPDEST
000002b3: POP
000002b4: JUMP
000002b5: JUMPDEST
000002b6: PUSH1 0x00
000002b8: PUSH1 0x20
000002ba: MSTORE
000002bb: DUP1
000002bc: PUSH1 0x00
000002be: MSTORE
000002bf: PUSH1 0x40
000002c1: PUSH1 0x00
000002c3: KECCAK256
000002c4: PUSH1 0x00
000002c6: SWAP2
000002c7: POP
000002c8: SWAP1
000002c9: POP
000002ca: SLOAD
000002cb: DUP2
000002cc: JUMP
000002cd: STOP
000002ce: LOG1
000002cf: PUSH6 0x627a7a723058
000002d6: KECCAK256
000002d7: SELFDESTRUCT
000002d8: CALLDATACOPY
000002d9: UNKNOWN(0xAB)
000002da: BLOBBASEFEE
000002db: UNKNOWN(0xEC)
000002dc: SWAP5
000002dd: UNKNOWN(0xC9)
000002de: GASPRICE
000002df: SWAP10
000002e0: EXTCODECOPY
000002e1: UNKNOWN(0xC8)
000002e2: DUP8
000002e3: UNKNOWN(0x4B)
000002e4: UNKNOWN(0xF9)
000002e5: BLOBBASEFEE
000002e6: PUSH14 0x3d706d3eeb6b5b5df89d7c23a752
000002f5: UNKNOWN(0x27)
000002f6: BALANCE
000002f7: STOP
000002f8: UNKNOWN(0x29)

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
high	other	cast	SELFDESTRUCT present	85	no	—	view evidence_json { "notes": "selfdestruct can remove contract code and send funds; review reachability", "selfdestruct_count": 1 }
high	other	detector	Untrusted CALL target/value reachable	60	no	no	view trace_id: 0xda36f1f3204c5d14584c81fd4034c741ca469a02948ac82851bb94e7cdfeb6ea call_targets: 0x1bb28e79f2482df6bf60efc7a33365703bcf1536 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xda36f1f3204c5d14584c81fd4034c741ca469a02948ac82851bb94e7cdfeb6ea", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0x1bb28e79f2482df6bf60efc7a33365703bcf1536" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0xffffffff", "selector": "0xffffffff", "calldata_variants": [ "0xffffffff", "0xffffffff0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x354284f2", "selector": "0x354284f2", "calldata_variants": [ "0x354284f2", "0x354284f20000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x4a3f17e7", "selector": "0x4a3f17e7", "calldata_variants": [ "0x4a3f17e7", "0x4a3f17e70000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 605, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "call_count": 1, "guards_detected": [], "untrusted_call_count": 1 }
high	other	detector	ETH value transfer possible	55	no	no	view trace_id: 0xda36f1f3204c5d14584c81fd4034c741ca469a02948ac82851bb94e7cdfeb6ea call_targets: 0x1bb28e79f2482df6bf60efc7a33365703bcf1536 target_varies: no classification: constant_target validation_json { "sink": "CALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0xda36f1f3204c5d14584c81fd4034c741ca469a02948ac82851bb94e7cdfeb6ea", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0x1bb28e79f2482df6bf60efc7a33365703bcf1536" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0xffffffff", "selector": "0xffffffff", "calldata_variants": [ "0xffffffff", "0xffffffff0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x354284f2", "selector": "0x354284f2", "calldata_variants": [ "0x354284f2", "0x354284f20000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x4a3f17e7", "selector": "0x4a3f17e7", "calldata_variants": [ "0x4a3f17e7", "0x4a3f17e70000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "examples": [ { "pc": 605, "opcode": "CALL", "returndata_checked": null, "value_expression_category": "computed", "target_expression_category": "computed" } ], "eth_value_calls": 1, "guards_detected": [] }
high	other	detector	SELFDESTRUCT reachable	65	no	no	view trace_id: 0x3aeb3d96f436ea2d82a8950d904f24bc0ba039341df00b5893d404669a4473cf validation_json { "sink": "SELFDESTRUCT", "errors": 0, "status": "unknown", "attempts": 6, "trace_id": "0x3aeb3d96f436ea2d82a8950d904f24bc0ba039341df00b5893d404669a4473cf", "confirmed": false, "trace_mode": "structLogs", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "no_sink" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0xffffffff", "selector": "0xffffffff", "calldata_variants": [ "0xffffffff", "0xffffffff0000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x354284f2", "selector": "0x354284f2", "calldata_variants": [ "0x354284f2", "0x354284f20000000000000000000000000000000000000000000000000000000000000000" ] }, { "calldata": "0x4a3f17e7", "selector": "0x4a3f17e7", "calldata_variants": [ "0x4a3f17e7", "0x4a3f17e70000000000000000000000000000000000000000000000000000000000000000" ] } ] } evidence_json { "guards_detected": [], "selfdestruct_count": 1 }