019ba9bc-ec3c-738f-9671-9046fad6b6a8
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 37727 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 37728 | proxy.resolve | complete | 1 / 3 | 3 months ago |
| 37729 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 37730 | analysis.bundle | complete | 1 / 3 | 3 months ago |
| 37731 | capability.graph | complete | 1 / 3 | 3 months ago |
| 37732 | detector.run | complete | 1 / 3 | 3 months ago |
| 37733 | validation.fork | complete | 1 / 3 | 3 months ago |
| 37896 | report.consolidate | complete | 1 / 6 | 3 months ago |
{
"status": "not_proxy"
}
No slither job recorded yet.
{"no_findings":false,"summary":"Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.","findings":[{"severity":"high","category":"upgradeability","title":"Computed DELEGATECALL target allows potential arbitrary code execution","exploit_scenario":"If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract’s context, draining funds or overwriting state.","recommendation":"Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.","evidence":"Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.","locations":["pc:0x189"]},{"severity":"medium","category":"access_control","title":"Potential arbitrary external CALLs with value to computed targets","exploit_scenario":"If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract’s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets.","recommendation":"Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.","evidence":"Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.","locations":["pc:0x58c","pc:0x61d","pc:0x6eb","pc:0x8d6","pc:0x9da"]}]}
OpenAI Codex v0.77.0 (research preview)
--------
workdir: /tmp/codex-cyh1pt69
model: gpt-5.2-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: xhigh
reasoning summaries: auto
session id: 019ba9c8-1764-74b0-8b9a-508c0b5dfd25
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.
Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.
Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".
Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
mcp startup: no servers
thinking
**Preparing to read BYTECODE_BUNDLE.json**
exec
/bin/bash -lc ls in /tmp/codex-cyh1pt69 succeeded in 6ms:
BYTECODE_BUNDLE.json
codex-output-schema.json
exec
/bin/bash -lc 'cat BYTECODE_BUNDLE.json' in /tmp/codex-cyh1pt69 succeeded in 9ms:
{
"analysis_artifact": {
"address": "0x942a70014b6ba71ec84b16e1604fc76b1071eaf9",
"artifact_hash": "0x5c72b42571ea3606584e33f283dd108a03ee6cb4485af2708ee3061f42555867",
"artifact_json": {
"auth": {
"guards": []
},
"basic_blocks": [
{
"end_pc": 12,
"hash": "0xf22705069d58de5e475a0ae499d9c45bc7477c202e97427801be5e53f1d1ac9b",
"opcodes": [
"PUSH1",
"PUSH1",
"MSTORE",
"PUSH1",
"CALLDATASIZE",
"LT",
"PUSH2",
thinking
**Preparing to parse bytecode data**
exec
/bin/bash -lc 'rg -n "storage|slot|evidence|selector|proxy|1967|beacon|callsite|delegatecall|upgrade" BYTECODE_BUNDLE.json' in /tmp/codex-cyh1pt69 succeeded in 16ms:
4483: "callsites": [
5995: "dispatcher_type": "selector_jump_table",
5999: "selector": "0xaa2d4a29"
6003: "selector": "0xd89da49c"
6007: "selector": "0xeded6191"
6011: "selector": "0xefbb98c2"
6015: "selector": "0x802a81d8"
6019: "selector": "0x810d6ce5"
6023: "selector": "0xa4358917"
6027: "selector": "0x1fceed7f"
6031: "selector": "0x234ecf06"
6035: "selector": "0x5a703223"
6039: "selector": "0x5f850252"
6043: "selector": "0x0ae50a39"
6047: "selector": "0x12038e5d"
6051: "selector": "0x167d3e9c"
6060: "selector": "0xaa2d4a29",
6063: "delegatecall": 1,
6067: "storage": {
6069: "slots": [
thinking
**Gathering callsite and evidence data**
exec
/bin/bash -lc "python - <<'PY'
import json
import textwrap
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
print('keys', data.keys())
print('heuristics_summary', data.get('heuristics_summary'))
print('is_proxy', data.get('is_proxy'))
print('proxy_evidence', data.get('proxy_evidence'))
print('detector_findings count', len(data.get('detector_findings', [])))
for i,fd in enumerate(data.get('detector_findings', []),1):
print('\\nFinding', i, fd.get('title'), 'severity', fd.get('severity'), 'confidence', fd.get('confidence'))
print(' evidence_json', fd.get('evidence_json'))
print(' normalized', fd.get('normalized_json'))
print(' validation', fd.get('validation_json'))
# show callsites
callsites = data.get('analysis_artifact',{}).get('artifact_json',{}).get('callsites',[])
print('\\ncallsites', callsites[:10], 'total', len(callsites))
# dump selectors list if present
selectors = data.get('analysis_artifact',{}).get('artifact_json',{}).get('selectors')
print('\\nselectors', selectors)
# show dispatcher_type
print('dispatcher_type', data.get('analysis_artifact',{}).get('artifact_json',{}).get('dispatcher_type'))
# print function selectors list (if in artifact_json)
functions = [f for f in data.get('analysis_artifact',{}).get('artifact_json',{}).get('function_selectors',[])]
if functions:
print('function_selectors', functions)
PY" in /tmp/codex-cyh1pt69 succeeded in 30ms:
keys dict_keys(['analysis_artifact', 'analysis_run', 'artifact', 'capability_graph', 'detector_findings', 'heuristics_summary'])
heuristics_summary {'create2_count': 0, 'delegatecall_count': 1, 'flags': ['delegatecall_present'], 'selfdestruct_count': 0}
is_proxy None
proxy_evidence None
detector_findings count 3
Finding 1 Untrusted DELEGATECALL target reachable severity critical confidence 70
evidence_json {'delegatecall_count': 1, 'examples': [{'opcode': 'DELEGATECALL', 'pc': 393, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'n/a'}], 'guards_detected': [], 'untrusted_delegatecall_count': 1}
normalized {'sink': 'DELEGATECALL'}
validation {'attempts': 168, 'call_targets': None, 'classification': 'no_sink', 'confirmed': False, 'errors': 0, 'matched_probe': None, 'sink': 'DELEGATECALL', 'status': 'unknown', 'target_varies': None, 'trace_id': '0x3325434cb15a794ec465fa30e9092dd0edad7648a57cca55b385f38ad1d15646', 'trace_mode': 'callTracer'}
Finding 2 Untrusted CALL target/value reachable severity high confidence 60
evidence_json {'call_count': 5, 'examples': [{'opcode': 'CALL', 'pc': 1420, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1565, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1771, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}], 'guards_detected': [], 'untrusted_call_count': 5}
normalized {'sink': 'CALL'}
validation {'attempts': 1, 'call_targets': ['0x942a70014b6ba71ec84b16e1604fc76b1071eaf9'], 'classification': 'constant_target', 'confirmed': False, 'errors': 0, 'matched_probe': None, 'sink': 'CALL', 'status': 'sink_reached', 'target_varies': False, 'trace_id': '0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be', 'trace_mode': 'callTracer'}
Finding 3 ETH value transfer possible severity high confidence 55
evidence_json {'eth_value_calls': 5, 'examples': [{'opcode': 'CALL', 'pc': 1420, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1565, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1771, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}], 'guards_detected': []}
normalized {'sink': 'CALL', 'value': 'nonzero'}
validation {'attempts': 1, 'call_targets': ['0x942a70014b6ba71ec84b16e1604fc76b1071eaf9'], 'classification': 'constant_target', 'confirmed': False, 'errors': 0, 'matched_probe': None, 'sink': 'CALL', 'status': 'sink_reached', 'target_varies': False, 'trace_id': '0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be', 'trace_mode': 'callTracer'}
thinking
**Investigating auth guard presence**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
# check if top-level has proxy info in other fields
for key in ['analysis_run','artifact','capability_graph']:
if key in data:
print('\\n====', key, '====')
# Print keys and some fields
val=data[key]
if isinstance(val, dict):
print('keys', list(val.keys())[:20])
else:
print(type(val))
# If there is artifact with proxy evidence
artifact=data.get('artifact')
if isinstance(artifact, dict):
print('\\nartifact keys', artifact.keys())
for k in ['is_proxy','proxy_evidence','proxy','upgradeability','bytecode_hash','address']:
if k in artifact:
print(k, artifact.get(k))
# capability_graph may have proxy evidence
cg=data.get('capability_graph')
if isinstance(cg, dict):
for k in ['is_proxy','proxy_evidence','proxy','upgradeability']:
if k in cg:
print('capability_graph', k, cg.get(k))
# analysis_run might contain proxy info
ar=data.get('analysis_run')
if isinstance(ar, dict):
for k in ['is_proxy','proxy_evidence','proxy']:
if k in ar:
print('analysis_run', k, ar.get(k))
PY" in /tmp/codex-cyh1pt69 succeeded in 42ms:
==== analysis_run ====
keys ['address', 'block_number', 'chain_id', 'child_links', 'created_at', 'id', 'parent_links', 'status', 'updated_at']
==== artifact ====
keys ['codehash', 'compiler_json', 'implementation_address', 'is_proxy', 'runtime_bytecode', 'verified_source']
==== capability_graph ====
keys ['address', 'block_number', 'chain_id', 'codehash', 'created_at', 'graph_hash', 'graph_json', 'id', 'updated_at', 'version']
artifact keys dict_keys(['codehash', 'compiler_json', 'implementation_address', 'is_proxy', 'runtime_bytecode', 'verified_source'])
is_proxy False
thinking
**Inspecting capability_graph.graph_json**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
cg = data.get('capability_graph', {}).get('graph_json')
if cg:
print('capability_graph.graph_json keys', cg.keys())
print('is_proxy', cg.get('is_proxy'))
print('proxy_evidence', cg.get('proxy_evidence'))
print('proxy', cg.get('proxy'))
print('dispatcher_type', cg.get('dispatcher_type'))
print('selectors', cg.get('selectors'))
# print auth guards if present
if 'auth' in cg:
print('auth', cg['auth'])
# Print storage slots summary
if 'storage' in cg:
slots = cg['storage'].get('slots', [])
print('storage slots count', len(slots))
print('first slots', slots[:10])
# print callsites
print('callsites count', len(cg.get('callsites', [])))
print('callsites', cg.get('callsites', [])[:10])
PY" in /tmp/codex-cyh1pt69 succeeded in 92ms:
capability_graph.graph_json keys dict_keys(['edges', 'nodes', 'version'])
is_proxy None
proxy_evidence None
proxy None
dispatcher_type None
selectors None
callsites count 0
callsites []
thinking
**Planning JSON inspection for proxy evidence**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
# Traverse to find proxy_evidence
results=[]
def walk(obj, path=''):
if isinstance(obj, dict):
for k,v in obj.items():
p = f\"{path}.{k}\" if path else k
if k in ('proxy_evidence','is_proxy','proxy'):
results.append((p, v))
walk(v, p)
elif isinstance(obj, list):
for i,v in enumerate(obj):
walk(v, f\"{path}[{i}]\")
walk(data)
for p,v in results:
print(p, ':', v)
PY" in /tmp/codex-cyh1pt69 succeeded in 30ms:
artifact.compiler_json.etherscan.proxy : 0
artifact.compiler_json.proxy_evidence : {'status': 'not_proxy'}
artifact.is_proxy : False
thinking
**Investigating delegatecall usage in contract analysis**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
bb = data['analysis_artifact']['artifact_json']['basic_blocks']
# Find blocks containing DELEGATECALL
for b in bb:
if 'DELEGATECALL' in b.get('opcodes', []):
print('block', b['start_pc'], b['end_pc'])
print(b['opcodes'])
# Print blocks around pc 345-407
for b in bb:
if 330 <= b['start_pc'] <= 410:
print('block', b['start_pc'], b['end_pc'])
print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 28ms:
block 381 407
['JUMPDEST', 'PUSH1', 'PUSH1', 'MLOAD', 'OP_80', 'OP_83', 'SUB', 'OP_81', 'OP_86', 'OP_86', 'DELEGATECALL', 'OP_92', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']
block 336 344
['JUMPDEST', 'PUSH1', 'MLOAD', 'OP_80', 'OP_91', 'SUB', 'OP_90', 'REVERT']
block 345 380
['JUMPDEST', 'PUSH1', 'OP_80', 'SLOAD', 'PUSH1', 'SLOAD', 'PUSH1', 'MLOAD', 'OP_83', 'OP_92', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'OP_91', 'OP_90', 'PUSH2', 'OP_90', 'OP_84', 'OP_90', 'CALLDATASIZE', 'OP_90', 'PUSH2', 'JUMP']
block 381 407
['JUMPDEST', 'PUSH1', 'PUSH1', 'MLOAD', 'OP_80', 'OP_83', 'SUB', 'OP_81', 'OP_86', 'OP_86', 'DELEGATECALL', 'OP_92', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']
block 408 440
['PUSH1', 'MLOAD', 'OP_91', 'POP', 'PUSH1', 'NOT', 'PUSH1', 'RETURNDATASIZE', 'ADD', 'AND', 'OP_82', 'ADD', 'PUSH1', 'MSTORE', 'RETURNDATASIZE', 'OP_82', 'MSTORE', 'RETURNDATASIZE', 'PUSH1', 'PUSH1', 'OP_84', 'ADD', 'RETURNDATACOPY', 'PUSH2', 'JUMP']
thinking
**Analyzing delegatecall and storage slots**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
bb = data['analysis_artifact']['artifact_json']['basic_blocks']
callsites = data['analysis_artifact']['artifact_json']['callsites']
# For each callsite, print the block containing pc if possible
for cs in callsites:
pc = cs['pc']
block = next((b for b in bb if b['start_pc'] <= pc <= b['end_pc']), None)
print('\\ncallsite', cs['opcode'], 'pc', pc)
if block:
print('block', block['start_pc'], block['end_pc'])
print(block['opcodes'])
else:
print('block not found')
PY" in /tmp/codex-cyh1pt69 succeeded in 26ms:
callsite DELEGATECALL pc 393
block 381 407
['JUMPDEST', 'PUSH1', 'PUSH1', 'MLOAD', 'OP_80', 'OP_83', 'SUB', 'OP_81', 'OP_86', 'OP_86', 'DELEGATECALL', 'OP_92', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']
callsite CALL pc 1420
block 1417 1427
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']
callsite CALL pc 1565
block 1562 1572
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']
callsite CALL pc 1771
block 1742 1786
['JUMPDEST', 'PUSH1', 'SLOAD', 'PUSH1', 'MLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'OP_84', 'AND', 'OP_91', 'OP_90', 'OP_83', 'OP_90', 'PUSH1', 'OP_81', 'OP_81', 'OP_81', 'OP_85', 'OP_88', 'OP_88', 'CALL', 'OP_93', 'POP', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']
callsite CALL pc 2262
block 2239 2274
['JUMPDEST', 'PUSH1', 'MLOAD', 'CALLER', 'OP_90', 'OP_82', 'ISZERO', 'PUSH2', 'MUL', 'OP_90', 'OP_83', 'OP_90', 'PUSH1', 'OP_81', 'OP_81', 'OP_81', 'OP_85', 'OP_88', 'OP_88', 'CALL', 'OP_93', 'POP', 'POP', 'POP', 'POP', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']
thinking
**Analyzing proxy delegatecall patterns**
I'm trying to make sense of delegatecalls in this contract, suspecting it's a proxy but not a typical EIP-1967 one. I'll focus on understanding the selectors, their delegatecall usage, and any access control to changes since these could affect upgradeability and security. I plan to parse the large artifact JSON to extract selector details and call edges to clarify how functions map to delegatecall targets.
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
artifact_json = data['analysis_artifact']['artifact_json']
print('artifact_json keys', artifact_json.keys())
# Show extra keys besides basic_blocks, callsites etc
for k in artifact_json.keys():
if k not in ('basic_blocks','callsites','auth','version'):
print(k, type(artifact_json[k]))
# if selectors_detail exist
for k in artifact_json.keys():
if 'selector' in k:
print('selector key', k)
# Let's search for a key containing 'selector_analysis' or 'functions'
for k in artifact_json.keys():
if 'function' in k or 'selector' in k or 'dispatch' in k or 'proxy' in k:
print('key', k)
PY" in /tmp/codex-cyh1pt69 succeeded in 32ms:
artifact_json keys dict_keys(['auth', 'basic_blocks', 'callsites', 'cfg_edges', 'cfg_hash', 'dispatcher_type', 'function_entries', 'functions', 'selectors', 'sinks', 'storage', 'version'])
cfg_edges <class 'list'>
cfg_hash <class 'str'>
dispatcher_type <class 'str'>
function_entries <class 'list'>
functions <class 'list'>
selectors <class 'list'>
sinks <class 'dict'>
storage <class 'dict'>
selector key selectors
key dispatcher_type
key function_entries
key functions
key selectors
thinking
**Inspecting functions metadata**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
functions = data['analysis_artifact']['artifact_json']['functions']
print('functions count', len(functions))
# print first function keys
if functions:
print('function keys', functions[0].keys())
# print first function metadata summary
pprint(functions[0])
PY" in /tmp/codex-cyh1pt69 succeeded in 42ms:
functions count 14
function keys dict_keys(['auth', 'entry_pc', 'selector', 'sinks', 'storage'])
{'auth': {'guards': []},
'entry_pc': 2855094825,
'selector': '0xaa2d4a29',
'sinks': {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0},
'storage': {'reads': 25,
'slots': [{'op': 'SLOAD',
'pc': 265,
'slot': '0x0000000000000000000000000000000000000000000000000000000000000003'},
{'op': 'SLOAD',
'pc': 296,
'slot': '0x0000000000000000000000000000000000000000000000000000000000000001'},
{'op': 'SLOAD',
'pc': 349,
'slot': '0x0000000000000000000000000000000000000000000000000000000000000000'},
{'op': 'SLOAD',
'pc': 352,
'slot': '0x0000000000000000000000000000000000000000000000000000000000000004'},
{'op': 'SLOAD',
thinking
**Analyzing function call patterns**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
functions = data['analysis_artifact']['artifact_json']['functions']
for f in functions:
print(f['selector'], 'entry_pc', f['entry_pc'], 'sinks', f['sinks'])
PY" in /tmp/codex-cyh1pt69 succeeded in 80ms:
0xaa2d4a29 entry_pc 2855094825 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xd89da49c entry_pc 3991757201 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xeded6191 entry_pc 4022048962 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xefbb98c2 entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x802a81d8 entry_pc 2165140709 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x810d6ce5 entry_pc 2754971927 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xa4358917 entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x1fceed7f entry_pc 533654911 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x234ecf06 entry_pc 1517302307 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x5a703223 entry_pc 1602552402 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x5f850252 entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x0ae50a39 entry_pc 302222941 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x12038e5d entry_pc 377306780 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x167d3e9c entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
thinking
**Analyzing proxy delegatecall and storage writes**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
f0 = data['analysis_artifact']['artifact_json']['functions'][0]
print(f0['storage'].keys())
print('writes', f0['storage'].get('writes'))
print('slots len', len(f0['storage'].get('slots', [])))
# Check for SSTORE entries
sstore = [s for s in f0['storage'].get('slots', []) if s.get('op')=='SSTORE']
print('sstore entries', sstore)
# check if storage has separate 'writes' or 'write_slots'
for k,v in f0['storage'].items():
if k not in ('reads','writes','slots'):
print('other', k, v)
PY" in /tmp/codex-cyh1pt69 succeeded in 87ms:
dict_keys(['reads', 'slots', 'writes'])
writes 6
slots len 23
sstore entries []
thinking
**Investigating storage write operations**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
storage = data['analysis_artifact']['artifact_json']['storage']
print(storage.keys())
print('reads', storage.get('reads'), 'writes', storage.get('writes'))
# check for sstore entries
slots = storage.get('slots', [])
print('slots count', len(slots))
print('unique ops', sorted(set(s.get('op') for s in slots)))
# show any SSTORE entries if present
sstore = [s for s in slots if s.get('op')=='SSTORE']
print('sstore entries count', len(sstore))
print('first sstore entries', sstore[:5])
PY" in /tmp/codex-cyh1pt69 succeeded in 46ms:
dict_keys(['keccak_count', 'reads', 'slots', 'writes'])
reads 25 writes 6
slots count 23
unique ops ['SLOAD']
sstore entries count 0
first sstore entries []
thinking
**Analyzing storage and delegatecall risks**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
bb = data['analysis_artifact']['artifact_json']['basic_blocks']
for b in bb:
if 232 <= b['start_pc'] <= 312:
print('block', b['start_pc'], b['end_pc'])
print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 76ms:
block 232 261
['JUMPDEST', 'CALLER', 'PUSH1', 'OP_90', 'OP_81', 'MSTORE', 'PUSH1', 'PUSH1', 'MSTORE', 'PUSH1', 'OP_81', 'SHA3', 'SLOAD', 'CALLDATASIZE', 'OP_90', 'PUSH1', 'OP_90', 'PUSH1', 'EQ', 'OP_80', 'PUSH2', 'JUMPI']
block 262 276
['POP', 'PUSH1', 'SLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'CALLER', 'EQ']
block 277 282
['JUMPDEST', 'OP_80', 'PUSH2', 'JUMPI']
block 283 286
['POP', 'CALLER', 'ADDRESS', 'EQ']
block 287 292
['JUMPDEST', 'OP_80', 'PUSH2', 'JUMPI']
block 293 307
['POP', 'PUSH1', 'SLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'CALLER', 'EQ']
block 308 312
['JUMPDEST', 'PUSH2', 'JUMPI']
thinking
**Analyzing access control and delegatecall patterns**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
entries = data['analysis_artifact']['artifact_json']['function_entries']
print('function_entries count', len(entries))
print(entries[:10])
PY" in /tmp/codex-cyh1pt69 succeeded in 75ms:
function_entries count 14
[{'entry_pc': 2855094825, 'selector': '0xaa2d4a29'}, {'entry_pc': 3991757201, 'selector': '0xd89da49c'}, {'entry_pc': 4022048962, 'selector': '0xeded6191'}, {'entry_pc': None, 'selector': '0xefbb98c2'}, {'entry_pc': 2165140709, 'selector': '0x802a81d8'}, {'entry_pc': 2754971927, 'selector': '0x810d6ce5'}, {'entry_pc': None, 'selector': '0xa4358917'}, {'entry_pc': 533654911, 'selector': '0x1fceed7f'}, {'entry_pc': 1517302307, 'selector': '0x234ecf06'}, {'entry_pc': 1602552402, 'selector': '0x5a703223'}]
thinking
**Analyzing contract dispatch and call risks**
I'm exploring how large entry PCs might relate to hashed selectors or dynamic dispatch via storage tables. I'll look for fallback or receive functions by checking opcodes like CALLDATASIZE and JUMPI, and inspect key blocks to understand control flow. With evidence limits, I want to cautiously evaluate delegatecall and external call risks, assigning severity levels conservatively while noting any access control hints. I’m also trying to assess how call values are sourced by reviewing opcode blocks near the 1400 range to understand potential vulnerabilities more clearly.
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
bb = data['analysis_artifact']['artifact_json']['basic_blocks']
# Print blocks around 1380-1450
for b in bb:
if 1360 <= b['start_pc'] <= 1460:
print('block', b['start_pc'], b['end_pc'])
print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 26ms:
block 1413 1416
['PUSH1', 'OP_80', 'REVERT']
block 1417 1427
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']
block 1428 1436
['RETURNDATASIZE', 'PUSH1', 'OP_80', 'RETURNDATACOPY', 'RETURNDATASIZE', 'PUSH1', 'REVERT']
block 1437 1445
['JUMPDEST', 'POP', 'POP', 'POP', 'POP', 'POP', 'POP', 'POP', 'JUMP']
block 1446 1464
['JUMPDEST', 'PUSH1', 'SLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'CALLER', 'EQ', 'PUSH2', 'JUMPI']
thinking
**Investigating auth check location**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
data=json.load(f)
bb = data['analysis_artifact']['artifact_json']['basic_blocks']
# Print blocks around 1540-1590
for b in bb:
if 1540 <= b['start_pc'] <= 1600:
print('block', b['start_pc'], b['end_pc'])
print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 26ms:
block 1558 1561
['PUSH1', 'OP_80', 'REVERT']
block 1562 1572
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']
block 1573 1581
['RETURNDATASIZE', 'PUSH1', 'OP_80', 'RETURNDATACOPY', 'RETURNDATASIZE', 'PUSH1', 'REVERT']
block 1582 1617
['JUMPDEST', 'POP', 'POP', 'POP', 'POP', 'PUSH1', 'MLOAD', 'RETURNDATASIZE', 'PUSH1', 'NOT', 'PUSH1', 'OP_82', 'ADD', 'AND', 'OP_82', 'ADD', 'OP_80', 'PUSH1', 'MSTORE', 'POP', 'OP_81', 'ADD', 'OP_90', 'PUSH2', 'OP_91', 'OP_90', 'PUSH2', 'JUMP']
thinking
**Summarizing delegatecall and call risks**
I’m laying out two main findings about potential vulnerabilities: a high-severity risk from a computed delegatecall target without detected guards, suggesting possible arbitrary code execution, and a medium-severity risk from multiple computed external CALL sites possibly allowing unauthorized fund transfers. I’m carefully balancing the evidence, noting the uncertainty from validations and emphasizing the need for strict access control and guarded upgrade patterns.
thinking
**Completing vulnerability report JSON**
codex
{"no_findings":false,"summary":"Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.","findings":[{"severity":"high","category":"upgradeability","title":"Computed DELEGATECALL target allows potential arbitrary code execution","exploit_scenario":"If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract’s context, draining funds or overwriting state.","recommendation":"Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.","evidence":"Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.","locations":["pc:0x189"]},{"severity":"medium","category":"access_control","title":"Potential arbitrary external CALLs with value to computed targets","exploit_scenario":"If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract’s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets.","recommendation":"Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.","evidence":"Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.","locations":["pc:0x58c","pc:0x61d","pc:0x6eb","pc:0x8d6","pc:0x9da"]}]}
tokens used
91,543
{
"codex": {
"ran_at": "2026-01-10T21:24:16.308909+00:00",
"returncode": 0
},
"project": {
"mode": "bytecode",
"bytecode_length": 7392,
"bytecode_truncated": false,
"capability_graph_present": true,
"analysis_artifact_present": true
},
"summary": "Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.",
"raw_final": {
"summary": "Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.",
"findings": [
{
"title": "Computed DELEGATECALL target allows potential arbitrary code execution",
"category": "upgradeability",
"evidence": "Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.",
"severity": "high",
"locations": [
"pc:0x189"
],
"recommendation": "Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.",
"exploit_scenario": "If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract\u2019s context, draining funds or overwriting state."
},
{
"title": "Potential arbitrary external CALLs with value to computed targets",
"category": "access_control",
"evidence": "Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.",
"severity": "medium",
"locations": [
"pc:0x58c",
"pc:0x61d",
"pc:0x6eb",
"pc:0x8d6",
"pc:0x9da"
],
"recommendation": "Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.",
"exploit_scenario": "If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract\u2019s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets."
}
],
"no_findings": false
},
"no_findings": false,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x00e1 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH1 0xe0 00000012: SHR 00000013: DUP1 00000014: PUSH4 0x802a81d8 00000019: GT 0000001a: PUSH2 0x007f 0000001d: JUMPI 0000001e: DUP1 0000001f: PUSH4 0xaa2d4a29 00000024: GT 00000025: PUSH2 0x0059 00000028: JUMPI 00000029: DUP1 0000002a: PUSH4 0xaa2d4a29 0000002f: EQ 00000030: PUSH2 0x0342 00000033: JUMPI 00000034: DUP1 00000035: PUSH4 0xd89da49c 0000003a: EQ 0000003b: PUSH2 0x0362 0000003e: JUMPI 0000003f: DUP1 00000040: PUSH4 0xeded6191 00000045: EQ 00000046: PUSH2 0x0380 00000049: JUMPI 0000004a: DUP1 0000004b: PUSH4 0xefbb98c2 00000050: EQ 00000051: PUSH2 0x03a0 00000054: JUMPI 00000055: PUSH2 0x00e8 00000058: JUMP 00000059: JUMPDEST 0000005a: DUP1 0000005b: PUSH4 0x802a81d8 00000060: EQ 00000061: PUSH2 0x02e2 00000064: JUMPI 00000065: DUP1 00000066: PUSH4 0x810d6ce5 0000006b: EQ 0000006c: PUSH2 0x0302 0000006f: JUMPI 00000070: DUP1 00000071: PUSH4 0xa4358917 00000076: EQ 00000077: PUSH2 0x0322 0000007a: JUMPI 0000007b: PUSH2 0x00e8 0000007e: JUMP 0000007f: JUMPDEST 00000080: DUP1 00000081: PUSH4 0x1fceed7f 00000086: GT 00000087: PUSH2 0x00bb 0000008a: JUMPI 0000008b: DUP1 0000008c: PUSH4 0x1fceed7f 00000091: EQ 00000092: PUSH2 0x0262 00000095: JUMPI 00000096: DUP1 00000097: PUSH4 0x234ecf06 0000009c: EQ 0000009d: PUSH2 0x0282 000000a0: JUMPI 000000a1: DUP1 000000a2: PUSH4 0x5a703223 000000a7: EQ 000000a8: PUSH2 0x02a2 000000ab: JUMPI 000000ac: DUP1 000000ad: PUSH4 0x5f850252 000000b2: EQ 000000b3: PUSH2 0x02c2 000000b6: JUMPI 000000b7: PUSH2 0x00e8 000000ba: JUMP 000000bb: JUMPDEST 000000bc: DUP1 000000bd: PUSH4 0x0ae50a39 000000c2: EQ 000000c3: PUSH2 0x01ea 000000c6: JUMPI 000000c7: DUP1 000000c8: PUSH4 0x12038e5d 000000cd: EQ 000000ce: PUSH2 0x0220 000000d1: JUMPI 000000d2: DUP1 000000d3: PUSH4 0x167d3e9c 000000d8: EQ 000000d9: PUSH2 0x0242 000000dc: JUMPI 000000dd: PUSH2 0x00e8 000000e0: JUMP 000000e1: JUMPDEST 000000e2: CALLDATASIZE 000000e3: PUSH2 0x00e8 000000e6: JUMPI 000000e7: STOP 000000e8: JUMPDEST 000000e9: CALLER 000000ea: PUSH1 0x00 000000ec: SWAP1 000000ed: DUP2 000000ee: MSTORE 000000ef: PUSH1 0x02 000000f1: PUSH1 0x20 000000f3: MSTORE 000000f4: PUSH1 0x40 000000f6: DUP2 000000f7: KECCAK256 000000f8: SLOAD 000000f9: CALLDATASIZE 000000fa: SWAP1 000000fb: PUSH1 0x60 000000fd: SWAP1 000000fe: PUSH1 0x01 00000100: EQ 00000101: DUP1 00000102: PUSH2 0x0115 00000105: JUMPI 00000106: POP 00000107: PUSH1 0x03 00000109: SLOAD 0000010a: PUSH1 0x01 0000010c: PUSH1 0x01 0000010e: PUSH1 0xa0 00000110: SHL 00000111: SUB 00000112: AND 00000113: CALLER 00000114: EQ 00000115: JUMPDEST 00000116: DUP1 00000117: PUSH2 0x011f 0000011a: JUMPI 0000011b: POP 0000011c: CALLER 0000011d: ADDRESS 0000011e: EQ 0000011f: JUMPDEST 00000120: DUP1 00000121: PUSH2 0x0134 00000124: JUMPI 00000125: POP 00000126: PUSH1 0x01 00000128: SLOAD 00000129: PUSH1 0x01 0000012b: PUSH1 0x01 0000012d: PUSH1 0xa0 0000012f: SHL 00000130: SUB 00000131: AND 00000132: CALLER 00000133: EQ 00000134: JUMPDEST 00000135: PUSH2 0x0159 00000138: JUMPI 00000139: PUSH1 0x40 0000013b: MLOAD 0000013c: PUSH3 0x461bcd 00000140: PUSH1 0xe5 00000142: SHL 00000143: DUP2 00000144: MSTORE 00000145: PUSH1 0x04 00000147: ADD 00000148: PUSH2 0x0150 0000014b: SWAP1 0000014c: PUSH2 0x0d16 0000014f: JUMP 00000150: JUMPDEST 00000151: PUSH1 0x40 00000153: MLOAD 00000154: DUP1 00000155: SWAP2 00000156: SUB 00000157: SWAP1 00000158: REVERT 00000159: JUMPDEST 0000015a: PUSH1 0x00 0000015c: DUP1 0000015d: SLOAD 0000015e: PUSH1 0x04 00000160: SLOAD 00000161: PUSH1 0x40 00000163: MLOAD 00000164: DUP4 00000165: SWAP3 00000166: PUSH1 0x01 00000168: PUSH1 0x01 0000016a: PUSH1 0xa0 0000016c: SHL 0000016d: SUB 0000016e: AND 0000016f: SWAP2 00000170: SWAP1 00000171: PUSH2 0x017d 00000174: SWAP1 00000175: DUP5 00000176: SWAP1 00000177: CALLDATASIZE 00000178: SWAP1 00000179: PUSH2 0x0cb7 0000017c: JUMP 0000017d: JUMPDEST 0000017e: PUSH1 0x00 00000180: PUSH1 0x40 00000182: MLOAD 00000183: DUP1 00000184: DUP4 00000185: SUB 00000186: DUP2 00000187: DUP7 00000188: DUP7 00000189: DELEGATECALL 0000018a: SWAP3 0000018b: POP 0000018c: POP 0000018d: POP 0000018e: RETURNDATASIZE 0000018f: DUP1 00000190: PUSH1 0x00 00000192: DUP2 00000193: EQ 00000194: PUSH2 0x01b9 00000197: JUMPI 00000198: PUSH1 0x40 0000019a: MLOAD 0000019b: SWAP2 0000019c: POP 0000019d: PUSH1 0x1f 0000019f: NOT 000001a0: PUSH1 0x3f 000001a2: RETURNDATASIZE 000001a3: ADD 000001a4: AND 000001a5: DUP3 000001a6: ADD 000001a7: PUSH1 0x40 000001a9: MSTORE 000001aa: RETURNDATASIZE 000001ab: DUP3 000001ac: MSTORE 000001ad: RETURNDATASIZE 000001ae: PUSH1 0x00 000001b0: PUSH1 0x20 000001b2: DUP5 000001b3: ADD 000001b4: RETURNDATACOPY 000001b5: PUSH2 0x01be 000001b8: JUMP 000001b9: JUMPDEST 000001ba: PUSH1 0x60 000001bc: SWAP2 000001bd: POP 000001be: JUMPDEST 000001bf: POP 000001c0: SWAP2 000001c1: POP 000001c2: SWAP2 000001c3: POP 000001c4: DUP2 000001c5: ISZERO 000001c6: PUSH2 0x01d2 000001c9: JUMPI 000001ca: SWAP2 000001cb: POP 000001cc: PUSH2 0x01df 000001cf: SWAP1 000001d0: POP 000001d1: JUMP 000001d2: JUMPDEST 000001d3: PUSH1 0x40 000001d5: MLOAD 000001d6: RETURNDATASIZE 000001d7: DUP1 000001d8: PUSH1 0x00 000001da: DUP4 000001db: RETURNDATACOPY 000001dc: DUP1 000001dd: DUP3 000001de: REVERT 000001df: JUMPDEST 000001e0: SWAP2 000001e1: POP 000001e2: POP 000001e3: DUP1 000001e4: MLOAD 000001e5: SWAP1 000001e6: PUSH1 0x20 000001e8: ADD 000001e9: RETURN 000001ea: JUMPDEST 000001eb: CALLVALUE 000001ec: DUP1 000001ed: ISZERO 000001ee: PUSH2 0x01f6 000001f1: JUMPI 000001f2: PUSH1 0x00 000001f4: DUP1 000001f5: REVERT 000001f6: JUMPDEST 000001f7: POP 000001f8: PUSH1 0x01 000001fa: SLOAD 000001fb: PUSH1 0x01 000001fd: PUSH1 0x01 000001ff: PUSH1 0xa0 00000201: SHL 00000202: SUB 00000203: AND 00000204: JUMPDEST 00000205: PUSH1 0x40 00000207: MLOAD 00000208: PUSH1 0x01 0000020a: PUSH1 0x01 0000020c: PUSH1 0xa0 0000020e: SHL 0000020f: SUB 00000210: SWAP1 00000211: SWAP2 00000212: AND 00000213: DUP2 00000214: MSTORE 00000215: PUSH1 0x20 00000217: ADD 00000218: PUSH1 0x40 0000021a: MLOAD 0000021b: DUP1 0000021c: SWAP2 0000021d: SUB 0000021e: SWAP1 0000021f: RETURN 00000220: JUMPDEST 00000221: CALLVALUE 00000222: DUP1 00000223: ISZERO 00000224: PUSH2 0x022c 00000227: JUMPI 00000228: PUSH1 0x00 0000022a: DUP1 0000022b: REVERT 0000022c: JUMPDEST 0000022d: POP 0000022e: PUSH2 0x0240 00000231: PUSH2 0x023b 00000234: CALLDATASIZE 00000235: PUSH1 0x04 00000237: PUSH2 0x0a7f 0000023a: JUMP 0000023b: JUMPDEST 0000023c: PUSH2 0x03c0 0000023f: JUMP 00000240: JUMPDEST 00000241: STOP 00000242: JUMPDEST 00000243: CALLVALUE 00000244: DUP1 00000245: ISZERO 00000246: PUSH2 0x024e 00000249: JUMPI 0000024a: PUSH1 0x00 0000024c: DUP1 0000024d: REVERT 0000024e: JUMPDEST 0000024f: POP 00000250: PUSH2 0x0240 00000253: PUSH2 0x025d 00000256: CALLDATASIZE 00000257: PUSH1 0x04 00000259: PUSH2 0x0a7f 0000025c: JUMP 0000025d: JUMPDEST 0000025e: PUSH2 0x0445 00000261: JUMP 00000262: JUMPDEST 00000263: CALLVALUE 00000264: DUP1 00000265: ISZERO 00000266: PUSH2 0x026e 00000269: JUMPI 0000026a: PUSH1 0x00 0000026c: DUP1 0000026d: REVERT 0000026e: JUMPDEST 0000026f: POP 00000270: PUSH2 0x0240 00000273: PUSH2 0x027d 00000276: CALLDATASIZE 00000277: PUSH1 0x04 00000279: PUSH2 0x0b07 0000027c: JUMP 0000027d: JUMPDEST 0000027e: PUSH2 0x0491 00000281: JUMP 00000282: JUMPDEST 00000283: CALLVALUE 00000284: DUP1 00000285: ISZERO 00000286: PUSH2 0x028e 00000289: JUMPI 0000028a: PUSH1 0x00 0000028c: DUP1 0000028d: REVERT 0000028e: JUMPDEST 0000028f: POP 00000290: PUSH2 0x0240 00000293: PUSH2 0x029d 00000296: CALLDATASIZE 00000297: PUSH1 0x04 00000299: PUSH2 0x0add 0000029c: JUMP 0000029d: JUMPDEST 0000029e: PUSH2 0x051b 000002a1: JUMP 000002a2: JUMPDEST 000002a3: CALLVALUE 000002a4: DUP1 000002a5: ISZERO 000002a6: PUSH2 0x02ae 000002a9: JUMPI 000002aa: PUSH1 0x00 000002ac: DUP1 000002ad: REVERT 000002ae: JUMPDEST 000002af: POP 000002b0: PUSH2 0x0240 000002b3: PUSH2 0x02bd 000002b6: CALLDATASIZE 000002b7: PUSH1 0x04 000002b9: PUSH2 0x0add 000002bc: JUMP 000002bd: JUMPDEST 000002be: PUSH2 0x05a6 000002c1: JUMP 000002c2: JUMPDEST 000002c3: CALLVALUE 000002c4: DUP1 000002c5: ISZERO 000002c6: PUSH2 0x02ce 000002c9: JUMPI 000002ca: PUSH1 0x00 000002cc: DUP1 000002cd: REVERT 000002ce: JUMPDEST 000002cf: POP 000002d0: PUSH2 0x0240 000002d3: PUSH2 0x02dd 000002d6: CALLDATASIZE 000002d7: PUSH1 0x04 000002d9: PUSH2 0x0a7f 000002dc: JUMP 000002dd: JUMPDEST 000002de: PUSH2 0x0658 000002e1: JUMP 000002e2: JUMPDEST 000002e3: CALLVALUE 000002e4: DUP1 000002e5: ISZERO 000002e6: PUSH2 0x02ee 000002e9: JUMPI 000002ea: PUSH1 0x00 000002ec: DUP1 000002ed: REVERT 000002ee: JUMPDEST 000002ef: POP 000002f0: PUSH2 0x0240 000002f3: PUSH2 0x02fd 000002f6: CALLDATASIZE 000002f7: PUSH1 0x04 000002f9: PUSH2 0x0add 000002fc: JUMP 000002fd: JUMPDEST 000002fe: PUSH2 0x06a4 00000301: JUMP 00000302: JUMPDEST 00000303: CALLVALUE 00000304: DUP1 00000305: ISZERO 00000306: PUSH2 0x030e 00000309: JUMPI 0000030a: PUSH1 0x00 0000030c: DUP1 0000030d: REVERT 0000030e: JUMPDEST 0000030f: POP 00000310: PUSH2 0x0240 00000313: PUSH2 0x031d 00000316: CALLDATASIZE 00000317: PUSH1 0x04 00000319: PUSH2 0x0c9e 0000031c: JUMP 0000031d: JUMPDEST 0000031e: PUSH2 0x0728 00000321: JUMP 00000322: JUMPDEST 00000323: CALLVALUE 00000324: DUP1 00000325: ISZERO 00000326: PUSH2 0x032e 00000329: JUMPI 0000032a: PUSH1 0x00 0000032c: DUP1 0000032d: REVERT 0000032e: JUMPDEST 0000032f: POP 00000330: PUSH2 0x0240 00000333: PUSH2 0x033d 00000336: CALLDATASIZE 00000337: PUSH1 0x04 00000339: PUSH2 0x0b07 0000033c: JUMP 0000033d: JUMPDEST 0000033e: PUSH2 0x0757 00000341: JUMP 00000342: JUMPDEST 00000343: CALLVALUE 00000344: DUP1 00000345: ISZERO 00000346: PUSH2 0x034e 00000349: JUMPI 0000034a: PUSH1 0x00 0000034c: DUP1 0000034d: REVERT 0000034e: JUMPDEST 0000034f: POP 00000350: PUSH2 0x0240 00000353: PUSH2 0x035d 00000356: CALLDATASIZE 00000357: PUSH1 0x04 00000359: PUSH2 0x0bab 0000035c: JUMP 0000035d: JUMPDEST 0000035e: PUSH2 0x07d9 00000361: JUMP 00000362: JUMPDEST 00000363: CALLVALUE 00000364: DUP1 00000365: ISZERO 00000366: PUSH2 0x036e 00000369: JUMPI 0000036a: PUSH1 0x00 0000036c: DUP1 0000036d: REVERT 0000036e: JUMPDEST 0000036f: POP 00000370: PUSH1 0x00 00000372: SLOAD 00000373: PUSH1 0x01 00000375: PUSH1 0x01 00000377: PUSH1 0xa0 00000379: SHL 0000037a: SUB 0000037b: AND 0000037c: PUSH2 0x0204 0000037f: JUMP 00000380: JUMPDEST 00000381: CALLVALUE 00000382: DUP1 00000383: ISZERO 00000384: PUSH2 0x038c 00000387: JUMPI 00000388: PUSH1 0x00 0000038a: DUP1 0000038b: REVERT 0000038c: JUMPDEST 0000038d: POP 0000038e: PUSH2 0x0240 00000391: PUSH2 0x039b 00000394: CALLDATASIZE 00000395: PUSH1 0x04 00000397: PUSH2 0x0aa1 0000039a: JUMP 0000039b: JUMPDEST 0000039c: PUSH2 0x085f 0000039f: JUMP 000003a0: JUMPDEST 000003a1: CALLVALUE 000003a2: DUP1 000003a3: ISZERO 000003a4: PUSH2 0x03ac 000003a7: JUMPI 000003a8: PUSH1 0x00 000003aa: DUP1 000003ab: REVERT 000003ac: JUMPDEST 000003ad: POP 000003ae: PUSH2 0x0240 000003b1: PUSH2 0x03bb 000003b4: CALLDATASIZE 000003b5: PUSH1 0x04 000003b7: PUSH2 0x0c9e 000003ba: JUMP 000003bb: JUMPDEST 000003bc: PUSH2 0x0895 000003bf: JUMP 000003c0: JUMPDEST 000003c1: CALLER 000003c2: PUSH1 0x00 000003c4: SWAP1 000003c5: DUP2 000003c6: MSTORE 000003c7: PUSH1 0x02 000003c9: PUSH1 0x20 000003cb: MSTORE 000003cc: PUSH1 0x40 000003ce: SWAP1 000003cf: KECCAK256 000003d0: SLOAD 000003d1: PUSH1 0x01 000003d3: EQ 000003d4: DUP1 000003d5: PUSH2 0x03e8 000003d8: JUMPI 000003d9: POP 000003da: PUSH1 0x03 000003dc: SLOAD 000003dd: PUSH1 0x01 000003df: PUSH1 0x01 000003e1: PUSH1 0xa0 000003e3: SHL 000003e4: SUB 000003e5: AND 000003e6: CALLER 000003e7: EQ 000003e8: JUMPDEST 000003e9: DUP1 000003ea: PUSH2 0x03f2 000003ed: JUMPI 000003ee: POP 000003ef: CALLER 000003f0: ADDRESS 000003f1: EQ 000003f2: JUMPDEST 000003f3: DUP1 000003f4: PUSH2 0x0407 000003f7: JUMPI 000003f8: POP 000003f9: PUSH1 0x01 000003fb: SLOAD 000003fc: PUSH1 0x01 000003fe: PUSH1 0x01 00000400: PUSH1 0xa0 00000402: SHL 00000403: SUB 00000404: AND 00000405: CALLER 00000406: EQ 00000407: JUMPDEST 00000408: PUSH2 0x0423 0000040b: JUMPI 0000040c: PUSH1 0x40 0000040e: MLOAD 0000040f: PUSH3 0x461bcd 00000413: PUSH1 0xe5 00000415: SHL 00000416: DUP2 00000417: MSTORE 00000418: PUSH1 0x04 0000041a: ADD 0000041b: PUSH2 0x0150 0000041e: SWAP1 0000041f: PUSH2 0x0d16 00000422: JUMP 00000423: JUMPDEST 00000424: PUSH1 0x03 00000426: DUP1 00000427: SLOAD 00000428: PUSH1 0x01 0000042a: PUSH1 0x01 0000042c: PUSH1 0xa0 0000042e: SHL 0000042f: SUB 00000430: NOT 00000431: AND 00000432: PUSH1 0x01 00000434: PUSH1 0x01 00000436: PUSH1 0xa0 00000438: SHL 00000439: SUB 0000043a: SWAP3 0000043b: SWAP1 0000043c: SWAP3 0000043d: AND 0000043e: SWAP2 0000043f: SWAP1 00000440: SWAP2 00000441: OR 00000442: SWAP1 00000443: SSTORE 00000444: JUMP 00000445: JUMPDEST 00000446: PUSH1 0x01 00000448: SLOAD 00000449: PUSH1 0x01 0000044b: PUSH1 0x01 0000044d: PUSH1 0xa0 0000044f: SHL 00000450: SUB 00000451: AND 00000452: CALLER 00000453: EQ 00000454: PUSH2 0x046f 00000457: JUMPI 00000458: PUSH1 0x40 0000045a: MLOAD 0000045b: PUSH3 0x461bcd 0000045f: PUSH1 0xe5 00000461: SHL 00000462: DUP2 00000463: MSTORE 00000464: PUSH1 0x04 00000466: ADD 00000467: PUSH2 0x0150 0000046a: SWAP1 0000046b: PUSH2 0x0d16 0000046e: JUMP 0000046f: JUMPDEST 00000470: PUSH1 0x01 00000472: DUP1 00000473: SLOAD 00000474: PUSH1 0x01 00000476: PUSH1 0x01 00000478: PUSH1 0xa0 0000047a: SHL 0000047b: SUB 0000047c: NOT 0000047d: AND 0000047e: PUSH1 0x01 00000480: PUSH1 0x01 00000482: PUSH1 0xa0 00000484: SHL 00000485: SUB 00000486: SWAP3 00000487: SWAP1 00000488: SWAP3 00000489: AND 0000048a: SWAP2 0000048b: SWAP1 0000048c: SWAP2 0000048d: OR 0000048e: SWAP1 0000048f: SSTORE 00000490: JUMP 00000491: JUMPDEST 00000492: PUSH1 0x01 00000494: SLOAD 00000495: PUSH1 0x01 00000497: PUSH1 0x01 00000499: PUSH1 0xa0 0000049b: SHL 0000049c: SUB 0000049d: AND 0000049e: CALLER 0000049f: EQ 000004a0: PUSH2 0x04bb 000004a3: JUMPI 000004a4: PUSH1 0x40 000004a6: MLOAD 000004a7: PUSH3 0x461bcd 000004ab: PUSH1 0xe5 000004ad: SHL 000004ae: DUP2 000004af: MSTORE 000004b0: PUSH1 0x04 000004b2: ADD 000004b3: PUSH2 0x0150 000004b6: SWAP1 000004b7: PUSH2 0x0d16 000004ba: JUMP 000004bb: JUMPDEST 000004bc: DUP1 000004bd: MLOAD 000004be: PUSH1 0x00 000004c0: JUMPDEST 000004c1: DUP2 000004c2: DUP2 000004c3: LT 000004c4: ISZERO 000004c5: PUSH2 0x0516 000004c8: JUMPI 000004c9: PUSH1 0x00 000004cb: DUP4 000004cc: DUP3 000004cd: DUP2 000004ce: MLOAD 000004cf: DUP2 000004d0: LT 000004d1: PUSH2 0x04dc 000004d4: JUMPI 000004d5: PUSH2 0x04dc 000004d8: PUSH2 0x0e0d 000004db: JUMP 000004dc: JUMPDEST 000004dd: PUSH1 0x20 000004df: SWAP1 000004e0: DUP2 000004e1: MUL 000004e2: SWAP2 000004e3: SWAP1 000004e4: SWAP2 000004e5: ADD 000004e6: DUP2 000004e7: ADD 000004e8: MLOAD 000004e9: PUSH1 0x01 000004eb: PUSH1 0x01 000004ed: PUSH1 0xa0 000004ef: SHL 000004f0: SUB 000004f1: AND 000004f2: PUSH1 0x00 000004f4: SWAP1 000004f5: DUP2 000004f6: MSTORE 000004f7: PUSH1 0x02 000004f9: SWAP1 000004fa: SWAP2 000004fb: MSTORE 000004fc: PUSH1 0x40 000004fe: SWAP1 000004ff: KECCAK256 00000500: PUSH1 0x01 00000502: SWAP1 00000503: SSTORE 00000504: POP 00000505: DUP1 00000506: PUSH2 0x050e 00000509: DUP2 0000050a: PUSH2 0x0de4 0000050d: JUMP 0000050e: JUMPDEST 0000050f: SWAP2 00000510: POP 00000511: POP 00000512: PUSH2 0x04c0 00000515: JUMP 00000516: JUMPDEST 00000517: POP 00000518: POP 00000519: POP 0000051a: JUMP 0000051b: JUMPDEST 0000051c: PUSH1 0x01 0000051e: SLOAD 0000051f: PUSH1 0x01 00000521: PUSH1 0x01 00000523: PUSH1 0xa0 00000525: SHL 00000526: SUB 00000527: AND 00000528: CALLER 00000529: EQ 0000052a: PUSH2 0x0545 0000052d: JUMPI 0000052e: PUSH1 0x40 00000530: MLOAD 00000531: PUSH3 0x461bcd 00000535: PUSH1 0xe5 00000537: SHL 00000538: DUP2 00000539: MSTORE 0000053a: PUSH1 0x04 0000053c: ADD 0000053d: PUSH2 0x0150 00000540: SWAP1 00000541: PUSH2 0x0d16 00000544: JUMP 00000545: JUMPDEST 00000546: PUSH1 0x40 00000548: MLOAD 00000549: PUSH4 0x2e1a7d4d 0000054e: PUSH1 0xe0 00000550: SHL 00000551: DUP2 00000552: MSTORE 00000553: PUSH1 0x04 00000555: DUP2 00000556: ADD 00000557: DUP3 00000558: SWAP1 00000559: MSTORE 0000055a: DUP3 0000055b: SWAP1 0000055c: PUSH1 0x01 0000055e: PUSH1 0x01 00000560: PUSH1 0xa0 00000562: SHL 00000563: SUB 00000564: DUP3 00000565: AND 00000566: SWAP1 00000567: PUSH4 0x2e1a7d4d 0000056c: SWAP1 0000056d: PUSH1 0x24 0000056f: ADD 00000570: PUSH1 0x00 00000572: PUSH1 0x40 00000574: MLOAD 00000575: DUP1 00000576: DUP4 00000577: SUB 00000578: DUP2 00000579: PUSH1 0x00 0000057b: DUP8 0000057c: DUP1 0000057d: EXTCODESIZE 0000057e: ISZERO 0000057f: DUP1 00000580: ISZERO 00000581: PUSH2 0x0589 00000584: JUMPI 00000585: PUSH1 0x00 00000587: DUP1 00000588: REVERT 00000589: JUMPDEST 0000058a: POP 0000058b: GAS 0000058c: CALL 0000058d: ISZERO 0000058e: DUP1 0000058f: ISZERO 00000590: PUSH2 0x059d 00000593: JUMPI 00000594: RETURNDATASIZE 00000595: PUSH1 0x00 00000597: DUP1 00000598: RETURNDATACOPY 00000599: RETURNDATASIZE 0000059a: PUSH1 0x00 0000059c: REVERT 0000059d: JUMPDEST 0000059e: POP 0000059f: POP 000005a0: POP 000005a1: POP 000005a2: POP 000005a3: POP 000005a4: POP 000005a5: JUMP 000005a6: JUMPDEST 000005a7: PUSH1 0x01 000005a9: SLOAD 000005aa: PUSH1 0x01 000005ac: PUSH1 0x01 000005ae: PUSH1 0xa0 000005b0: SHL 000005b1: SUB 000005b2: AND 000005b3: CALLER 000005b4: EQ 000005b5: PUSH2 0x05d0 000005b8: JUMPI 000005b9: PUSH1 0x40 000005bb: MLOAD 000005bc: PUSH3 0x461bcd 000005c0: PUSH1 0xe5 000005c2: SHL 000005c3: DUP2 000005c4: MSTORE 000005c5: PUSH1 0x04 000005c7: ADD 000005c8: PUSH2 0x0150 000005cb: SWAP1 000005cc: PUSH2 0x0d16 000005cf: JUMP 000005d0: JUMPDEST 000005d1: PUSH1 0x40 000005d3: MLOAD 000005d4: PUSH4 0xa9059cbb 000005d9: PUSH1 0xe0 000005db: SHL 000005dc: DUP2 000005dd: MSTORE 000005de: CALLER 000005df: PUSH1 0x04 000005e1: DUP3 000005e2: ADD 000005e3: MSTORE 000005e4: PUSH1 0x24 000005e6: DUP2 000005e7: ADD 000005e8: DUP3 000005e9: SWAP1 000005ea: MSTORE 000005eb: DUP3 000005ec: SWAP1 000005ed: PUSH1 0x01 000005ef: PUSH1 0x01 000005f1: PUSH1 0xa0 000005f3: SHL 000005f4: SUB 000005f5: DUP3 000005f6: AND 000005f7: SWAP1 000005f8: PUSH4 0xa9059cbb 000005fd: SWAP1 000005fe: PUSH1 0x44 00000600: ADD 00000601: PUSH1 0x20 00000603: PUSH1 0x40 00000605: MLOAD 00000606: DUP1 00000607: DUP4 00000608: SUB 00000609: DUP2 0000060a: PUSH1 0x00 0000060c: DUP8 0000060d: DUP1 0000060e: EXTCODESIZE 0000060f: ISZERO 00000610: DUP1 00000611: ISZERO 00000612: PUSH2 0x061a 00000615: JUMPI 00000616: PUSH1 0x00 00000618: DUP1 00000619: REVERT 0000061a: JUMPDEST 0000061b: POP 0000061c: GAS 0000061d: CALL 0000061e: ISZERO 0000061f: DUP1 00000620: ISZERO 00000621: PUSH2 0x062e 00000624: JUMPI 00000625: RETURNDATASIZE 00000626: PUSH1 0x00 00000628: DUP1 00000629: RETURNDATACOPY 0000062a: RETURNDATASIZE 0000062b: PUSH1 0x00 0000062d: REVERT 0000062e: JUMPDEST 0000062f: POP 00000630: POP 00000631: POP 00000632: POP 00000633: PUSH1 0x40 00000635: MLOAD 00000636: RETURNDATASIZE 00000637: PUSH1 0x1f 00000639: NOT 0000063a: PUSH1 0x1f 0000063c: DUP3 0000063d: ADD 0000063e: AND 0000063f: DUP3 00000640: ADD 00000641: DUP1 00000642: PUSH1 0x40 00000644: MSTORE 00000645: POP 00000646: DUP2 00000647: ADD 00000648: SWAP1 00000649: PUSH2 0x0652 0000064c: SWAP2 0000064d: SWAP1 0000064e: PUSH2 0x0c7c 00000651: JUMP 00000652: JUMPDEST 00000653: POP 00000654: POP 00000655: POP 00000656: POP 00000657: JUMP 00000658: JUMPDEST 00000659: PUSH1 0x01 0000065b: SLOAD 0000065c: PUSH1 0x01 0000065e: PUSH1 0x01 00000660: PUSH1 0xa0 00000662: SHL 00000663: SUB 00000664: AND 00000665: CALLER 00000666: EQ 00000667: PUSH2 0x0682 0000066a: JUMPI 0000066b: PUSH1 0x40 0000066d: MLOAD 0000066e: PUSH3 0x461bcd 00000672: PUSH1 0xe5 00000674: SHL 00000675: DUP2 00000676: MSTORE 00000677: PUSH1 0x04 00000679: ADD 0000067a: PUSH2 0x0150 0000067d: SWAP1 0000067e: PUSH2 0x0d16 00000681: JUMP 00000682: JUMPDEST 00000683: PUSH1 0x00 00000685: DUP1 00000686: SLOAD 00000687: PUSH1 0x01 00000689: PUSH1 0x01 0000068b: PUSH1 0xa0 0000068d: SHL 0000068e: SUB 0000068f: NOT 00000690: AND 00000691: PUSH1 0x01 00000693: PUSH1 0x01 00000695: PUSH1 0xa0 00000697: SHL 00000698: SUB 00000699: SWAP3 0000069a: SWAP1 0000069b: SWAP3 0000069c: AND 0000069d: SWAP2 0000069e: SWAP1 0000069f: SWAP2 000006a0: OR 000006a1: SWAP1 000006a2: SSTORE 000006a3: JUMP 000006a4: JUMPDEST 000006a5: PUSH1 0x01 000006a7: SLOAD 000006a8: PUSH1 0x01 000006aa: PUSH1 0x01 000006ac: PUSH1 0xa0 000006ae: SHL 000006af: SUB 000006b0: AND 000006b1: CALLER 000006b2: EQ 000006b3: PUSH2 0x06ce 000006b6: JUMPI 000006b7: PUSH1 0x40 000006b9: MLOAD 000006ba: PUSH3 0x461bcd 000006be: PUSH1 0xe5 000006c0: SHL 000006c1: DUP2 000006c2: MSTORE 000006c3: PUSH1 0x04 000006c5: ADD 000006c6: PUSH2 0x0150 000006c9: SWAP1 000006ca: PUSH2 0x0d16 000006cd: JUMP 000006ce: JUMPDEST 000006cf: PUSH1 0x04 000006d1: SLOAD 000006d2: PUSH1 0x40 000006d4: MLOAD 000006d5: PUSH1 0x01 000006d7: PUSH1 0x01 000006d9: PUSH1 0xa0 000006db: SHL 000006dc: SUB 000006dd: DUP5 000006de: AND 000006df: SWAP2 000006e0: SWAP1 000006e1: DUP4 000006e2: SWAP1 000006e3: PUSH1 0x00 000006e5: DUP2 000006e6: DUP2 000006e7: DUP2 000006e8: DUP6 000006e9: DUP9 000006ea: DUP9 000006eb: CALL 000006ec: SWAP4 000006ed: POP 000006ee: POP 000006ef: POP 000006f0: POP 000006f1: RETURNDATASIZE 000006f2: DUP1 000006f3: PUSH1 0x00 000006f5: DUP2 000006f6: EQ 000006f7: PUSH2 0x071c 000006fa: JUMPI 000006fb: PUSH1 0x40 000006fd: MLOAD 000006fe: SWAP2 000006ff: POP 00000700: PUSH1 0x1f 00000702: NOT 00000703: PUSH1 0x3f 00000705: RETURNDATASIZE 00000706: ADD 00000707: AND 00000708: DUP3 00000709: ADD 0000070a: PUSH1 0x40 0000070c: MSTORE 0000070d: RETURNDATASIZE 0000070e: DUP3 0000070f: MSTORE 00000710: RETURNDATASIZE 00000711: PUSH1 0x00 00000713: PUSH1 0x20 00000715: DUP5 00000716: ADD 00000717: RETURNDATACOPY 00000718: PUSH2 0x0721 0000071b: JUMP 0000071c: JUMPDEST 0000071d: PUSH1 0x60 0000071f: SWAP2 00000720: POP 00000721: JUMPDEST 00000722: POP 00000723: POP 00000724: POP 00000725: POP 00000726: POP 00000727: JUMP 00000728: JUMPDEST 00000729: PUSH1 0x01 0000072b: SLOAD 0000072c: PUSH1 0x01 0000072e: PUSH1 0x01 00000730: PUSH1 0xa0 00000732: SHL 00000733: SUB 00000734: AND 00000735: CALLER 00000736: EQ 00000737: PUSH2 0x0752 0000073a: JUMPI 0000073b: PUSH1 0x40 0000073d: MLOAD 0000073e: PUSH3 0x461bcd 00000742: PUSH1 0xe5 00000744: SHL 00000745: DUP2 00000746: MSTORE 00000747: PUSH1 0x04 00000749: ADD 0000074a: PUSH2 0x0150 0000074d: SWAP1 0000074e: PUSH2 0x0d16 00000751: JUMP 00000752: JUMPDEST 00000753: PUSH1 0x04 00000755: SSTORE 00000756: JUMP 00000757: JUMPDEST 00000758: PUSH1 0x01 0000075a: SLOAD 0000075b: PUSH1 0x01 0000075d: PUSH1 0x01 0000075f: PUSH1 0xa0 00000761: SHL 00000762: SUB 00000763: AND 00000764: CALLER 00000765: EQ 00000766: PUSH2 0x0781 00000769: JUMPI 0000076a: PUSH1 0x40 0000076c: MLOAD 0000076d: PUSH3 0x461bcd 00000771: PUSH1 0xe5 00000773: SHL 00000774: DUP2 00000775: MSTORE 00000776: PUSH1 0x04 00000778: ADD 00000779: PUSH2 0x0150 0000077c: SWAP1 0000077d: PUSH2 0x0d16 00000780: JUMP 00000781: JUMPDEST 00000782: DUP1 00000783: MLOAD 00000784: PUSH1 0x00 00000786: JUMPDEST 00000787: DUP2 00000788: DUP2 00000789: LT 0000078a: ISZERO 0000078b: PUSH2 0x0516 0000078e: JUMPI 0000078f: PUSH1 0x00 00000791: DUP4 00000792: DUP3 00000793: DUP2 00000794: MLOAD 00000795: DUP2 00000796: LT 00000797: PUSH2 0x07a2 0000079a: JUMPI 0000079b: PUSH2 0x07a2 0000079e: PUSH2 0x0e0d 000007a1: JUMP 000007a2: JUMPDEST 000007a3: PUSH1 0x20 000007a5: SWAP1 000007a6: DUP2 000007a7: MUL 000007a8: SWAP2 000007a9: SWAP1 000007aa: SWAP2 000007ab: ADD 000007ac: DUP2 000007ad: ADD 000007ae: MLOAD 000007af: PUSH1 0x01 000007b1: PUSH1 0x01 000007b3: PUSH1 0xa0 000007b5: SHL 000007b6: SUB 000007b7: AND 000007b8: PUSH1 0x00 000007ba: SWAP1 000007bb: DUP2 000007bc: MSTORE 000007bd: PUSH1 0x02 000007bf: SWAP1 000007c0: SWAP2 000007c1: MSTORE 000007c2: PUSH1 0x40 000007c4: DUP2 000007c5: KECCAK256 000007c6: SSTORE 000007c7: POP 000007c8: DUP1 000007c9: PUSH2 0x07d1 000007cc: DUP2 000007cd: PUSH2 0x0de4 000007d0: JUMP 000007d1: JUMPDEST 000007d2: SWAP2 000007d3: POP 000007d4: POP 000007d5: PUSH2 0x0786 000007d8: JUMP 000007d9: JUMPDEST 000007da: PUSH1 0x01 000007dc: SLOAD 000007dd: PUSH1 0x01 000007df: PUSH1 0x01 000007e1: PUSH1 0xa0 000007e3: SHL 000007e4: SUB 000007e5: AND 000007e6: CALLER 000007e7: EQ 000007e8: PUSH2 0x0803 000007eb: JUMPI 000007ec: PUSH1 0x40 000007ee: MLOAD 000007ef: PUSH3 0x461bcd 000007f3: PUSH1 0xe5 000007f5: SHL 000007f6: DUP2 000007f7: MSTORE 000007f8: PUSH1 0x04 000007fa: ADD 000007fb: PUSH2 0x0150 000007fe: SWAP1 000007ff: PUSH2 0x0d16 00000802: JUMP 00000803: JUMPDEST 00000804: DUP1 00000805: MLOAD 00000806: PUSH1 0x00 00000808: JUMPDEST 00000809: DUP2 0000080a: DUP2 0000080b: LT 0000080c: ISZERO 0000080d: PUSH2 0x0516 00000810: JUMPI 00000811: PUSH1 0x00 00000813: DUP4 00000814: DUP3 00000815: DUP2 00000816: MLOAD 00000817: DUP2 00000818: LT 00000819: PUSH2 0x0824 0000081c: JUMPI 0000081d: PUSH2 0x0824 00000820: PUSH2 0x0e0d 00000823: JUMP 00000824: JUMPDEST 00000825: PUSH1 0x20 00000827: MUL 00000828: PUSH1 0x20 0000082a: ADD 0000082b: ADD 0000082c: MLOAD 0000082d: SWAP1 0000082e: POP 0000082f: PUSH1 0x00 00000831: DUP2 00000832: PUSH1 0x00 00000834: ADD 00000835: MLOAD 00000836: SWAP1 00000837: POP 00000838: PUSH2 0x084a 0000083b: DUP2 0000083c: DUP4 0000083d: PUSH1 0x20 0000083f: ADD 00000840: MLOAD 00000841: DUP5 00000842: PUSH1 0x40 00000844: ADD 00000845: MLOAD 00000846: PUSH2 0x08f0 00000849: JUMP 0000084a: JUMPDEST 0000084b: POP 0000084c: POP 0000084d: DUP1 0000084e: DUP1 0000084f: PUSH2 0x0857 00000852: SWAP1 00000853: PUSH2 0x0de4 00000856: JUMP 00000857: JUMPDEST 00000858: SWAP2 00000859: POP 0000085a: POP 0000085b: PUSH2 0x0808 0000085e: JUMP 0000085f: JUMPDEST 00000860: PUSH1 0x01 00000862: SLOAD 00000863: PUSH1 0x01 00000865: PUSH1 0x01 00000867: PUSH1 0xa0 00000869: SHL 0000086a: SUB 0000086b: AND 0000086c: CALLER 0000086d: EQ 0000086e: PUSH2 0x0889 00000871: JUMPI 00000872: PUSH1 0x40 00000874: MLOAD 00000875: PUSH3 0x461bcd 00000879: PUSH1 0xe5 0000087b: SHL 0000087c: DUP2 0000087d: MSTORE 0000087e: PUSH1 0x04 00000880: ADD 00000881: PUSH2 0x0150 00000884: SWAP1 00000885: PUSH2 0x0d16 00000888: JUMP 00000889: JUMPDEST 0000088a: DUP3 0000088b: PUSH2 0x0652 0000088e: DUP2 0000088f: DUP5 00000890: DUP5 00000891: PUSH2 0x08f0 00000894: JUMP 00000895: JUMPDEST 00000896: PUSH1 0x01 00000898: SLOAD 00000899: PUSH1 0x01 0000089b: PUSH1 0x01 0000089d: PUSH1 0xa0 0000089f: SHL 000008a0: SUB 000008a1: AND 000008a2: CALLER 000008a3: EQ 000008a4: PUSH2 0x08bf 000008a7: JUMPI 000008a8: PUSH1 0x40 000008aa: MLOAD 000008ab: PUSH3 0x461bcd 000008af: PUSH1 0xe5 000008b1: SHL 000008b2: DUP2 000008b3: MSTORE 000008b4: PUSH1 0x04 000008b6: ADD 000008b7: PUSH2 0x0150 000008ba: SWAP1 000008bb: PUSH2 0x0d16 000008be: JUMP 000008bf: JUMPDEST 000008c0: PUSH1 0x40 000008c2: MLOAD 000008c3: CALLER 000008c4: SWAP1 000008c5: DUP3 000008c6: ISZERO 000008c7: PUSH2 0x08fc 000008ca: MUL 000008cb: SWAP1 000008cc: DUP4 000008cd: SWAP1 000008ce: PUSH1 0x00 000008d0: DUP2 000008d1: DUP2 000008d2: DUP2 000008d3: DUP6 000008d4: DUP9 000008d5: DUP9 000008d6: CALL 000008d7: SWAP4 000008d8: POP 000008d9: POP 000008da: POP 000008db: POP 000008dc: ISZERO 000008dd: DUP1 000008de: ISZERO 000008df: PUSH2 0x08ec 000008e2: JUMPI 000008e3: RETURNDATASIZE 000008e4: PUSH1 0x00 000008e6: DUP1 000008e7: RETURNDATACOPY 000008e8: RETURNDATASIZE 000008e9: PUSH1 0x00 000008eb: REVERT 000008ec: JUMPDEST 000008ed: POP 000008ee: POP 000008ef: JUMP 000008f0: JUMPDEST 000008f1: PUSH1 0x40 000008f3: DUP1 000008f4: MLOAD 000008f5: PUSH1 0x01 000008f7: PUSH1 0x01 000008f9: PUSH1 0xa0 000008fb: SHL 000008fc: SUB 000008fd: DUP5 000008fe: AND 000008ff: PUSH1 0x24 00000901: DUP3 00000902: ADD 00000903: MSTORE 00000904: PUSH1 0x44 00000906: DUP1 00000907: DUP3 00000908: ADD 00000909: DUP5 0000090a: SWAP1 0000090b: MSTORE 0000090c: DUP3 0000090d: MLOAD 0000090e: DUP1 0000090f: DUP4 00000910: SUB 00000911: SWAP1 00000912: SWAP2 00000913: ADD 00000914: DUP2 00000915: MSTORE 00000916: PUSH1 0x64 00000918: SWAP1 00000919: SWAP2 0000091a: ADD 0000091b: DUP3 0000091c: MSTORE 0000091d: PUSH1 0x20 0000091f: DUP1 00000920: DUP3 00000921: ADD 00000922: DUP1 00000923: MLOAD 00000924: PUSH1 0x01 00000926: PUSH1 0x01 00000928: PUSH1 0xe0 0000092a: SHL 0000092b: SUB 0000092c: AND 0000092d: PUSH4 0x095ea7b3 00000932: PUSH1 0xe0 00000934: SHL 00000935: OR 00000936: SWAP1 00000937: MSTORE 00000938: DUP3 00000939: MLOAD 0000093a: SWAP1 0000093b: DUP2 0000093c: ADD 0000093d: SWAP1 0000093e: SWAP3 0000093f: MSTORE 00000940: PUSH1 0x00 00000942: DUP1 00000943: DUP4 00000944: MSTORE 00000945: PUSH2 0x0516 00000948: SWAP3 00000949: DUP7 0000094a: SWAP3 0000094b: SWAP2 0000094c: SWAP1 0000094d: PUSH2 0x0959 00000950: SWAP1 00000951: DUP5 00000952: SWAP1 00000953: DUP5 00000954: SWAP1 00000955: PUSH2 0x0980 00000958: JUMP 00000959: JUMPDEST 0000095a: DUP1 0000095b: MLOAD 0000095c: SWAP1 0000095d: SWAP2 0000095e: POP 0000095f: ISZERO 00000960: PUSH2 0x0516 00000963: JUMPI 00000964: DUP1 00000965: DUP1 00000966: PUSH1 0x20 00000968: ADD 00000969: SWAP1 0000096a: MLOAD 0000096b: DUP2 0000096c: ADD 0000096d: SWAP1 0000096e: PUSH2 0x0977 00000971: SWAP2 00000972: SWAP1 00000973: PUSH2 0x0c7c 00000976: JUMP 00000977: JUMPDEST 00000978: PUSH2 0x0516 0000097b: JUMPI 0000097c: PUSH1 0x00 0000097e: DUP1 0000097f: REVERT 00000980: JUMPDEST 00000981: PUSH1 0x60 00000983: PUSH2 0x098f 00000986: DUP5 00000987: DUP5 00000988: PUSH1 0x00 0000098a: DUP6 0000098b: PUSH2 0x0997 0000098e: JUMP 0000098f: JUMPDEST 00000990: SWAP5 00000991: SWAP4 00000992: POP 00000993: POP 00000994: POP 00000995: POP 00000996: JUMP 00000997: JUMPDEST 00000998: PUSH1 0x60 0000099a: DUP3 0000099b: SELFBALANCE 0000099c: LT 0000099d: ISZERO 0000099e: PUSH2 0x09a6 000009a1: JUMPI 000009a2: PUSH1 0x00 000009a4: DUP1 000009a5: REVERT 000009a6: JUMPDEST 000009a7: DUP5 000009a8: EXTCODESIZE 000009a9: PUSH2 0x09b1 000009ac: JUMPI 000009ad: PUSH1 0x00 000009af: DUP1 000009b0: REVERT 000009b1: JUMPDEST 000009b2: PUSH1 0x00 000009b4: DUP1 000009b5: DUP7 000009b6: PUSH1 0x01 000009b8: PUSH1 0x01 000009ba: PUSH1 0xa0 000009bc: SHL 000009bd: SUB 000009be: AND 000009bf: DUP6 000009c0: DUP8 000009c1: PUSH1 0x40 000009c3: MLOAD 000009c4: PUSH2 0x09cd 000009c7: SWAP2 000009c8: SWAP1 000009c9: PUSH2 0x0cc7 000009cc: JUMP 000009cd: JUMPDEST 000009ce: PUSH1 0x00 000009d0: PUSH1 0x40 000009d2: MLOAD 000009d3: DUP1 000009d4: DUP4 000009d5: SUB 000009d6: DUP2 000009d7: DUP6 000009d8: DUP8 000009d9: GAS 000009da: CALL 000009db: SWAP3 000009dc: POP 000009dd: POP 000009de: POP 000009df: RETURNDATASIZE 000009e0: DUP1 000009e1: PUSH1 0x00 000009e3: DUP2 000009e4: EQ 000009e5: PUSH2 0x0a0a 000009e8: JUMPI 000009e9: PUSH1 0x40 000009eb: MLOAD 000009ec: SWAP2 000009ed: POP 000009ee: PUSH1 0x1f 000009f0: NOT 000009f1: PUSH1 0x3f 000009f3: RETURNDATASIZE 000009f4: ADD 000009f5: AND 000009f6: DUP3 000009f7: ADD 000009f8: PUSH1 0x40 000009fa: MSTORE 000009fb: RETURNDATASIZE 000009fc: DUP3 000009fd: MSTORE 000009fe: RETURNDATASIZE 000009ff: PUSH1 0x00 00000a01: PUSH1 0x20 00000a03: DUP5 00000a04: ADD 00000a05: RETURNDATACOPY 00000a06: PUSH2 0x0a0f 00000a09: JUMP 00000a0a: JUMPDEST 00000a0b: PUSH1 0x60 00000a0d: SWAP2 00000a0e: POP 00000a0f: JUMPDEST 00000a10: POP 00000a11: SWAP2 00000a12: POP 00000a13: SWAP2 00000a14: POP 00000a15: PUSH2 0x0a1f 00000a18: DUP3 00000a19: DUP3 00000a1a: DUP7 00000a1b: PUSH2 0x0a2a 00000a1e: JUMP 00000a1f: JUMPDEST 00000a20: SWAP8 00000a21: SWAP7 00000a22: POP 00000a23: POP 00000a24: POP 00000a25: POP 00000a26: POP 00000a27: POP 00000a28: POP 00000a29: JUMP 00000a2a: JUMPDEST 00000a2b: PUSH1 0x60 00000a2d: DUP4 00000a2e: PUSH2 0x0a5b 00000a31: JUMPI 00000a32: DUP3 00000a33: MLOAD 00000a34: ISZERO 00000a35: PUSH2 0x0a41 00000a38: JUMPI 00000a39: DUP3 00000a3a: MLOAD 00000a3b: DUP1 00000a3c: DUP5 00000a3d: PUSH1 0x20 00000a3f: ADD 00000a40: REVERT 00000a41: JUMPDEST 00000a42: DUP2 00000a43: PUSH1 0x40 00000a45: MLOAD 00000a46: PUSH3 0x461bcd 00000a4a: PUSH1 0xe5 00000a4c: SHL 00000a4d: DUP2 00000a4e: MSTORE 00000a4f: PUSH1 0x04 00000a51: ADD 00000a52: PUSH2 0x0150 00000a55: SWAP2 00000a56: SWAP1 00000a57: PUSH2 0x0ce3 00000a5a: JUMP 00000a5b: JUMPDEST 00000a5c: POP 00000a5d: SWAP1 00000a5e: SWAP3 00000a5f: SWAP2 00000a60: POP 00000a61: POP 00000a62: JUMP 00000a63: JUMPDEST 00000a64: DUP1 00000a65: CALLDATALOAD 00000a66: PUSH1 0x01 00000a68: PUSH1 0x01 00000a6a: PUSH1 0xa0 00000a6c: SHL 00000a6d: SUB 00000a6e: DUP2 00000a6f: AND 00000a70: DUP2 00000a71: EQ 00000a72: PUSH2 0x0a7a 00000a75: JUMPI 00000a76: PUSH1 0x00 00000a78: DUP1 00000a79: REVERT 00000a7a: JUMPDEST 00000a7b: SWAP2 00000a7c: SWAP1 00000a7d: POP 00000a7e: JUMP 00000a7f: JUMPDEST 00000a80: PUSH1 0x00 00000a82: PUSH1 0x20 00000a84: DUP3 00000a85: DUP5 00000a86: SUB 00000a87: SLT 00000a88: ISZERO 00000a89: PUSH2 0x0a91 00000a8c: JUMPI 00000a8d: PUSH1 0x00 00000a8f: DUP1 00000a90: REVERT 00000a91: JUMPDEST 00000a92: PUSH2 0x0a9a 00000a95: DUP3 00000a96: PUSH2 0x0a63 00000a99: JUMP 00000a9a: JUMPDEST 00000a9b: SWAP4 00000a9c: SWAP3 00000a9d: POP 00000a9e: POP 00000a9f: POP 00000aa0: JUMP 00000aa1: JUMPDEST 00000aa2: PUSH1 0x00 00000aa4: DUP1 00000aa5: PUSH1 0x00 00000aa7: PUSH1 0x60 00000aa9: DUP5 00000aaa: DUP7 00000aab: SUB 00000aac: SLT 00000aad: ISZERO 00000aae: PUSH2 0x0ab6 00000ab1: JUMPI 00000ab2: PUSH1 0x00 00000ab4: DUP1 00000ab5: REVERT 00000ab6: JUMPDEST 00000ab7: PUSH2 0x0abf 00000aba: DUP5 00000abb: PUSH2 0x0a63 00000abe: JUMP 00000abf: JUMPDEST 00000ac0: SWAP3 00000ac1: POP 00000ac2: PUSH2 0x0acd 00000ac5: PUSH1 0x20 00000ac7: DUP6 00000ac8: ADD 00000ac9: PUSH2 0x0a63 00000acc: JUMP 00000acd: JUMPDEST 00000ace: SWAP2 00000acf: POP 00000ad0: PUSH1 0x40 00000ad2: DUP5 00000ad3: ADD 00000ad4: CALLDATALOAD 00000ad5: SWAP1 00000ad6: POP 00000ad7: SWAP3 00000ad8: POP 00000ad9: SWAP3 00000ada: POP 00000adb: SWAP3 00000adc: JUMP 00000add: JUMPDEST 00000ade: PUSH1 0x00 00000ae0: DUP1 00000ae1: PUSH1 0x40 00000ae3: DUP4 00000ae4: DUP6 00000ae5: SUB 00000ae6: SLT 00000ae7: ISZERO 00000ae8: PUSH2 0x0af0 00000aeb: JUMPI 00000aec: PUSH1 0x00 00000aee: DUP1 00000aef: REVERT 00000af0: JUMPDEST 00000af1: PUSH2 0x0af9 00000af4: DUP4 00000af5: PUSH2 0x0a63 00000af8: JUMP 00000af9: JUMPDEST 00000afa: SWAP5 00000afb: PUSH1 0x20 00000afd: SWAP4 00000afe: SWAP1 00000aff: SWAP4 00000b00: ADD 00000b01: CALLDATALOAD 00000b02: SWAP4 00000b03: POP 00000b04: POP 00000b05: POP 00000b06: JUMP 00000b07: JUMPDEST 00000b08: PUSH1 0x00 00000b0a: PUSH1 0x20 00000b0c: DUP1 00000b0d: DUP4 00000b0e: DUP6 00000b0f: SUB 00000b10: SLT 00000b11: ISZERO 00000b12: PUSH2 0x0b1a 00000b15: JUMPI 00000b16: PUSH1 0x00 00000b18: DUP1 00000b19: REVERT 00000b1a: JUMPDEST 00000b1b: DUP3 00000b1c: CALLDATALOAD 00000b1d: PUSH8 0xffffffffffffffff 00000b26: DUP2 00000b27: GT 00000b28: ISZERO 00000b29: PUSH2 0x0b31 00000b2c: JUMPI 00000b2d: PUSH1 0x00 00000b2f: DUP1 00000b30: REVERT 00000b31: JUMPDEST 00000b32: DUP4 00000b33: ADD 00000b34: PUSH1 0x1f 00000b36: DUP2 00000b37: ADD 00000b38: DUP6 00000b39: SGT 00000b3a: PUSH2 0x0b42 00000b3d: JUMPI 00000b3e: PUSH1 0x00 00000b40: DUP1 00000b41: REVERT 00000b42: JUMPDEST 00000b43: DUP1 00000b44: CALLDATALOAD 00000b45: PUSH2 0x0b55 00000b48: PUSH2 0x0b50 00000b4b: DUP3 00000b4c: PUSH2 0x0d94 00000b4f: JUMP 00000b50: JUMPDEST 00000b51: PUSH2 0x0d63 00000b54: JUMP 00000b55: JUMPDEST 00000b56: DUP1 00000b57: DUP3 00000b58: DUP3 00000b59: MSTORE 00000b5a: DUP5 00000b5b: DUP3 00000b5c: ADD 00000b5d: SWAP2 00000b5e: POP 00000b5f: DUP5 00000b60: DUP5 00000b61: ADD 00000b62: DUP9 00000b63: DUP7 00000b64: DUP6 00000b65: PUSH1 0x05 00000b67: SHL 00000b68: DUP8 00000b69: ADD 00000b6a: ADD 00000b6b: GT 00000b6c: ISZERO 00000b6d: PUSH2 0x0b75 00000b70: JUMPI 00000b71: PUSH1 0x00 00000b73: DUP1 00000b74: REVERT 00000b75: JUMPDEST 00000b76: PUSH1 0x00 00000b78: SWAP5 00000b79: POP 00000b7a: JUMPDEST 00000b7b: DUP4 00000b7c: DUP6 00000b7d: LT 00000b7e: ISZERO 00000b7f: PUSH2 0x0b9f 00000b82: JUMPI 00000b83: PUSH2 0x0b8b 00000b86: DUP2 00000b87: PUSH2 0x0a63 00000b8a: JUMP 00000b8b: JUMPDEST 00000b8c: DUP4 00000b8d: MSTORE 00000b8e: PUSH1 0x01 00000b90: SWAP5 00000b91: SWAP1 00000b92: SWAP5 00000b93: ADD 00000b94: SWAP4 00000b95: SWAP2 00000b96: DUP6 00000b97: ADD 00000b98: SWAP2 00000b99: DUP6 00000b9a: ADD 00000b9b: PUSH2 0x0b7a 00000b9e: JUMP 00000b9f: JUMPDEST 00000ba0: POP 00000ba1: SWAP8 00000ba2: SWAP7 00000ba3: POP 00000ba4: POP 00000ba5: POP 00000ba6: POP 00000ba7: POP 00000ba8: POP 00000ba9: POP 00000baa: JUMP 00000bab: JUMPDEST 00000bac: PUSH1 0x00 00000bae: PUSH1 0x20 00000bb0: DUP1 00000bb1: DUP4 00000bb2: DUP6 00000bb3: SUB 00000bb4: SLT 00000bb5: ISZERO 00000bb6: PUSH2 0x0bbe 00000bb9: JUMPI 00000bba: PUSH1 0x00 00000bbc: DUP1 00000bbd: REVERT 00000bbe: JUMPDEST 00000bbf: DUP3 00000bc0: CALLDATALOAD 00000bc1: PUSH8 0xffffffffffffffff 00000bca: DUP2 00000bcb: GT 00000bcc: ISZERO 00000bcd: PUSH2 0x0bd5 00000bd0: JUMPI 00000bd1: PUSH1 0x00 00000bd3: DUP1 00000bd4: REVERT 00000bd5: JUMPDEST 00000bd6: DUP4 00000bd7: ADD 00000bd8: PUSH1 0x1f 00000bda: DUP2 00000bdb: ADD 00000bdc: DUP6 00000bdd: SGT 00000bde: PUSH2 0x0be6 00000be1: JUMPI 00000be2: PUSH1 0x00 00000be4: DUP1 00000be5: REVERT 00000be6: JUMPDEST 00000be7: DUP1 00000be8: CALLDATALOAD 00000be9: PUSH2 0x0bf4 00000bec: PUSH2 0x0b50 00000bef: DUP3 00000bf0: PUSH2 0x0d94 00000bf3: JUMP 00000bf4: JUMPDEST 00000bf5: DUP2 00000bf6: DUP2 00000bf7: MSTORE 00000bf8: DUP4 00000bf9: DUP2 00000bfa: ADD 00000bfb: SWAP1 00000bfc: DUP4 00000bfd: DUP6 00000bfe: ADD 00000bff: PUSH1 0x60 00000c01: DUP1 00000c02: DUP6 00000c03: MUL 00000c04: DUP7 00000c05: ADD 00000c06: DUP8 00000c07: ADD 00000c08: DUP11 00000c09: LT 00000c0a: ISZERO 00000c0b: PUSH2 0x0c13 00000c0e: JUMPI 00000c0f: PUSH1 0x00 00000c11: DUP1 00000c12: REVERT 00000c13: JUMPDEST 00000c14: PUSH1 0x00 00000c16: SWAP6 00000c17: POP 00000c18: DUP6 00000c19: JUMPDEST 00000c1a: DUP6 00000c1b: DUP2 00000c1c: LT 00000c1d: ISZERO 00000c1e: PUSH2 0x0c6d 00000c21: JUMPI 00000c22: DUP2 00000c23: DUP4 00000c24: DUP13 00000c25: SUB 00000c26: SLT 00000c27: ISZERO 00000c28: PUSH2 0x0c2f 00000c2b: JUMPI 00000c2c: DUP7 00000c2d: DUP8 00000c2e: REVERT 00000c2f: JUMPDEST 00000c30: PUSH2 0x0c37 00000c33: PUSH2 0x0d3a 00000c36: JUMP 00000c37: JUMPDEST 00000c38: PUSH2 0x0c40 00000c3b: DUP5 00000c3c: PUSH2 0x0a63 00000c3f: JUMP 00000c40: JUMPDEST 00000c41: DUP2 00000c42: MSTORE 00000c43: PUSH2 0x0c4d 00000c46: DUP10 00000c47: DUP6 00000c48: ADD 00000c49: PUSH2 0x0a63 00000c4c: JUMP 00000c4d: JUMPDEST 00000c4e: DUP2 00000c4f: DUP11 00000c50: ADD 00000c51: MSTORE 00000c52: PUSH1 0x40 00000c54: DUP5 00000c55: DUP2 00000c56: ADD 00000c57: CALLDATALOAD 00000c58: SWAP1 00000c59: DUP3 00000c5a: ADD 00000c5b: MSTORE 00000c5c: DUP6 00000c5d: MSTORE 00000c5e: SWAP4 00000c5f: DUP8 00000c60: ADD 00000c61: SWAP4 00000c62: SWAP2 00000c63: DUP2 00000c64: ADD 00000c65: SWAP2 00000c66: PUSH1 0x01 00000c68: ADD 00000c69: PUSH2 0x0c19 00000c6c: JUMP 00000c6d: JUMPDEST 00000c6e: POP 00000c6f: SWAP2 00000c70: SWAP10 00000c71: SWAP9 00000c72: POP 00000c73: POP 00000c74: POP 00000c75: POP 00000c76: POP 00000c77: POP 00000c78: POP 00000c79: POP 00000c7a: POP 00000c7b: JUMP 00000c7c: JUMPDEST 00000c7d: PUSH1 0x00 00000c7f: PUSH1 0x20 00000c81: DUP3 00000c82: DUP5 00000c83: SUB 00000c84: SLT 00000c85: ISZERO 00000c86: PUSH2 0x0c8e 00000c89: JUMPI 00000c8a: PUSH1 0x00 00000c8c: DUP1 00000c8d: REVERT 00000c8e: JUMPDEST 00000c8f: DUP2 00000c90: MLOAD 00000c91: DUP1 00000c92: ISZERO 00000c93: ISZERO 00000c94: DUP2 00000c95: EQ 00000c96: PUSH2 0x0a9a 00000c99: JUMPI 00000c9a: PUSH1 0x00 00000c9c: DUP1 00000c9d: REVERT 00000c9e: JUMPDEST 00000c9f: PUSH1 0x00 00000ca1: PUSH1 0x20 00000ca3: DUP3 00000ca4: DUP5 00000ca5: SUB 00000ca6: SLT 00000ca7: ISZERO 00000ca8: PUSH2 0x0cb0 00000cab: JUMPI 00000cac: PUSH1 0x00 00000cae: DUP1 00000caf: REVERT 00000cb0: JUMPDEST 00000cb1: POP 00000cb2: CALLDATALOAD 00000cb3: SWAP2 00000cb4: SWAP1 00000cb5: POP 00000cb6: JUMP 00000cb7: JUMPDEST 00000cb8: DUP2 00000cb9: DUP4 00000cba: DUP3 00000cbb: CALLDATACOPY 00000cbc: PUSH1 0x00 00000cbe: SWAP2 00000cbf: ADD 00000cc0: SWAP1 00000cc1: DUP2 00000cc2: MSTORE 00000cc3: SWAP2 00000cc4: SWAP1 00000cc5: POP 00000cc6: JUMP 00000cc7: JUMPDEST 00000cc8: PUSH1 0x00 00000cca: DUP3 00000ccb: MLOAD 00000ccc: PUSH2 0x0cd9 00000ccf: DUP2 00000cd0: DUP5 00000cd1: PUSH1 0x20 00000cd3: DUP8 00000cd4: ADD 00000cd5: PUSH2 0x0db8 00000cd8: JUMP 00000cd9: JUMPDEST 00000cda: SWAP2 00000cdb: SWAP1 00000cdc: SWAP2 00000cdd: ADD 00000cde: SWAP3 00000cdf: SWAP2 00000ce0: POP 00000ce1: POP 00000ce2: JUMP 00000ce3: JUMPDEST 00000ce4: PUSH1 0x20 00000ce6: DUP2 00000ce7: MSTORE 00000ce8: PUSH1 0x00 00000cea: DUP3 00000ceb: MLOAD 00000cec: DUP1 00000ced: PUSH1 0x20 00000cef: DUP5 00000cf0: ADD 00000cf1: MSTORE 00000cf2: PUSH2 0x0d02 00000cf5: DUP2 00000cf6: PUSH1 0x40 00000cf8: DUP6 00000cf9: ADD 00000cfa: PUSH1 0x20 00000cfc: DUP8 00000cfd: ADD 00000cfe: PUSH2 0x0db8 00000d01: JUMP 00000d02: JUMPDEST 00000d03: PUSH1 0x1f 00000d05: ADD 00000d06: PUSH1 0x1f 00000d08: NOT 00000d09: AND 00000d0a: SWAP2 00000d0b: SWAP1 00000d0c: SWAP2 00000d0d: ADD 00000d0e: PUSH1 0x40 00000d10: ADD 00000d11: SWAP3 00000d12: SWAP2 00000d13: POP 00000d14: POP 00000d15: JUMP 00000d16: JUMPDEST 00000d17: PUSH1 0x20 00000d19: DUP1 00000d1a: DUP3 00000d1b: MSTORE 00000d1c: PUSH1 0x0a 00000d1e: SWAP1 00000d1f: DUP3 00000d20: ADD 00000d21: MSTORE 00000d22: PUSH10 0x2337b93134b23232b717 00000d2d: PUSH1 0xb1 00000d2f: SHL 00000d30: PUSH1 0x40 00000d32: DUP3 00000d33: ADD 00000d34: MSTORE 00000d35: PUSH1 0x60 00000d37: ADD 00000d38: SWAP1 00000d39: JUMP 00000d3a: JUMPDEST 00000d3b: PUSH1 0x40 00000d3d: MLOAD 00000d3e: PUSH1 0x60 00000d40: DUP2 00000d41: ADD 00000d42: PUSH8 0xffffffffffffffff 00000d4b: DUP2 00000d4c: GT 00000d4d: DUP3 00000d4e: DUP3 00000d4f: LT 00000d50: OR 00000d51: ISZERO 00000d52: PUSH2 0x0d5d 00000d55: JUMPI 00000d56: PUSH2 0x0d5d 00000d59: PUSH2 0x0e23 00000d5c: JUMP 00000d5d: JUMPDEST 00000d5e: PUSH1 0x40 00000d60: MSTORE 00000d61: SWAP1 00000d62: JUMP 00000d63: JUMPDEST 00000d64: PUSH1 0x40 00000d66: MLOAD 00000d67: PUSH1 0x1f 00000d69: DUP3 00000d6a: ADD 00000d6b: PUSH1 0x1f 00000d6d: NOT 00000d6e: AND 00000d6f: DUP2 00000d70: ADD 00000d71: PUSH8 0xffffffffffffffff 00000d7a: DUP2 00000d7b: GT 00000d7c: DUP3 00000d7d: DUP3 00000d7e: LT 00000d7f: OR 00000d80: ISZERO 00000d81: PUSH2 0x0d8c 00000d84: JUMPI 00000d85: PUSH2 0x0d8c 00000d88: PUSH2 0x0e23 00000d8b: JUMP 00000d8c: JUMPDEST 00000d8d: PUSH1 0x40 00000d8f: MSTORE 00000d90: SWAP2 00000d91: SWAP1 00000d92: POP 00000d93: JUMP 00000d94: JUMPDEST 00000d95: PUSH1 0x00 00000d97: PUSH8 0xffffffffffffffff 00000da0: DUP3 00000da1: GT 00000da2: ISZERO 00000da3: PUSH2 0x0dae 00000da6: JUMPI 00000da7: PUSH2 0x0dae 00000daa: PUSH2 0x0e23 00000dad: JUMP 00000dae: JUMPDEST 00000daf: POP 00000db0: PUSH1 0x05 00000db2: SHL 00000db3: PUSH1 0x20 00000db5: ADD 00000db6: SWAP1 00000db7: JUMP 00000db8: JUMPDEST 00000db9: PUSH1 0x00 00000dbb: JUMPDEST 00000dbc: DUP4 00000dbd: DUP2 00000dbe: LT 00000dbf: ISZERO 00000dc0: PUSH2 0x0dd3 00000dc3: JUMPI 00000dc4: DUP2 00000dc5: DUP2 00000dc6: ADD 00000dc7: MLOAD 00000dc8: DUP4 00000dc9: DUP3 00000dca: ADD 00000dcb: MSTORE 00000dcc: PUSH1 0x20 00000dce: ADD 00000dcf: PUSH2 0x0dbb 00000dd2: JUMP 00000dd3: JUMPDEST 00000dd4: DUP4 00000dd5: DUP2 00000dd6: GT 00000dd7: ISZERO 00000dd8: PUSH2 0x0652 00000ddb: JUMPI 00000ddc: POP 00000ddd: POP 00000dde: PUSH1 0x00 00000de0: SWAP2 00000de1: ADD 00000de2: MSTORE 00000de3: JUMP 00000de4: JUMPDEST 00000de5: PUSH1 0x00 00000de7: PUSH1 0x00 00000de9: NOT 00000dea: DUP3 00000deb: EQ 00000dec: ISZERO 00000ded: PUSH2 0x0e06 00000df0: JUMPI 00000df1: PUSH4 0x4e487b71 00000df6: PUSH1 0xe0 00000df8: SHL 00000df9: PUSH1 0x00 00000dfb: MSTORE 00000dfc: PUSH1 0x11 00000dfe: PUSH1 0x04 00000e00: MSTORE 00000e01: PUSH1 0x24 00000e03: PUSH1 0x00 00000e05: REVERT 00000e06: JUMPDEST 00000e07: POP 00000e08: PUSH1 0x01 00000e0a: ADD 00000e0b: SWAP1 00000e0c: JUMP 00000e0d: JUMPDEST 00000e0e: PUSH4 0x4e487b71 00000e13: PUSH1 0xe0 00000e15: SHL 00000e16: PUSH1 0x00 00000e18: MSTORE 00000e19: PUSH1 0x32 00000e1b: PUSH1 0x04 00000e1d: MSTORE 00000e1e: PUSH1 0x24 00000e20: PUSH1 0x00 00000e22: REVERT 00000e23: JUMPDEST 00000e24: PUSH4 0x4e487b71 00000e29: PUSH1 0xe0 00000e2b: SHL 00000e2c: PUSH1 0x00 00000e2e: MSTORE 00000e2f: PUSH1 0x41 00000e31: PUSH1 0x04 00000e33: MSTORE 00000e34: PUSH1 0x24 00000e36: PUSH1 0x00 00000e38: REVERT 00000e39: INVALID 00000e3a: LOG2 00000e3b: PUSH5 0x6970667358 00000e41: UNKNOWN(0x22) 00000e42: SLT 00000e43: KECCAK256 00000e44: UNKNOWN(0xC2) 00000e45: PUSH20 0x9b4fb04b72b8e4f8607b9ba0e9cd622024f8bc73 00000e5a: UNKNOWN(0xD5) 00000e5b: UNKNOWN(0xAE) 00000e5c: LOG4 00000e5d: PUSH25
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | upgradeability | detector | Untrusted DELEGATECALL target reachable | 70 | no | no |
viewtrace_id: 0x3325434cb15a794ec465fa30e9092dd0edad7648a57cca55b385f38ad1d15646
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "unknown",
"attempts": 168,
"trace_id": "0x3325434cb15a794ec465fa30e9092dd0edad7648a57cca55b385f38ad1d15646",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": null,
"matched_probe": null,
"target_varies": null,
"classification": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xaa2d4a29",
"selector": "0xaa2d4a29",
"calldata_variants": [
"0xaa2d4a29",
"0xaa2d4a290000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd89da49c",
"selector": "0xd89da49c",
"calldata_variants": [
"0xd89da49c",
"0xd89da49c0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xeded6191",
"selector": "0xeded6191",
"calldata_variants": [
"0xeded6191",
"0xeded61910000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xefbb98c2",
"selector": "0xefbb98c2",
"calldata_variants": [
"0xefbb98c2",
"0xefbb98c20000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x802a81d8",
"selector": "0x802a81d8",
"calldata_variants": [
"0x802a81d8",
"0x802a81d80000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x810d6ce5",
"selector": "0x810d6ce5",
"calldata_variants": [
"0x810d6ce5",
"0x810d6ce50000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xa4358917",
"selector": "0xa4358917",
"calldata_variants": [
"0xa4358917",
"0xa43589170000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x1fceed7f",
"selector": "0x1fceed7f",
"calldata_variants": [
"0x1fceed7f",
"0x1fceed7f0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 393,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [],
"delegatecall_count": 1,
"untrusted_delegatecall_count": 1
}
|
| high | upgradeability | codex | Computed DELEGATECALL target allows potential arbitrary code execution | 85 | no | — |
viewevidence_json{
"evidence": "Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.",
"locations": [
"pc:0x189"
],
"recommendation": "Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.",
"exploit_scenario": "If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract\u2019s context, draining funds or overwriting state."
}
|
| high | other | detector | Untrusted CALL target/value reachable | 60 | no | no |
viewtrace_id: 0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be
call_targets:
0x942a70014b6ba71ec84b16e1604fc76b1071eaf9
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x942a70014b6ba71ec84b16e1604fc76b1071eaf9"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xaa2d4a29",
"selector": "0xaa2d4a29",
"calldata_variants": [
"0xaa2d4a29",
"0xaa2d4a290000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd89da49c",
"selector": "0xd89da49c",
"calldata_variants": [
"0xd89da49c",
"0xd89da49c0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xeded6191",
"selector": "0xeded6191",
"calldata_variants": [
"0xeded6191",
"0xeded61910000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xefbb98c2",
"selector": "0xefbb98c2",
"calldata_variants": [
"0xefbb98c2",
"0xefbb98c20000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x802a81d8",
"selector": "0x802a81d8",
"calldata_variants": [
"0x802a81d8",
"0x802a81d80000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x810d6ce5",
"selector": "0x810d6ce5",
"calldata_variants": [
"0x810d6ce5",
"0x810d6ce50000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xa4358917",
"selector": "0xa4358917",
"calldata_variants": [
"0xa4358917",
"0xa43589170000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x1fceed7f",
"selector": "0x1fceed7f",
"calldata_variants": [
"0x1fceed7f",
"0x1fceed7f0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1420,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1565,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1771,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 5,
"guards_detected": [],
"untrusted_call_count": 5
}
|
| high | other | detector | ETH value transfer possible | 55 | no | no |
viewtrace_id: 0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be
call_targets:
0x942a70014b6ba71ec84b16e1604fc76b1071eaf9
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x942a70014b6ba71ec84b16e1604fc76b1071eaf9"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xaa2d4a29",
"selector": "0xaa2d4a29",
"calldata_variants": [
"0xaa2d4a29",
"0xaa2d4a290000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd89da49c",
"selector": "0xd89da49c",
"calldata_variants": [
"0xd89da49c",
"0xd89da49c0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xeded6191",
"selector": "0xeded6191",
"calldata_variants": [
"0xeded6191",
"0xeded61910000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xefbb98c2",
"selector": "0xefbb98c2",
"calldata_variants": [
"0xefbb98c2",
"0xefbb98c20000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x802a81d8",
"selector": "0x802a81d8",
"calldata_variants": [
"0x802a81d8",
"0x802a81d80000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x810d6ce5",
"selector": "0x810d6ce5",
"calldata_variants": [
"0x810d6ce5",
"0x810d6ce50000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xa4358917",
"selector": "0xa4358917",
"calldata_variants": [
"0xa4358917",
"0xa43589170000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x1fceed7f",
"selector": "0x1fceed7f",
"calldata_variants": [
"0x1fceed7f",
"0x1fceed7f0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1420,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1565,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1771,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 5,
"guards_detected": []
}
|
| medium | access_control | codex | Potential arbitrary external CALLs with value to computed targets | 75 | no | — |
viewevidence_json{
"evidence": "Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.",
"locations": [
"pc:0x58c",
"pc:0x61d",
"pc:0x6eb",
"pc:0x8d6",
"pc:0x9da"
],
"recommendation": "Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.",
"exploit_scenario": "If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract\u2019s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets."
}
|
| medium | upgradeability | cast | DELEGATECALL present | 80 | no | — |
viewevidence_json{
"notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
"delegatecall_count": 1
}
|