TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

019ba9bc-ec3c-738f-9671-9046fad6b6a8

complete
Chain ID
1
Address
Block Number
Created
Sat, Jan 10, 2026 9:08 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

Confirmed
0
Validated
0
Source
Bytecode only
Review Backing
Present
Best current signal
Untrusted DELEGATECALL target reachable
crit 0 high 0 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
37727 artifact.fetch complete 1 / 3 3 months ago
37728 proxy.resolve complete 1 / 3 3 months ago
37729 tool.cast_disasm complete 1 / 3 3 months ago
37730 analysis.bundle complete 1 / 3 3 months ago
37731 capability.graph complete 1 / 3 3 months ago
37732 detector.run complete 1 / 3 3 months ago
37733 validation.fork complete 1 / 3 3 months ago
37896 report.consolidate complete 1 / 6 3 months ago

Artifact

Runtime bytecode: available
Creation TX:
Deployer:
Proxy: no not_proxy
Implementation:
Verified Source: no
Proxy evidence
{
    "status": "not_proxy"
}

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate
Job Status
complete
Attempts
1 / 6
Findings
2
No findings?
no
Summary
Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.
View stdout
{"no_findings":false,"summary":"Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.","findings":[{"severity":"high","category":"upgradeability","title":"Computed DELEGATECALL target allows potential arbitrary code execution","exploit_scenario":"If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract’s context, draining funds or overwriting state.","recommendation":"Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.","evidence":"Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.","locations":["pc:0x189"]},{"severity":"medium","category":"access_control","title":"Potential arbitrary external CALLs with value to computed targets","exploit_scenario":"If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract’s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets.","recommendation":"Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.","evidence":"Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.","locations":["pc:0x58c","pc:0x61d","pc:0x6eb","pc:0x8d6","pc:0x9da"]}]}
View stderr
OpenAI Codex v0.77.0 (research preview)
--------
workdir: /tmp/codex-cyh1pt69
model: gpt-5.2-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: xhigh
reasoning summaries: auto
session id: 019ba9c8-1764-74b0-8b9a-508c0b5dfd25
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.

Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".

Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
mcp startup: no servers

thinking
**Preparing to read BYTECODE_BUNDLE.json**
exec
/bin/bash -lc ls in /tmp/codex-cyh1pt69 succeeded in 6ms:
BYTECODE_BUNDLE.json
codex-output-schema.json
exec
/bin/bash -lc 'cat BYTECODE_BUNDLE.json' in /tmp/codex-cyh1pt69 succeeded in 9ms:
{
  "analysis_artifact": {
    "address": "0x942a70014b6ba71ec84b16e1604fc76b1071eaf9",
    "artifact_hash": "0x5c72b42571ea3606584e33f283dd108a03ee6cb4485af2708ee3061f42555867",
    "artifact_json": {
      "auth": {
        "guards": []
      },
      "basic_blocks": [
        {
          "end_pc": 12,
          "hash": "0xf22705069d58de5e475a0ae499d9c45bc7477c202e97427801be5e53f1d1ac9b",
          "opcodes": [
            "PUSH1",
            "PUSH1",
            "MSTORE",
            "PUSH1",
            "CALLDATASIZE",
            "LT",
            "PUSH2",

thinking
**Preparing to parse bytecode data**
exec
/bin/bash -lc 'rg -n "storage|slot|evidence|selector|proxy|1967|beacon|callsite|delegatecall|upgrade" BYTECODE_BUNDLE.json' in /tmp/codex-cyh1pt69 succeeded in 16ms:
4483:      "callsites": [
5995:      "dispatcher_type": "selector_jump_table",
5999:          "selector": "0xaa2d4a29"
6003:          "selector": "0xd89da49c"
6007:          "selector": "0xeded6191"
6011:          "selector": "0xefbb98c2"
6015:          "selector": "0x802a81d8"
6019:          "selector": "0x810d6ce5"
6023:          "selector": "0xa4358917"
6027:          "selector": "0x1fceed7f"
6031:          "selector": "0x234ecf06"
6035:          "selector": "0x5a703223"
6039:          "selector": "0x5f850252"
6043:          "selector": "0x0ae50a39"
6047:          "selector": "0x12038e5d"
6051:          "selector": "0x167d3e9c"
6060:          "selector": "0xaa2d4a29",
6063:            "delegatecall": 1,
6067:          "storage": {
6069:            "slots": [

thinking
**Gathering callsite and evidence data**
exec
/bin/bash -lc "python - <<'PY'
import json
import textwrap
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

print('keys', data.keys())
print('heuristics_summary', data.get('heuristics_summary'))
print('is_proxy', data.get('is_proxy'))
print('proxy_evidence', data.get('proxy_evidence'))
print('detector_findings count', len(data.get('detector_findings', [])))
for i,fd in enumerate(data.get('detector_findings', []),1):
    print('\\nFinding', i, fd.get('title'), 'severity', fd.get('severity'), 'confidence', fd.get('confidence'))
    print(' evidence_json', fd.get('evidence_json'))
    print(' normalized', fd.get('normalized_json'))
    print(' validation', fd.get('validation_json'))

# show callsites
callsites = data.get('analysis_artifact',{}).get('artifact_json',{}).get('callsites',[])
print('\\ncallsites', callsites[:10], 'total', len(callsites))

# dump selectors list if present
selectors = data.get('analysis_artifact',{}).get('artifact_json',{}).get('selectors')
print('\\nselectors', selectors)

# show dispatcher_type
print('dispatcher_type', data.get('analysis_artifact',{}).get('artifact_json',{}).get('dispatcher_type'))

# print function selectors list (if in artifact_json)
functions = [f for f in data.get('analysis_artifact',{}).get('artifact_json',{}).get('function_selectors',[])]
if functions:
    print('function_selectors', functions)

PY" in /tmp/codex-cyh1pt69 succeeded in 30ms:
keys dict_keys(['analysis_artifact', 'analysis_run', 'artifact', 'capability_graph', 'detector_findings', 'heuristics_summary'])
heuristics_summary {'create2_count': 0, 'delegatecall_count': 1, 'flags': ['delegatecall_present'], 'selfdestruct_count': 0}
is_proxy None
proxy_evidence None
detector_findings count 3

Finding 1 Untrusted DELEGATECALL target reachable severity critical confidence 70
 evidence_json {'delegatecall_count': 1, 'examples': [{'opcode': 'DELEGATECALL', 'pc': 393, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'n/a'}], 'guards_detected': [], 'untrusted_delegatecall_count': 1}
 normalized {'sink': 'DELEGATECALL'}
 validation {'attempts': 168, 'call_targets': None, 'classification': 'no_sink', 'confirmed': False, 'errors': 0, 'matched_probe': None, 'sink': 'DELEGATECALL', 'status': 'unknown', 'target_varies': None, 'trace_id': '0x3325434cb15a794ec465fa30e9092dd0edad7648a57cca55b385f38ad1d15646', 'trace_mode': 'callTracer'}

Finding 2 Untrusted CALL target/value reachable severity high confidence 60
 evidence_json {'call_count': 5, 'examples': [{'opcode': 'CALL', 'pc': 1420, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1565, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1771, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}], 'guards_detected': [], 'untrusted_call_count': 5}
 normalized {'sink': 'CALL'}
 validation {'attempts': 1, 'call_targets': ['0x942a70014b6ba71ec84b16e1604fc76b1071eaf9'], 'classification': 'constant_target', 'confirmed': False, 'errors': 0, 'matched_probe': None, 'sink': 'CALL', 'status': 'sink_reached', 'target_varies': False, 'trace_id': '0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be', 'trace_mode': 'callTracer'}

Finding 3 ETH value transfer possible severity high confidence 55
 evidence_json {'eth_value_calls': 5, 'examples': [{'opcode': 'CALL', 'pc': 1420, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1565, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}, {'opcode': 'CALL', 'pc': 1771, 'returndata_checked': None, 'target_expression_category': 'computed', 'value_expression_category': 'computed'}], 'guards_detected': []}
 normalized {'sink': 'CALL', 'value': 'nonzero'}
 validation {'attempts': 1, 'call_targets': ['0x942a70014b6ba71ec84b16e1604fc76b1071eaf9'], 'classification': 'constant_target', 'confirmed': False, 'errors': 0, 'matched_probe': None, 'sink': 'CALL', 'status': 'sink_reached', 'target_varies': False, 'trace_id': '0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be', 'trace_mode': 'callTracer'}

thinking
**Investigating auth guard presence**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

# check if top-level has proxy info in other fields
for key in ['analysis_run','artifact','capability_graph']:
    if key in data:
        print('\\n====', key, '====')
        # Print keys and some fields
        val=data[key]
        if isinstance(val, dict):
            print('keys', list(val.keys())[:20])
        else:
            print(type(val))

# If there is artifact with proxy evidence
artifact=data.get('artifact')
if isinstance(artifact, dict):
    print('\\nartifact keys', artifact.keys())
    for k in ['is_proxy','proxy_evidence','proxy','upgradeability','bytecode_hash','address']:
        if k in artifact:
            print(k, artifact.get(k))

# capability_graph may have proxy evidence
cg=data.get('capability_graph')
if isinstance(cg, dict):
    for k in ['is_proxy','proxy_evidence','proxy','upgradeability']:
        if k in cg:
            print('capability_graph', k, cg.get(k))

# analysis_run might contain proxy info
ar=data.get('analysis_run')
if isinstance(ar, dict):
    for k in ['is_proxy','proxy_evidence','proxy']:
        if k in ar:
            print('analysis_run', k, ar.get(k))
PY" in /tmp/codex-cyh1pt69 succeeded in 42ms:

==== analysis_run ====
keys ['address', 'block_number', 'chain_id', 'child_links', 'created_at', 'id', 'parent_links', 'status', 'updated_at']

==== artifact ====
keys ['codehash', 'compiler_json', 'implementation_address', 'is_proxy', 'runtime_bytecode', 'verified_source']

==== capability_graph ====
keys ['address', 'block_number', 'chain_id', 'codehash', 'created_at', 'graph_hash', 'graph_json', 'id', 'updated_at', 'version']

artifact keys dict_keys(['codehash', 'compiler_json', 'implementation_address', 'is_proxy', 'runtime_bytecode', 'verified_source'])
is_proxy False

thinking
**Inspecting capability_graph.graph_json**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

cg = data.get('capability_graph', {}).get('graph_json')
if cg:
    print('capability_graph.graph_json keys', cg.keys())
    print('is_proxy', cg.get('is_proxy'))
    print('proxy_evidence', cg.get('proxy_evidence'))
    print('proxy', cg.get('proxy'))
    print('dispatcher_type', cg.get('dispatcher_type'))
    print('selectors', cg.get('selectors'))
    # print auth guards if present
    if 'auth' in cg:
        print('auth', cg['auth'])
    # Print storage slots summary
    if 'storage' in cg:
        slots = cg['storage'].get('slots', [])
        print('storage slots count', len(slots))
        print('first slots', slots[:10])
    # print callsites
    print('callsites count', len(cg.get('callsites', [])))
    print('callsites', cg.get('callsites', [])[:10])

PY" in /tmp/codex-cyh1pt69 succeeded in 92ms:
capability_graph.graph_json keys dict_keys(['edges', 'nodes', 'version'])
is_proxy None
proxy_evidence None
proxy None
dispatcher_type None
selectors None
callsites count 0
callsites []

thinking
**Planning JSON inspection for proxy evidence**
exec
/bin/bash -lc "python - <<'PY'
import json

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

# Traverse to find proxy_evidence
results=[]

def walk(obj, path=''):
    if isinstance(obj, dict):
        for k,v in obj.items():
            p = f\"{path}.{k}\" if path else k
            if k in ('proxy_evidence','is_proxy','proxy'):
                results.append((p, v))
            walk(v, p)
    elif isinstance(obj, list):
        for i,v in enumerate(obj):
            walk(v, f\"{path}[{i}]\")

walk(data)

for p,v in results:
    print(p, ':', v)
PY" in /tmp/codex-cyh1pt69 succeeded in 30ms:
artifact.compiler_json.etherscan.proxy : 0
artifact.compiler_json.proxy_evidence : {'status': 'not_proxy'}
artifact.is_proxy : False

thinking
**Investigating delegatecall usage in contract analysis**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bb = data['analysis_artifact']['artifact_json']['basic_blocks']
# Find blocks containing DELEGATECALL
for b in bb:
    if 'DELEGATECALL' in b.get('opcodes', []):
        print('block', b['start_pc'], b['end_pc'])
        print(b['opcodes'])

# Print blocks around pc 345-407
for b in bb:
    if 330 <= b['start_pc'] <= 410:
        print('block', b['start_pc'], b['end_pc'])
        print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 28ms:
block 381 407
['JUMPDEST', 'PUSH1', 'PUSH1', 'MLOAD', 'OP_80', 'OP_83', 'SUB', 'OP_81', 'OP_86', 'OP_86', 'DELEGATECALL', 'OP_92', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']
block 336 344
['JUMPDEST', 'PUSH1', 'MLOAD', 'OP_80', 'OP_91', 'SUB', 'OP_90', 'REVERT']
block 345 380
['JUMPDEST', 'PUSH1', 'OP_80', 'SLOAD', 'PUSH1', 'SLOAD', 'PUSH1', 'MLOAD', 'OP_83', 'OP_92', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'OP_91', 'OP_90', 'PUSH2', 'OP_90', 'OP_84', 'OP_90', 'CALLDATASIZE', 'OP_90', 'PUSH2', 'JUMP']
block 381 407
['JUMPDEST', 'PUSH1', 'PUSH1', 'MLOAD', 'OP_80', 'OP_83', 'SUB', 'OP_81', 'OP_86', 'OP_86', 'DELEGATECALL', 'OP_92', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']
block 408 440
['PUSH1', 'MLOAD', 'OP_91', 'POP', 'PUSH1', 'NOT', 'PUSH1', 'RETURNDATASIZE', 'ADD', 'AND', 'OP_82', 'ADD', 'PUSH1', 'MSTORE', 'RETURNDATASIZE', 'OP_82', 'MSTORE', 'RETURNDATASIZE', 'PUSH1', 'PUSH1', 'OP_84', 'ADD', 'RETURNDATACOPY', 'PUSH2', 'JUMP']

thinking
**Analyzing delegatecall and storage slots**
exec
/bin/bash -lc "python - <<'PY'
import json

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bb = data['analysis_artifact']['artifact_json']['basic_blocks']

callsites = data['analysis_artifact']['artifact_json']['callsites']

# For each callsite, print the block containing pc if possible
for cs in callsites:
    pc = cs['pc']
    block = next((b for b in bb if b['start_pc'] <= pc <= b['end_pc']), None)
    print('\\ncallsite', cs['opcode'], 'pc', pc)
    if block:
        print('block', block['start_pc'], block['end_pc'])
        print(block['opcodes'])
    else:
        print('block not found')
PY" in /tmp/codex-cyh1pt69 succeeded in 26ms:

callsite DELEGATECALL pc 393
block 381 407
['JUMPDEST', 'PUSH1', 'PUSH1', 'MLOAD', 'OP_80', 'OP_83', 'SUB', 'OP_81', 'OP_86', 'OP_86', 'DELEGATECALL', 'OP_92', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']

callsite CALL pc 1420
block 1417 1427
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']

callsite CALL pc 1565
block 1562 1572
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']

callsite CALL pc 1771
block 1742 1786
['JUMPDEST', 'PUSH1', 'SLOAD', 'PUSH1', 'MLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'OP_84', 'AND', 'OP_91', 'OP_90', 'OP_83', 'OP_90', 'PUSH1', 'OP_81', 'OP_81', 'OP_81', 'OP_85', 'OP_88', 'OP_88', 'CALL', 'OP_93', 'POP', 'POP', 'POP', 'POP', 'RETURNDATASIZE', 'OP_80', 'PUSH1', 'OP_81', 'EQ', 'PUSH2', 'JUMPI']

callsite CALL pc 2262
block 2239 2274
['JUMPDEST', 'PUSH1', 'MLOAD', 'CALLER', 'OP_90', 'OP_82', 'ISZERO', 'PUSH2', 'MUL', 'OP_90', 'OP_83', 'OP_90', 'PUSH1', 'OP_81', 'OP_81', 'OP_81', 'OP_85', 'OP_88', 'OP_88', 'CALL', 'OP_93', 'POP', 'POP', 'POP', 'POP', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']

thinking
**Analyzing proxy delegatecall patterns**

I'm trying to make sense of delegatecalls in this contract, suspecting it's a proxy but not a typical EIP-1967 one. I'll focus on understanding the selectors, their delegatecall usage, and any access control to changes since these could affect upgradeability and security. I plan to parse the large artifact JSON to extract selector details and call edges to clarify how functions map to delegatecall targets.
exec
/bin/bash -lc "python - <<'PY'
import json

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

artifact_json = data['analysis_artifact']['artifact_json']
print('artifact_json keys', artifact_json.keys())

# Show extra keys besides basic_blocks, callsites etc
for k in artifact_json.keys():
    if k not in ('basic_blocks','callsites','auth','version'):
        print(k, type(artifact_json[k]))

# if selectors_detail exist
for k in artifact_json.keys():
    if 'selector' in k:
        print('selector key', k)

# Let's search for a key containing 'selector_analysis' or 'functions'
for k in artifact_json.keys():
    if 'function' in k or 'selector' in k or 'dispatch' in k or 'proxy' in k:
        print('key', k)

PY" in /tmp/codex-cyh1pt69 succeeded in 32ms:
artifact_json keys dict_keys(['auth', 'basic_blocks', 'callsites', 'cfg_edges', 'cfg_hash', 'dispatcher_type', 'function_entries', 'functions', 'selectors', 'sinks', 'storage', 'version'])
cfg_edges <class 'list'>
cfg_hash <class 'str'>
dispatcher_type <class 'str'>
function_entries <class 'list'>
functions <class 'list'>
selectors <class 'list'>
sinks <class 'dict'>
storage <class 'dict'>
selector key selectors
key dispatcher_type
key function_entries
key functions
key selectors

thinking
**Inspecting functions metadata**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

functions = data['analysis_artifact']['artifact_json']['functions']
print('functions count', len(functions))
# print first function keys
if functions:
    print('function keys', functions[0].keys())
    # print first function metadata summary
    pprint(functions[0])
PY" in /tmp/codex-cyh1pt69 succeeded in 42ms:
functions count 14
function keys dict_keys(['auth', 'entry_pc', 'selector', 'sinks', 'storage'])
{'auth': {'guards': []},
 'entry_pc': 2855094825,
 'selector': '0xaa2d4a29',
 'sinks': {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0},
 'storage': {'reads': 25,
             'slots': [{'op': 'SLOAD',
                        'pc': 265,
                        'slot': '0x0000000000000000000000000000000000000000000000000000000000000003'},
                       {'op': 'SLOAD',
                        'pc': 296,
                        'slot': '0x0000000000000000000000000000000000000000000000000000000000000001'},
                       {'op': 'SLOAD',
                        'pc': 349,
                        'slot': '0x0000000000000000000000000000000000000000000000000000000000000000'},
                       {'op': 'SLOAD',
                        'pc': 352,
                        'slot': '0x0000000000000000000000000000000000000000000000000000000000000004'},
                       {'op': 'SLOAD',

thinking
**Analyzing function call patterns**
exec
/bin/bash -lc "python - <<'PY'
import json
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

functions = data['analysis_artifact']['artifact_json']['functions']
for f in functions:
    print(f['selector'], 'entry_pc', f['entry_pc'], 'sinks', f['sinks'])
PY" in /tmp/codex-cyh1pt69 succeeded in 80ms:
0xaa2d4a29 entry_pc 2855094825 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xd89da49c entry_pc 3991757201 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xeded6191 entry_pc 4022048962 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xefbb98c2 entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x802a81d8 entry_pc 2165140709 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x810d6ce5 entry_pc 2754971927 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0xa4358917 entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x1fceed7f entry_pc 533654911 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x234ecf06 entry_pc 1517302307 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x5a703223 entry_pc 1602552402 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x5f850252 entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x0ae50a39 entry_pc 302222941 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x12038e5d entry_pc 377306780 sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}
0x167d3e9c entry_pc None sinks {'call': 5, 'delegatecall': 1, 'selfdestruct': 0, 'staticcall': 0}

thinking
**Analyzing proxy delegatecall and storage writes**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

f0 = data['analysis_artifact']['artifact_json']['functions'][0]
print(f0['storage'].keys())
print('writes', f0['storage'].get('writes'))
print('slots len', len(f0['storage'].get('slots', [])))
# Check for SSTORE entries
sstore = [s for s in f0['storage'].get('slots', []) if s.get('op')=='SSTORE']
print('sstore entries', sstore)

# check if storage has separate 'writes' or 'write_slots'
for k,v in f0['storage'].items():
    if k not in ('reads','writes','slots'):
        print('other', k, v)
PY" in /tmp/codex-cyh1pt69 succeeded in 87ms:
dict_keys(['reads', 'slots', 'writes'])
writes 6
slots len 23
sstore entries []

thinking
**Investigating storage write operations**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

storage = data['analysis_artifact']['artifact_json']['storage']
print(storage.keys())
print('reads', storage.get('reads'), 'writes', storage.get('writes'))

# check for sstore entries
slots = storage.get('slots', [])
print('slots count', len(slots))
print('unique ops', sorted(set(s.get('op') for s in slots)))

# show any SSTORE entries if present
sstore = [s for s in slots if s.get('op')=='SSTORE']
print('sstore entries count', len(sstore))
print('first sstore entries', sstore[:5])

PY" in /tmp/codex-cyh1pt69 succeeded in 46ms:
dict_keys(['keccak_count', 'reads', 'slots', 'writes'])
reads 25 writes 6
slots count 23
unique ops ['SLOAD']
sstore entries count 0
first sstore entries []

thinking
**Analyzing storage and delegatecall risks**
exec
/bin/bash -lc "python - <<'PY'
import json

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bb = data['analysis_artifact']['artifact_json']['basic_blocks']
for b in bb:
    if 232 <= b['start_pc'] <= 312:
        print('block', b['start_pc'], b['end_pc'])
        print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 76ms:
block 232 261
['JUMPDEST', 'CALLER', 'PUSH1', 'OP_90', 'OP_81', 'MSTORE', 'PUSH1', 'PUSH1', 'MSTORE', 'PUSH1', 'OP_81', 'SHA3', 'SLOAD', 'CALLDATASIZE', 'OP_90', 'PUSH1', 'OP_90', 'PUSH1', 'EQ', 'OP_80', 'PUSH2', 'JUMPI']
block 262 276
['POP', 'PUSH1', 'SLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'CALLER', 'EQ']
block 277 282
['JUMPDEST', 'OP_80', 'PUSH2', 'JUMPI']
block 283 286
['POP', 'CALLER', 'ADDRESS', 'EQ']
block 287 292
['JUMPDEST', 'OP_80', 'PUSH2', 'JUMPI']
block 293 307
['POP', 'PUSH1', 'SLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'CALLER', 'EQ']
block 308 312
['JUMPDEST', 'PUSH2', 'JUMPI']

thinking
**Analyzing access control and delegatecall patterns**
exec
/bin/bash -lc "python - <<'PY'
import json
from pprint import pprint
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

entries = data['analysis_artifact']['artifact_json']['function_entries']
print('function_entries count', len(entries))
print(entries[:10])
PY" in /tmp/codex-cyh1pt69 succeeded in 75ms:
function_entries count 14
[{'entry_pc': 2855094825, 'selector': '0xaa2d4a29'}, {'entry_pc': 3991757201, 'selector': '0xd89da49c'}, {'entry_pc': 4022048962, 'selector': '0xeded6191'}, {'entry_pc': None, 'selector': '0xefbb98c2'}, {'entry_pc': 2165140709, 'selector': '0x802a81d8'}, {'entry_pc': 2754971927, 'selector': '0x810d6ce5'}, {'entry_pc': None, 'selector': '0xa4358917'}, {'entry_pc': 533654911, 'selector': '0x1fceed7f'}, {'entry_pc': 1517302307, 'selector': '0x234ecf06'}, {'entry_pc': 1602552402, 'selector': '0x5a703223'}]

thinking
**Analyzing contract dispatch and call risks**

I'm exploring how large entry PCs might relate to hashed selectors or dynamic dispatch via storage tables. I'll look for fallback or receive functions by checking opcodes like CALLDATASIZE and JUMPI, and inspect key blocks to understand control flow. With evidence limits, I want to cautiously evaluate delegatecall and external call risks, assigning severity levels conservatively while noting any access control hints. I’m also trying to assess how call values are sourced by reviewing opcode blocks near the 1400 range to understand potential vulnerabilities more clearly.
exec
/bin/bash -lc "python - <<'PY'
import json

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bb = data['analysis_artifact']['artifact_json']['basic_blocks']

# Print blocks around 1380-1450
for b in bb:
    if 1360 <= b['start_pc'] <= 1460:
        print('block', b['start_pc'], b['end_pc'])
        print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 26ms:
block 1413 1416
['PUSH1', 'OP_80', 'REVERT']
block 1417 1427
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']
block 1428 1436
['RETURNDATASIZE', 'PUSH1', 'OP_80', 'RETURNDATACOPY', 'RETURNDATASIZE', 'PUSH1', 'REVERT']
block 1437 1445
['JUMPDEST', 'POP', 'POP', 'POP', 'POP', 'POP', 'POP', 'POP', 'JUMP']
block 1446 1464
['JUMPDEST', 'PUSH1', 'SLOAD', 'PUSH1', 'PUSH1', 'PUSH1', 'SHL', 'SUB', 'AND', 'CALLER', 'EQ', 'PUSH2', 'JUMPI']

thinking
**Investigating auth check location**
exec
/bin/bash -lc "python - <<'PY'
import json

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bb = data['analysis_artifact']['artifact_json']['basic_blocks']

# Print blocks around 1540-1590
for b in bb:
    if 1540 <= b['start_pc'] <= 1600:
        print('block', b['start_pc'], b['end_pc'])
        print(b['opcodes'])
PY" in /tmp/codex-cyh1pt69 succeeded in 26ms:
block 1558 1561
['PUSH1', 'OP_80', 'REVERT']
block 1562 1572
['JUMPDEST', 'POP', 'GAS', 'CALL', 'ISZERO', 'OP_80', 'ISZERO', 'PUSH2', 'JUMPI']
block 1573 1581
['RETURNDATASIZE', 'PUSH1', 'OP_80', 'RETURNDATACOPY', 'RETURNDATASIZE', 'PUSH1', 'REVERT']
block 1582 1617
['JUMPDEST', 'POP', 'POP', 'POP', 'POP', 'PUSH1', 'MLOAD', 'RETURNDATASIZE', 'PUSH1', 'NOT', 'PUSH1', 'OP_82', 'ADD', 'AND', 'OP_82', 'ADD', 'OP_80', 'PUSH1', 'MSTORE', 'POP', 'OP_81', 'ADD', 'OP_90', 'PUSH2', 'OP_91', 'OP_90', 'PUSH2', 'JUMP']


thinking
**Summarizing delegatecall and call risks**

I’m laying out two main findings about potential vulnerabilities: a high-severity risk from a computed delegatecall target without detected guards, suggesting possible arbitrary code execution, and a medium-severity risk from multiple computed external CALL sites possibly allowing unauthorized fund transfers. I’m carefully balancing the evidence, noting the uncertainty from validations and emphasizing the need for strict access control and guarded upgrade patterns.
thinking
**Completing vulnerability report JSON**
codex
{"no_findings":false,"summary":"Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.","findings":[{"severity":"high","category":"upgradeability","title":"Computed DELEGATECALL target allows potential arbitrary code execution","exploit_scenario":"If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract’s context, draining funds or overwriting state.","recommendation":"Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.","evidence":"Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.","locations":["pc:0x189"]},{"severity":"medium","category":"access_control","title":"Potential arbitrary external CALLs with value to computed targets","exploit_scenario":"If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract’s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets.","recommendation":"Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.","evidence":"Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.","locations":["pc:0x58c","pc:0x61d","pc:0x6eb","pc:0x8d6","pc:0x9da"]}]}
tokens used
91,543
Metadata
{
    "codex": {
        "ran_at": "2026-01-10T21:24:16.308909+00:00",
        "returncode": 0
    },
    "project": {
        "mode": "bytecode",
        "bytecode_length": 7392,
        "bytecode_truncated": false,
        "capability_graph_present": true,
        "analysis_artifact_present": true
    },
    "summary": "Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.",
    "raw_final": {
        "summary": "Bytecode shows a computed DELEGATECALL and multiple computed CALL sites; guard/target controllability is unclear from artifacts, so findings are conditional on who can influence those targets/values.",
        "findings": [
            {
                "title": "Computed DELEGATECALL target allows potential arbitrary code execution",
                "category": "upgradeability",
                "evidence": "Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.",
                "severity": "high",
                "locations": [
                    "pc:0x189"
                ],
                "recommendation": "Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.",
                "exploit_scenario": "If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract\u2019s context, draining funds or overwriting state."
            },
            {
                "title": "Potential arbitrary external CALLs with value to computed targets",
                "category": "access_control",
                "evidence": "Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.",
                "severity": "medium",
                "locations": [
                    "pc:0x58c",
                    "pc:0x61d",
                    "pc:0x6eb",
                    "pc:0x8d6",
                    "pc:0x9da"
                ],
                "recommendation": "Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.",
                "exploit_scenario": "If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract\u2019s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets."
            }
        ],
        "no_findings": false
    },
    "no_findings": false,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
1
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
5
EXT*/BALANCE
3
Total opcodes
2547
Flags
delegatecall_present
View cast disassembly output
00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x00e1
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x802a81d8
00000019: GT
0000001a: PUSH2 0x007f
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0xaa2d4a29
00000024: GT
00000025: PUSH2 0x0059
00000028: JUMPI
00000029: DUP1
0000002a: PUSH4 0xaa2d4a29
0000002f: EQ
00000030: PUSH2 0x0342
00000033: JUMPI
00000034: DUP1
00000035: PUSH4 0xd89da49c
0000003a: EQ
0000003b: PUSH2 0x0362
0000003e: JUMPI
0000003f: DUP1
00000040: PUSH4 0xeded6191
00000045: EQ
00000046: PUSH2 0x0380
00000049: JUMPI
0000004a: DUP1
0000004b: PUSH4 0xefbb98c2
00000050: EQ
00000051: PUSH2 0x03a0
00000054: JUMPI
00000055: PUSH2 0x00e8
00000058: JUMP
00000059: JUMPDEST
0000005a: DUP1
0000005b: PUSH4 0x802a81d8
00000060: EQ
00000061: PUSH2 0x02e2
00000064: JUMPI
00000065: DUP1
00000066: PUSH4 0x810d6ce5
0000006b: EQ
0000006c: PUSH2 0x0302
0000006f: JUMPI
00000070: DUP1
00000071: PUSH4 0xa4358917
00000076: EQ
00000077: PUSH2 0x0322
0000007a: JUMPI
0000007b: PUSH2 0x00e8
0000007e: JUMP
0000007f: JUMPDEST
00000080: DUP1
00000081: PUSH4 0x1fceed7f
00000086: GT
00000087: PUSH2 0x00bb
0000008a: JUMPI
0000008b: DUP1
0000008c: PUSH4 0x1fceed7f
00000091: EQ
00000092: PUSH2 0x0262
00000095: JUMPI
00000096: DUP1
00000097: PUSH4 0x234ecf06
0000009c: EQ
0000009d: PUSH2 0x0282
000000a0: JUMPI
000000a1: DUP1
000000a2: PUSH4 0x5a703223
000000a7: EQ
000000a8: PUSH2 0x02a2
000000ab: JUMPI
000000ac: DUP1
000000ad: PUSH4 0x5f850252
000000b2: EQ
000000b3: PUSH2 0x02c2
000000b6: JUMPI
000000b7: PUSH2 0x00e8
000000ba: JUMP
000000bb: JUMPDEST
000000bc: DUP1
000000bd: PUSH4 0x0ae50a39
000000c2: EQ
000000c3: PUSH2 0x01ea
000000c6: JUMPI
000000c7: DUP1
000000c8: PUSH4 0x12038e5d
000000cd: EQ
000000ce: PUSH2 0x0220
000000d1: JUMPI
000000d2: DUP1
000000d3: PUSH4 0x167d3e9c
000000d8: EQ
000000d9: PUSH2 0x0242
000000dc: JUMPI
000000dd: PUSH2 0x00e8
000000e0: JUMP
000000e1: JUMPDEST
000000e2: CALLDATASIZE
000000e3: PUSH2 0x00e8
000000e6: JUMPI
000000e7: STOP
000000e8: JUMPDEST
000000e9: CALLER
000000ea: PUSH1 0x00
000000ec: SWAP1
000000ed: DUP2
000000ee: MSTORE
000000ef: PUSH1 0x02
000000f1: PUSH1 0x20
000000f3: MSTORE
000000f4: PUSH1 0x40
000000f6: DUP2
000000f7: KECCAK256
000000f8: SLOAD
000000f9: CALLDATASIZE
000000fa: SWAP1
000000fb: PUSH1 0x60
000000fd: SWAP1
000000fe: PUSH1 0x01
00000100: EQ
00000101: DUP1
00000102: PUSH2 0x0115
00000105: JUMPI
00000106: POP
00000107: PUSH1 0x03
00000109: SLOAD
0000010a: PUSH1 0x01
0000010c: PUSH1 0x01
0000010e: PUSH1 0xa0
00000110: SHL
00000111: SUB
00000112: AND
00000113: CALLER
00000114: EQ
00000115: JUMPDEST
00000116: DUP1
00000117: PUSH2 0x011f
0000011a: JUMPI
0000011b: POP
0000011c: CALLER
0000011d: ADDRESS
0000011e: EQ
0000011f: JUMPDEST
00000120: DUP1
00000121: PUSH2 0x0134
00000124: JUMPI
00000125: POP
00000126: PUSH1 0x01
00000128: SLOAD
00000129: PUSH1 0x01
0000012b: PUSH1 0x01
0000012d: PUSH1 0xa0
0000012f: SHL
00000130: SUB
00000131: AND
00000132: CALLER
00000133: EQ
00000134: JUMPDEST
00000135: PUSH2 0x0159
00000138: JUMPI
00000139: PUSH1 0x40
0000013b: MLOAD
0000013c: PUSH3 0x461bcd
00000140: PUSH1 0xe5
00000142: SHL
00000143: DUP2
00000144: MSTORE
00000145: PUSH1 0x04
00000147: ADD
00000148: PUSH2 0x0150
0000014b: SWAP1
0000014c: PUSH2 0x0d16
0000014f: JUMP
00000150: JUMPDEST
00000151: PUSH1 0x40
00000153: MLOAD
00000154: DUP1
00000155: SWAP2
00000156: SUB
00000157: SWAP1
00000158: REVERT
00000159: JUMPDEST
0000015a: PUSH1 0x00
0000015c: DUP1
0000015d: SLOAD
0000015e: PUSH1 0x04
00000160: SLOAD
00000161: PUSH1 0x40
00000163: MLOAD
00000164: DUP4
00000165: SWAP3
00000166: PUSH1 0x01
00000168: PUSH1 0x01
0000016a: PUSH1 0xa0
0000016c: SHL
0000016d: SUB
0000016e: AND
0000016f: SWAP2
00000170: SWAP1
00000171: PUSH2 0x017d
00000174: SWAP1
00000175: DUP5
00000176: SWAP1
00000177: CALLDATASIZE
00000178: SWAP1
00000179: PUSH2 0x0cb7
0000017c: JUMP
0000017d: JUMPDEST
0000017e: PUSH1 0x00
00000180: PUSH1 0x40
00000182: MLOAD
00000183: DUP1
00000184: DUP4
00000185: SUB
00000186: DUP2
00000187: DUP7
00000188: DUP7
00000189: DELEGATECALL
0000018a: SWAP3
0000018b: POP
0000018c: POP
0000018d: POP
0000018e: RETURNDATASIZE
0000018f: DUP1
00000190: PUSH1 0x00
00000192: DUP2
00000193: EQ
00000194: PUSH2 0x01b9
00000197: JUMPI
00000198: PUSH1 0x40
0000019a: MLOAD
0000019b: SWAP2
0000019c: POP
0000019d: PUSH1 0x1f
0000019f: NOT
000001a0: PUSH1 0x3f
000001a2: RETURNDATASIZE
000001a3: ADD
000001a4: AND
000001a5: DUP3
000001a6: ADD
000001a7: PUSH1 0x40
000001a9: MSTORE
000001aa: RETURNDATASIZE
000001ab: DUP3
000001ac: MSTORE
000001ad: RETURNDATASIZE
000001ae: PUSH1 0x00
000001b0: PUSH1 0x20
000001b2: DUP5
000001b3: ADD
000001b4: RETURNDATACOPY
000001b5: PUSH2 0x01be
000001b8: JUMP
000001b9: JUMPDEST
000001ba: PUSH1 0x60
000001bc: SWAP2
000001bd: POP
000001be: JUMPDEST
000001bf: POP
000001c0: SWAP2
000001c1: POP
000001c2: SWAP2
000001c3: POP
000001c4: DUP2
000001c5: ISZERO
000001c6: PUSH2 0x01d2
000001c9: JUMPI
000001ca: SWAP2
000001cb: POP
000001cc: PUSH2 0x01df
000001cf: SWAP1
000001d0: POP
000001d1: JUMP
000001d2: JUMPDEST
000001d3: PUSH1 0x40
000001d5: MLOAD
000001d6: RETURNDATASIZE
000001d7: DUP1
000001d8: PUSH1 0x00
000001da: DUP4
000001db: RETURNDATACOPY
000001dc: DUP1
000001dd: DUP3
000001de: REVERT
000001df: JUMPDEST
000001e0: SWAP2
000001e1: POP
000001e2: POP
000001e3: DUP1
000001e4: MLOAD
000001e5: SWAP1
000001e6: PUSH1 0x20
000001e8: ADD
000001e9: RETURN
000001ea: JUMPDEST
000001eb: CALLVALUE
000001ec: DUP1
000001ed: ISZERO
000001ee: PUSH2 0x01f6
000001f1: JUMPI
000001f2: PUSH1 0x00
000001f4: DUP1
000001f5: REVERT
000001f6: JUMPDEST
000001f7: POP
000001f8: PUSH1 0x01
000001fa: SLOAD
000001fb: PUSH1 0x01
000001fd: PUSH1 0x01
000001ff: PUSH1 0xa0
00000201: SHL
00000202: SUB
00000203: AND
00000204: JUMPDEST
00000205: PUSH1 0x40
00000207: MLOAD
00000208: PUSH1 0x01
0000020a: PUSH1 0x01
0000020c: PUSH1 0xa0
0000020e: SHL
0000020f: SUB
00000210: SWAP1
00000211: SWAP2
00000212: AND
00000213: DUP2
00000214: MSTORE
00000215: PUSH1 0x20
00000217: ADD
00000218: PUSH1 0x40
0000021a: MLOAD
0000021b: DUP1
0000021c: SWAP2
0000021d: SUB
0000021e: SWAP1
0000021f: RETURN
00000220: JUMPDEST
00000221: CALLVALUE
00000222: DUP1
00000223: ISZERO
00000224: PUSH2 0x022c
00000227: JUMPI
00000228: PUSH1 0x00
0000022a: DUP1
0000022b: REVERT
0000022c: JUMPDEST
0000022d: POP
0000022e: PUSH2 0x0240
00000231: PUSH2 0x023b
00000234: CALLDATASIZE
00000235: PUSH1 0x04
00000237: PUSH2 0x0a7f
0000023a: JUMP
0000023b: JUMPDEST
0000023c: PUSH2 0x03c0
0000023f: JUMP
00000240: JUMPDEST
00000241: STOP
00000242: JUMPDEST
00000243: CALLVALUE
00000244: DUP1
00000245: ISZERO
00000246: PUSH2 0x024e
00000249: JUMPI
0000024a: PUSH1 0x00
0000024c: DUP1
0000024d: REVERT
0000024e: JUMPDEST
0000024f: POP
00000250: PUSH2 0x0240
00000253: PUSH2 0x025d
00000256: CALLDATASIZE
00000257: PUSH1 0x04
00000259: PUSH2 0x0a7f
0000025c: JUMP
0000025d: JUMPDEST
0000025e: PUSH2 0x0445
00000261: JUMP
00000262: JUMPDEST
00000263: CALLVALUE
00000264: DUP1
00000265: ISZERO
00000266: PUSH2 0x026e
00000269: JUMPI
0000026a: PUSH1 0x00
0000026c: DUP1
0000026d: REVERT
0000026e: JUMPDEST
0000026f: POP
00000270: PUSH2 0x0240
00000273: PUSH2 0x027d
00000276: CALLDATASIZE
00000277: PUSH1 0x04
00000279: PUSH2 0x0b07
0000027c: JUMP
0000027d: JUMPDEST
0000027e: PUSH2 0x0491
00000281: JUMP
00000282: JUMPDEST
00000283: CALLVALUE
00000284: DUP1
00000285: ISZERO
00000286: PUSH2 0x028e
00000289: JUMPI
0000028a: PUSH1 0x00
0000028c: DUP1
0000028d: REVERT
0000028e: JUMPDEST
0000028f: POP
00000290: PUSH2 0x0240
00000293: PUSH2 0x029d
00000296: CALLDATASIZE
00000297: PUSH1 0x04
00000299: PUSH2 0x0add
0000029c: JUMP
0000029d: JUMPDEST
0000029e: PUSH2 0x051b
000002a1: JUMP
000002a2: JUMPDEST
000002a3: CALLVALUE
000002a4: DUP1
000002a5: ISZERO
000002a6: PUSH2 0x02ae
000002a9: JUMPI
000002aa: PUSH1 0x00
000002ac: DUP1
000002ad: REVERT
000002ae: JUMPDEST
000002af: POP
000002b0: PUSH2 0x0240
000002b3: PUSH2 0x02bd
000002b6: CALLDATASIZE
000002b7: PUSH1 0x04
000002b9: PUSH2 0x0add
000002bc: JUMP
000002bd: JUMPDEST
000002be: PUSH2 0x05a6
000002c1: JUMP
000002c2: JUMPDEST
000002c3: CALLVALUE
000002c4: DUP1
000002c5: ISZERO
000002c6: PUSH2 0x02ce
000002c9: JUMPI
000002ca: PUSH1 0x00
000002cc: DUP1
000002cd: REVERT
000002ce: JUMPDEST
000002cf: POP
000002d0: PUSH2 0x0240
000002d3: PUSH2 0x02dd
000002d6: CALLDATASIZE
000002d7: PUSH1 0x04
000002d9: PUSH2 0x0a7f
000002dc: JUMP
000002dd: JUMPDEST
000002de: PUSH2 0x0658
000002e1: JUMP
000002e2: JUMPDEST
000002e3: CALLVALUE
000002e4: DUP1
000002e5: ISZERO
000002e6: PUSH2 0x02ee
000002e9: JUMPI
000002ea: PUSH1 0x00
000002ec: DUP1
000002ed: REVERT
000002ee: JUMPDEST
000002ef: POP
000002f0: PUSH2 0x0240
000002f3: PUSH2 0x02fd
000002f6: CALLDATASIZE
000002f7: PUSH1 0x04
000002f9: PUSH2 0x0add
000002fc: JUMP
000002fd: JUMPDEST
000002fe: PUSH2 0x06a4
00000301: JUMP
00000302: JUMPDEST
00000303: CALLVALUE
00000304: DUP1
00000305: ISZERO
00000306: PUSH2 0x030e
00000309: JUMPI
0000030a: PUSH1 0x00
0000030c: DUP1
0000030d: REVERT
0000030e: JUMPDEST
0000030f: POP
00000310: PUSH2 0x0240
00000313: PUSH2 0x031d
00000316: CALLDATASIZE
00000317: PUSH1 0x04
00000319: PUSH2 0x0c9e
0000031c: JUMP
0000031d: JUMPDEST
0000031e: PUSH2 0x0728
00000321: JUMP
00000322: JUMPDEST
00000323: CALLVALUE
00000324: DUP1
00000325: ISZERO
00000326: PUSH2 0x032e
00000329: JUMPI
0000032a: PUSH1 0x00
0000032c: DUP1
0000032d: REVERT
0000032e: JUMPDEST
0000032f: POP
00000330: PUSH2 0x0240
00000333: PUSH2 0x033d
00000336: CALLDATASIZE
00000337: PUSH1 0x04
00000339: PUSH2 0x0b07
0000033c: JUMP
0000033d: JUMPDEST
0000033e: PUSH2 0x0757
00000341: JUMP
00000342: JUMPDEST
00000343: CALLVALUE
00000344: DUP1
00000345: ISZERO
00000346: PUSH2 0x034e
00000349: JUMPI
0000034a: PUSH1 0x00
0000034c: DUP1
0000034d: REVERT
0000034e: JUMPDEST
0000034f: POP
00000350: PUSH2 0x0240
00000353: PUSH2 0x035d
00000356: CALLDATASIZE
00000357: PUSH1 0x04
00000359: PUSH2 0x0bab
0000035c: JUMP
0000035d: JUMPDEST
0000035e: PUSH2 0x07d9
00000361: JUMP
00000362: JUMPDEST
00000363: CALLVALUE
00000364: DUP1
00000365: ISZERO
00000366: PUSH2 0x036e
00000369: JUMPI
0000036a: PUSH1 0x00
0000036c: DUP1
0000036d: REVERT
0000036e: JUMPDEST
0000036f: POP
00000370: PUSH1 0x00
00000372: SLOAD
00000373: PUSH1 0x01
00000375: PUSH1 0x01
00000377: PUSH1 0xa0
00000379: SHL
0000037a: SUB
0000037b: AND
0000037c: PUSH2 0x0204
0000037f: JUMP
00000380: JUMPDEST
00000381: CALLVALUE
00000382: DUP1
00000383: ISZERO
00000384: PUSH2 0x038c
00000387: JUMPI
00000388: PUSH1 0x00
0000038a: DUP1
0000038b: REVERT
0000038c: JUMPDEST
0000038d: POP
0000038e: PUSH2 0x0240
00000391: PUSH2 0x039b
00000394: CALLDATASIZE
00000395: PUSH1 0x04
00000397: PUSH2 0x0aa1
0000039a: JUMP
0000039b: JUMPDEST
0000039c: PUSH2 0x085f
0000039f: JUMP
000003a0: JUMPDEST
000003a1: CALLVALUE
000003a2: DUP1
000003a3: ISZERO
000003a4: PUSH2 0x03ac
000003a7: JUMPI
000003a8: PUSH1 0x00
000003aa: DUP1
000003ab: REVERT
000003ac: JUMPDEST
000003ad: POP
000003ae: PUSH2 0x0240
000003b1: PUSH2 0x03bb
000003b4: CALLDATASIZE
000003b5: PUSH1 0x04
000003b7: PUSH2 0x0c9e
000003ba: JUMP
000003bb: JUMPDEST
000003bc: PUSH2 0x0895
000003bf: JUMP
000003c0: JUMPDEST
000003c1: CALLER
000003c2: PUSH1 0x00
000003c4: SWAP1
000003c5: DUP2
000003c6: MSTORE
000003c7: PUSH1 0x02
000003c9: PUSH1 0x20
000003cb: MSTORE
000003cc: PUSH1 0x40
000003ce: SWAP1
000003cf: KECCAK256
000003d0: SLOAD
000003d1: PUSH1 0x01
000003d3: EQ
000003d4: DUP1
000003d5: PUSH2 0x03e8
000003d8: JUMPI
000003d9: POP
000003da: PUSH1 0x03
000003dc: SLOAD
000003dd: PUSH1 0x01
000003df: PUSH1 0x01
000003e1: PUSH1 0xa0
000003e3: SHL
000003e4: SUB
000003e5: AND
000003e6: CALLER
000003e7: EQ
000003e8: JUMPDEST
000003e9: DUP1
000003ea: PUSH2 0x03f2
000003ed: JUMPI
000003ee: POP
000003ef: CALLER
000003f0: ADDRESS
000003f1: EQ
000003f2: JUMPDEST
000003f3: DUP1
000003f4: PUSH2 0x0407
000003f7: JUMPI
000003f8: POP
000003f9: PUSH1 0x01
000003fb: SLOAD
000003fc: PUSH1 0x01
000003fe: PUSH1 0x01
00000400: PUSH1 0xa0
00000402: SHL
00000403: SUB
00000404: AND
00000405: CALLER
00000406: EQ
00000407: JUMPDEST
00000408: PUSH2 0x0423
0000040b: JUMPI
0000040c: PUSH1 0x40
0000040e: MLOAD
0000040f: PUSH3 0x461bcd
00000413: PUSH1 0xe5
00000415: SHL
00000416: DUP2
00000417: MSTORE
00000418: PUSH1 0x04
0000041a: ADD
0000041b: PUSH2 0x0150
0000041e: SWAP1
0000041f: PUSH2 0x0d16
00000422: JUMP
00000423: JUMPDEST
00000424: PUSH1 0x03
00000426: DUP1
00000427: SLOAD
00000428: PUSH1 0x01
0000042a: PUSH1 0x01
0000042c: PUSH1 0xa0
0000042e: SHL
0000042f: SUB
00000430: NOT
00000431: AND
00000432: PUSH1 0x01
00000434: PUSH1 0x01
00000436: PUSH1 0xa0
00000438: SHL
00000439: SUB
0000043a: SWAP3
0000043b: SWAP1
0000043c: SWAP3
0000043d: AND
0000043e: SWAP2
0000043f: SWAP1
00000440: SWAP2
00000441: OR
00000442: SWAP1
00000443: SSTORE
00000444: JUMP
00000445: JUMPDEST
00000446: PUSH1 0x01
00000448: SLOAD
00000449: PUSH1 0x01
0000044b: PUSH1 0x01
0000044d: PUSH1 0xa0
0000044f: SHL
00000450: SUB
00000451: AND
00000452: CALLER
00000453: EQ
00000454: PUSH2 0x046f
00000457: JUMPI
00000458: PUSH1 0x40
0000045a: MLOAD
0000045b: PUSH3 0x461bcd
0000045f: PUSH1 0xe5
00000461: SHL
00000462: DUP2
00000463: MSTORE
00000464: PUSH1 0x04
00000466: ADD
00000467: PUSH2 0x0150
0000046a: SWAP1
0000046b: PUSH2 0x0d16
0000046e: JUMP
0000046f: JUMPDEST
00000470: PUSH1 0x01
00000472: DUP1
00000473: SLOAD
00000474: PUSH1 0x01
00000476: PUSH1 0x01
00000478: PUSH1 0xa0
0000047a: SHL
0000047b: SUB
0000047c: NOT
0000047d: AND
0000047e: PUSH1 0x01
00000480: PUSH1 0x01
00000482: PUSH1 0xa0
00000484: SHL
00000485: SUB
00000486: SWAP3
00000487: SWAP1
00000488: SWAP3
00000489: AND
0000048a: SWAP2
0000048b: SWAP1
0000048c: SWAP2
0000048d: OR
0000048e: SWAP1
0000048f: SSTORE
00000490: JUMP
00000491: JUMPDEST
00000492: PUSH1 0x01
00000494: SLOAD
00000495: PUSH1 0x01
00000497: PUSH1 0x01
00000499: PUSH1 0xa0
0000049b: SHL
0000049c: SUB
0000049d: AND
0000049e: CALLER
0000049f: EQ
000004a0: PUSH2 0x04bb
000004a3: JUMPI
000004a4: PUSH1 0x40
000004a6: MLOAD
000004a7: PUSH3 0x461bcd
000004ab: PUSH1 0xe5
000004ad: SHL
000004ae: DUP2
000004af: MSTORE
000004b0: PUSH1 0x04
000004b2: ADD
000004b3: PUSH2 0x0150
000004b6: SWAP1
000004b7: PUSH2 0x0d16
000004ba: JUMP
000004bb: JUMPDEST
000004bc: DUP1
000004bd: MLOAD
000004be: PUSH1 0x00
000004c0: JUMPDEST
000004c1: DUP2
000004c2: DUP2
000004c3: LT
000004c4: ISZERO
000004c5: PUSH2 0x0516
000004c8: JUMPI
000004c9: PUSH1 0x00
000004cb: DUP4
000004cc: DUP3
000004cd: DUP2
000004ce: MLOAD
000004cf: DUP2
000004d0: LT
000004d1: PUSH2 0x04dc
000004d4: JUMPI
000004d5: PUSH2 0x04dc
000004d8: PUSH2 0x0e0d
000004db: JUMP
000004dc: JUMPDEST
000004dd: PUSH1 0x20
000004df: SWAP1
000004e0: DUP2
000004e1: MUL
000004e2: SWAP2
000004e3: SWAP1
000004e4: SWAP2
000004e5: ADD
000004e6: DUP2
000004e7: ADD
000004e8: MLOAD
000004e9: PUSH1 0x01
000004eb: PUSH1 0x01
000004ed: PUSH1 0xa0
000004ef: SHL
000004f0: SUB
000004f1: AND
000004f2: PUSH1 0x00
000004f4: SWAP1
000004f5: DUP2
000004f6: MSTORE
000004f7: PUSH1 0x02
000004f9: SWAP1
000004fa: SWAP2
000004fb: MSTORE
000004fc: PUSH1 0x40
000004fe: SWAP1
000004ff: KECCAK256
00000500: PUSH1 0x01
00000502: SWAP1
00000503: SSTORE
00000504: POP
00000505: DUP1
00000506: PUSH2 0x050e
00000509: DUP2
0000050a: PUSH2 0x0de4
0000050d: JUMP
0000050e: JUMPDEST
0000050f: SWAP2
00000510: POP
00000511: POP
00000512: PUSH2 0x04c0
00000515: JUMP
00000516: JUMPDEST
00000517: POP
00000518: POP
00000519: POP
0000051a: JUMP
0000051b: JUMPDEST
0000051c: PUSH1 0x01
0000051e: SLOAD
0000051f: PUSH1 0x01
00000521: PUSH1 0x01
00000523: PUSH1 0xa0
00000525: SHL
00000526: SUB
00000527: AND
00000528: CALLER
00000529: EQ
0000052a: PUSH2 0x0545
0000052d: JUMPI
0000052e: PUSH1 0x40
00000530: MLOAD
00000531: PUSH3 0x461bcd
00000535: PUSH1 0xe5
00000537: SHL
00000538: DUP2
00000539: MSTORE
0000053a: PUSH1 0x04
0000053c: ADD
0000053d: PUSH2 0x0150
00000540: SWAP1
00000541: PUSH2 0x0d16
00000544: JUMP
00000545: JUMPDEST
00000546: PUSH1 0x40
00000548: MLOAD
00000549: PUSH4 0x2e1a7d4d
0000054e: PUSH1 0xe0
00000550: SHL
00000551: DUP2
00000552: MSTORE
00000553: PUSH1 0x04
00000555: DUP2
00000556: ADD
00000557: DUP3
00000558: SWAP1
00000559: MSTORE
0000055a: DUP3
0000055b: SWAP1
0000055c: PUSH1 0x01
0000055e: PUSH1 0x01
00000560: PUSH1 0xa0
00000562: SHL
00000563: SUB
00000564: DUP3
00000565: AND
00000566: SWAP1
00000567: PUSH4 0x2e1a7d4d
0000056c: SWAP1
0000056d: PUSH1 0x24
0000056f: ADD
00000570: PUSH1 0x00
00000572: PUSH1 0x40
00000574: MLOAD
00000575: DUP1
00000576: DUP4
00000577: SUB
00000578: DUP2
00000579: PUSH1 0x00
0000057b: DUP8
0000057c: DUP1
0000057d: EXTCODESIZE
0000057e: ISZERO
0000057f: DUP1
00000580: ISZERO
00000581: PUSH2 0x0589
00000584: JUMPI
00000585: PUSH1 0x00
00000587: DUP1
00000588: REVERT
00000589: JUMPDEST
0000058a: POP
0000058b: GAS
0000058c: CALL
0000058d: ISZERO
0000058e: DUP1
0000058f: ISZERO
00000590: PUSH2 0x059d
00000593: JUMPI
00000594: RETURNDATASIZE
00000595: PUSH1 0x00
00000597: DUP1
00000598: RETURNDATACOPY
00000599: RETURNDATASIZE
0000059a: PUSH1 0x00
0000059c: REVERT
0000059d: JUMPDEST
0000059e: POP
0000059f: POP
000005a0: POP
000005a1: POP
000005a2: POP
000005a3: POP
000005a4: POP
000005a5: JUMP
000005a6: JUMPDEST
000005a7: PUSH1 0x01
000005a9: SLOAD
000005aa: PUSH1 0x01
000005ac: PUSH1 0x01
000005ae: PUSH1 0xa0
000005b0: SHL
000005b1: SUB
000005b2: AND
000005b3: CALLER
000005b4: EQ
000005b5: PUSH2 0x05d0
000005b8: JUMPI
000005b9: PUSH1 0x40
000005bb: MLOAD
000005bc: PUSH3 0x461bcd
000005c0: PUSH1 0xe5
000005c2: SHL
000005c3: DUP2
000005c4: MSTORE
000005c5: PUSH1 0x04
000005c7: ADD
000005c8: PUSH2 0x0150
000005cb: SWAP1
000005cc: PUSH2 0x0d16
000005cf: JUMP
000005d0: JUMPDEST
000005d1: PUSH1 0x40
000005d3: MLOAD
000005d4: PUSH4 0xa9059cbb
000005d9: PUSH1 0xe0
000005db: SHL
000005dc: DUP2
000005dd: MSTORE
000005de: CALLER
000005df: PUSH1 0x04
000005e1: DUP3
000005e2: ADD
000005e3: MSTORE
000005e4: PUSH1 0x24
000005e6: DUP2
000005e7: ADD
000005e8: DUP3
000005e9: SWAP1
000005ea: MSTORE
000005eb: DUP3
000005ec: SWAP1
000005ed: PUSH1 0x01
000005ef: PUSH1 0x01
000005f1: PUSH1 0xa0
000005f3: SHL
000005f4: SUB
000005f5: DUP3
000005f6: AND
000005f7: SWAP1
000005f8: PUSH4 0xa9059cbb
000005fd: SWAP1
000005fe: PUSH1 0x44
00000600: ADD
00000601: PUSH1 0x20
00000603: PUSH1 0x40
00000605: MLOAD
00000606: DUP1
00000607: DUP4
00000608: SUB
00000609: DUP2
0000060a: PUSH1 0x00
0000060c: DUP8
0000060d: DUP1
0000060e: EXTCODESIZE
0000060f: ISZERO
00000610: DUP1
00000611: ISZERO
00000612: PUSH2 0x061a
00000615: JUMPI
00000616: PUSH1 0x00
00000618: DUP1
00000619: REVERT
0000061a: JUMPDEST
0000061b: POP
0000061c: GAS
0000061d: CALL
0000061e: ISZERO
0000061f: DUP1
00000620: ISZERO
00000621: PUSH2 0x062e
00000624: JUMPI
00000625: RETURNDATASIZE
00000626: PUSH1 0x00
00000628: DUP1
00000629: RETURNDATACOPY
0000062a: RETURNDATASIZE
0000062b: PUSH1 0x00
0000062d: REVERT
0000062e: JUMPDEST
0000062f: POP
00000630: POP
00000631: POP
00000632: POP
00000633: PUSH1 0x40
00000635: MLOAD
00000636: RETURNDATASIZE
00000637: PUSH1 0x1f
00000639: NOT
0000063a: PUSH1 0x1f
0000063c: DUP3
0000063d: ADD
0000063e: AND
0000063f: DUP3
00000640: ADD
00000641: DUP1
00000642: PUSH1 0x40
00000644: MSTORE
00000645: POP
00000646: DUP2
00000647: ADD
00000648: SWAP1
00000649: PUSH2 0x0652
0000064c: SWAP2
0000064d: SWAP1
0000064e: PUSH2 0x0c7c
00000651: JUMP
00000652: JUMPDEST
00000653: POP
00000654: POP
00000655: POP
00000656: POP
00000657: JUMP
00000658: JUMPDEST
00000659: PUSH1 0x01
0000065b: SLOAD
0000065c: PUSH1 0x01
0000065e: PUSH1 0x01
00000660: PUSH1 0xa0
00000662: SHL
00000663: SUB
00000664: AND
00000665: CALLER
00000666: EQ
00000667: PUSH2 0x0682
0000066a: JUMPI
0000066b: PUSH1 0x40
0000066d: MLOAD
0000066e: PUSH3 0x461bcd
00000672: PUSH1 0xe5
00000674: SHL
00000675: DUP2
00000676: MSTORE
00000677: PUSH1 0x04
00000679: ADD
0000067a: PUSH2 0x0150
0000067d: SWAP1
0000067e: PUSH2 0x0d16
00000681: JUMP
00000682: JUMPDEST
00000683: PUSH1 0x00
00000685: DUP1
00000686: SLOAD
00000687: PUSH1 0x01
00000689: PUSH1 0x01
0000068b: PUSH1 0xa0
0000068d: SHL
0000068e: SUB
0000068f: NOT
00000690: AND
00000691: PUSH1 0x01
00000693: PUSH1 0x01
00000695: PUSH1 0xa0
00000697: SHL
00000698: SUB
00000699: SWAP3
0000069a: SWAP1
0000069b: SWAP3
0000069c: AND
0000069d: SWAP2
0000069e: SWAP1
0000069f: SWAP2
000006a0: OR
000006a1: SWAP1
000006a2: SSTORE
000006a3: JUMP
000006a4: JUMPDEST
000006a5: PUSH1 0x01
000006a7: SLOAD
000006a8: PUSH1 0x01
000006aa: PUSH1 0x01
000006ac: PUSH1 0xa0
000006ae: SHL
000006af: SUB
000006b0: AND
000006b1: CALLER
000006b2: EQ
000006b3: PUSH2 0x06ce
000006b6: JUMPI
000006b7: PUSH1 0x40
000006b9: MLOAD
000006ba: PUSH3 0x461bcd
000006be: PUSH1 0xe5
000006c0: SHL
000006c1: DUP2
000006c2: MSTORE
000006c3: PUSH1 0x04
000006c5: ADD
000006c6: PUSH2 0x0150
000006c9: SWAP1
000006ca: PUSH2 0x0d16
000006cd: JUMP
000006ce: JUMPDEST
000006cf: PUSH1 0x04
000006d1: SLOAD
000006d2: PUSH1 0x40
000006d4: MLOAD
000006d5: PUSH1 0x01
000006d7: PUSH1 0x01
000006d9: PUSH1 0xa0
000006db: SHL
000006dc: SUB
000006dd: DUP5
000006de: AND
000006df: SWAP2
000006e0: SWAP1
000006e1: DUP4
000006e2: SWAP1
000006e3: PUSH1 0x00
000006e5: DUP2
000006e6: DUP2
000006e7: DUP2
000006e8: DUP6
000006e9: DUP9
000006ea: DUP9
000006eb: CALL
000006ec: SWAP4
000006ed: POP
000006ee: POP
000006ef: POP
000006f0: POP
000006f1: RETURNDATASIZE
000006f2: DUP1
000006f3: PUSH1 0x00
000006f5: DUP2
000006f6: EQ
000006f7: PUSH2 0x071c
000006fa: JUMPI
000006fb: PUSH1 0x40
000006fd: MLOAD
000006fe: SWAP2
000006ff: POP
00000700: PUSH1 0x1f
00000702: NOT
00000703: PUSH1 0x3f
00000705: RETURNDATASIZE
00000706: ADD
00000707: AND
00000708: DUP3
00000709: ADD
0000070a: PUSH1 0x40
0000070c: MSTORE
0000070d: RETURNDATASIZE
0000070e: DUP3
0000070f: MSTORE
00000710: RETURNDATASIZE
00000711: PUSH1 0x00
00000713: PUSH1 0x20
00000715: DUP5
00000716: ADD
00000717: RETURNDATACOPY
00000718: PUSH2 0x0721
0000071b: JUMP
0000071c: JUMPDEST
0000071d: PUSH1 0x60
0000071f: SWAP2
00000720: POP
00000721: JUMPDEST
00000722: POP
00000723: POP
00000724: POP
00000725: POP
00000726: POP
00000727: JUMP
00000728: JUMPDEST
00000729: PUSH1 0x01
0000072b: SLOAD
0000072c: PUSH1 0x01
0000072e: PUSH1 0x01
00000730: PUSH1 0xa0
00000732: SHL
00000733: SUB
00000734: AND
00000735: CALLER
00000736: EQ
00000737: PUSH2 0x0752
0000073a: JUMPI
0000073b: PUSH1 0x40
0000073d: MLOAD
0000073e: PUSH3 0x461bcd
00000742: PUSH1 0xe5
00000744: SHL
00000745: DUP2
00000746: MSTORE
00000747: PUSH1 0x04
00000749: ADD
0000074a: PUSH2 0x0150
0000074d: SWAP1
0000074e: PUSH2 0x0d16
00000751: JUMP
00000752: JUMPDEST
00000753: PUSH1 0x04
00000755: SSTORE
00000756: JUMP
00000757: JUMPDEST
00000758: PUSH1 0x01
0000075a: SLOAD
0000075b: PUSH1 0x01
0000075d: PUSH1 0x01
0000075f: PUSH1 0xa0
00000761: SHL
00000762: SUB
00000763: AND
00000764: CALLER
00000765: EQ
00000766: PUSH2 0x0781
00000769: JUMPI
0000076a: PUSH1 0x40
0000076c: MLOAD
0000076d: PUSH3 0x461bcd
00000771: PUSH1 0xe5
00000773: SHL
00000774: DUP2
00000775: MSTORE
00000776: PUSH1 0x04
00000778: ADD
00000779: PUSH2 0x0150
0000077c: SWAP1
0000077d: PUSH2 0x0d16
00000780: JUMP
00000781: JUMPDEST
00000782: DUP1
00000783: MLOAD
00000784: PUSH1 0x00
00000786: JUMPDEST
00000787: DUP2
00000788: DUP2
00000789: LT
0000078a: ISZERO
0000078b: PUSH2 0x0516
0000078e: JUMPI
0000078f: PUSH1 0x00
00000791: DUP4
00000792: DUP3
00000793: DUP2
00000794: MLOAD
00000795: DUP2
00000796: LT
00000797: PUSH2 0x07a2
0000079a: JUMPI
0000079b: PUSH2 0x07a2
0000079e: PUSH2 0x0e0d
000007a1: JUMP
000007a2: JUMPDEST
000007a3: PUSH1 0x20
000007a5: SWAP1
000007a6: DUP2
000007a7: MUL
000007a8: SWAP2
000007a9: SWAP1
000007aa: SWAP2
000007ab: ADD
000007ac: DUP2
000007ad: ADD
000007ae: MLOAD
000007af: PUSH1 0x01
000007b1: PUSH1 0x01
000007b3: PUSH1 0xa0
000007b5: SHL
000007b6: SUB
000007b7: AND
000007b8: PUSH1 0x00
000007ba: SWAP1
000007bb: DUP2
000007bc: MSTORE
000007bd: PUSH1 0x02
000007bf: SWAP1
000007c0: SWAP2
000007c1: MSTORE
000007c2: PUSH1 0x40
000007c4: DUP2
000007c5: KECCAK256
000007c6: SSTORE
000007c7: POP
000007c8: DUP1
000007c9: PUSH2 0x07d1
000007cc: DUP2
000007cd: PUSH2 0x0de4
000007d0: JUMP
000007d1: JUMPDEST
000007d2: SWAP2
000007d3: POP
000007d4: POP
000007d5: PUSH2 0x0786
000007d8: JUMP
000007d9: JUMPDEST
000007da: PUSH1 0x01
000007dc: SLOAD
000007dd: PUSH1 0x01
000007df: PUSH1 0x01
000007e1: PUSH1 0xa0
000007e3: SHL
000007e4: SUB
000007e5: AND
000007e6: CALLER
000007e7: EQ
000007e8: PUSH2 0x0803
000007eb: JUMPI
000007ec: PUSH1 0x40
000007ee: MLOAD
000007ef: PUSH3 0x461bcd
000007f3: PUSH1 0xe5
000007f5: SHL
000007f6: DUP2
000007f7: MSTORE
000007f8: PUSH1 0x04
000007fa: ADD
000007fb: PUSH2 0x0150
000007fe: SWAP1
000007ff: PUSH2 0x0d16
00000802: JUMP
00000803: JUMPDEST
00000804: DUP1
00000805: MLOAD
00000806: PUSH1 0x00
00000808: JUMPDEST
00000809: DUP2
0000080a: DUP2
0000080b: LT
0000080c: ISZERO
0000080d: PUSH2 0x0516
00000810: JUMPI
00000811: PUSH1 0x00
00000813: DUP4
00000814: DUP3
00000815: DUP2
00000816: MLOAD
00000817: DUP2
00000818: LT
00000819: PUSH2 0x0824
0000081c: JUMPI
0000081d: PUSH2 0x0824
00000820: PUSH2 0x0e0d
00000823: JUMP
00000824: JUMPDEST
00000825: PUSH1 0x20
00000827: MUL
00000828: PUSH1 0x20
0000082a: ADD
0000082b: ADD
0000082c: MLOAD
0000082d: SWAP1
0000082e: POP
0000082f: PUSH1 0x00
00000831: DUP2
00000832: PUSH1 0x00
00000834: ADD
00000835: MLOAD
00000836: SWAP1
00000837: POP
00000838: PUSH2 0x084a
0000083b: DUP2
0000083c: DUP4
0000083d: PUSH1 0x20
0000083f: ADD
00000840: MLOAD
00000841: DUP5
00000842: PUSH1 0x40
00000844: ADD
00000845: MLOAD
00000846: PUSH2 0x08f0
00000849: JUMP
0000084a: JUMPDEST
0000084b: POP
0000084c: POP
0000084d: DUP1
0000084e: DUP1
0000084f: PUSH2 0x0857
00000852: SWAP1
00000853: PUSH2 0x0de4
00000856: JUMP
00000857: JUMPDEST
00000858: SWAP2
00000859: POP
0000085a: POP
0000085b: PUSH2 0x0808
0000085e: JUMP
0000085f: JUMPDEST
00000860: PUSH1 0x01
00000862: SLOAD
00000863: PUSH1 0x01
00000865: PUSH1 0x01
00000867: PUSH1 0xa0
00000869: SHL
0000086a: SUB
0000086b: AND
0000086c: CALLER
0000086d: EQ
0000086e: PUSH2 0x0889
00000871: JUMPI
00000872: PUSH1 0x40
00000874: MLOAD
00000875: PUSH3 0x461bcd
00000879: PUSH1 0xe5
0000087b: SHL
0000087c: DUP2
0000087d: MSTORE
0000087e: PUSH1 0x04
00000880: ADD
00000881: PUSH2 0x0150
00000884: SWAP1
00000885: PUSH2 0x0d16
00000888: JUMP
00000889: JUMPDEST
0000088a: DUP3
0000088b: PUSH2 0x0652
0000088e: DUP2
0000088f: DUP5
00000890: DUP5
00000891: PUSH2 0x08f0
00000894: JUMP
00000895: JUMPDEST
00000896: PUSH1 0x01
00000898: SLOAD
00000899: PUSH1 0x01
0000089b: PUSH1 0x01
0000089d: PUSH1 0xa0
0000089f: SHL
000008a0: SUB
000008a1: AND
000008a2: CALLER
000008a3: EQ
000008a4: PUSH2 0x08bf
000008a7: JUMPI
000008a8: PUSH1 0x40
000008aa: MLOAD
000008ab: PUSH3 0x461bcd
000008af: PUSH1 0xe5
000008b1: SHL
000008b2: DUP2
000008b3: MSTORE
000008b4: PUSH1 0x04
000008b6: ADD
000008b7: PUSH2 0x0150
000008ba: SWAP1
000008bb: PUSH2 0x0d16
000008be: JUMP
000008bf: JUMPDEST
000008c0: PUSH1 0x40
000008c2: MLOAD
000008c3: CALLER
000008c4: SWAP1
000008c5: DUP3
000008c6: ISZERO
000008c7: PUSH2 0x08fc
000008ca: MUL
000008cb: SWAP1
000008cc: DUP4
000008cd: SWAP1
000008ce: PUSH1 0x00
000008d0: DUP2
000008d1: DUP2
000008d2: DUP2
000008d3: DUP6
000008d4: DUP9
000008d5: DUP9
000008d6: CALL
000008d7: SWAP4
000008d8: POP
000008d9: POP
000008da: POP
000008db: POP
000008dc: ISZERO
000008dd: DUP1
000008de: ISZERO
000008df: PUSH2 0x08ec
000008e2: JUMPI
000008e3: RETURNDATASIZE
000008e4: PUSH1 0x00
000008e6: DUP1
000008e7: RETURNDATACOPY
000008e8: RETURNDATASIZE
000008e9: PUSH1 0x00
000008eb: REVERT
000008ec: JUMPDEST
000008ed: POP
000008ee: POP
000008ef: JUMP
000008f0: JUMPDEST
000008f1: PUSH1 0x40
000008f3: DUP1
000008f4: MLOAD
000008f5: PUSH1 0x01
000008f7: PUSH1 0x01
000008f9: PUSH1 0xa0
000008fb: SHL
000008fc: SUB
000008fd: DUP5
000008fe: AND
000008ff: PUSH1 0x24
00000901: DUP3
00000902: ADD
00000903: MSTORE
00000904: PUSH1 0x44
00000906: DUP1
00000907: DUP3
00000908: ADD
00000909: DUP5
0000090a: SWAP1
0000090b: MSTORE
0000090c: DUP3
0000090d: MLOAD
0000090e: DUP1
0000090f: DUP4
00000910: SUB
00000911: SWAP1
00000912: SWAP2
00000913: ADD
00000914: DUP2
00000915: MSTORE
00000916: PUSH1 0x64
00000918: SWAP1
00000919: SWAP2
0000091a: ADD
0000091b: DUP3
0000091c: MSTORE
0000091d: PUSH1 0x20
0000091f: DUP1
00000920: DUP3
00000921: ADD
00000922: DUP1
00000923: MLOAD
00000924: PUSH1 0x01
00000926: PUSH1 0x01
00000928: PUSH1 0xe0
0000092a: SHL
0000092b: SUB
0000092c: AND
0000092d: PUSH4 0x095ea7b3
00000932: PUSH1 0xe0
00000934: SHL
00000935: OR
00000936: SWAP1
00000937: MSTORE
00000938: DUP3
00000939: MLOAD
0000093a: SWAP1
0000093b: DUP2
0000093c: ADD
0000093d: SWAP1
0000093e: SWAP3
0000093f: MSTORE
00000940: PUSH1 0x00
00000942: DUP1
00000943: DUP4
00000944: MSTORE
00000945: PUSH2 0x0516
00000948: SWAP3
00000949: DUP7
0000094a: SWAP3
0000094b: SWAP2
0000094c: SWAP1
0000094d: PUSH2 0x0959
00000950: SWAP1
00000951: DUP5
00000952: SWAP1
00000953: DUP5
00000954: SWAP1
00000955: PUSH2 0x0980
00000958: JUMP
00000959: JUMPDEST
0000095a: DUP1
0000095b: MLOAD
0000095c: SWAP1
0000095d: SWAP2
0000095e: POP
0000095f: ISZERO
00000960: PUSH2 0x0516
00000963: JUMPI
00000964: DUP1
00000965: DUP1
00000966: PUSH1 0x20
00000968: ADD
00000969: SWAP1
0000096a: MLOAD
0000096b: DUP2
0000096c: ADD
0000096d: SWAP1
0000096e: PUSH2 0x0977
00000971: SWAP2
00000972: SWAP1
00000973: PUSH2 0x0c7c
00000976: JUMP
00000977: JUMPDEST
00000978: PUSH2 0x0516
0000097b: JUMPI
0000097c: PUSH1 0x00
0000097e: DUP1
0000097f: REVERT
00000980: JUMPDEST
00000981: PUSH1 0x60
00000983: PUSH2 0x098f
00000986: DUP5
00000987: DUP5
00000988: PUSH1 0x00
0000098a: DUP6
0000098b: PUSH2 0x0997
0000098e: JUMP
0000098f: JUMPDEST
00000990: SWAP5
00000991: SWAP4
00000992: POP
00000993: POP
00000994: POP
00000995: POP
00000996: JUMP
00000997: JUMPDEST
00000998: PUSH1 0x60
0000099a: DUP3
0000099b: SELFBALANCE
0000099c: LT
0000099d: ISZERO
0000099e: PUSH2 0x09a6
000009a1: JUMPI
000009a2: PUSH1 0x00
000009a4: DUP1
000009a5: REVERT
000009a6: JUMPDEST
000009a7: DUP5
000009a8: EXTCODESIZE
000009a9: PUSH2 0x09b1
000009ac: JUMPI
000009ad: PUSH1 0x00
000009af: DUP1
000009b0: REVERT
000009b1: JUMPDEST
000009b2: PUSH1 0x00
000009b4: DUP1
000009b5: DUP7
000009b6: PUSH1 0x01
000009b8: PUSH1 0x01
000009ba: PUSH1 0xa0
000009bc: SHL
000009bd: SUB
000009be: AND
000009bf: DUP6
000009c0: DUP8
000009c1: PUSH1 0x40
000009c3: MLOAD
000009c4: PUSH2 0x09cd
000009c7: SWAP2
000009c8: SWAP1
000009c9: PUSH2 0x0cc7
000009cc: JUMP
000009cd: JUMPDEST
000009ce: PUSH1 0x00
000009d0: PUSH1 0x40
000009d2: MLOAD
000009d3: DUP1
000009d4: DUP4
000009d5: SUB
000009d6: DUP2
000009d7: DUP6
000009d8: DUP8
000009d9: GAS
000009da: CALL
000009db: SWAP3
000009dc: POP
000009dd: POP
000009de: POP
000009df: RETURNDATASIZE
000009e0: DUP1
000009e1: PUSH1 0x00
000009e3: DUP2
000009e4: EQ
000009e5: PUSH2 0x0a0a
000009e8: JUMPI
000009e9: PUSH1 0x40
000009eb: MLOAD
000009ec: SWAP2
000009ed: POP
000009ee: PUSH1 0x1f
000009f0: NOT
000009f1: PUSH1 0x3f
000009f3: RETURNDATASIZE
000009f4: ADD
000009f5: AND
000009f6: DUP3
000009f7: ADD
000009f8: PUSH1 0x40
000009fa: MSTORE
000009fb: RETURNDATASIZE
000009fc: DUP3
000009fd: MSTORE
000009fe: RETURNDATASIZE
000009ff: PUSH1 0x00
00000a01: PUSH1 0x20
00000a03: DUP5
00000a04: ADD
00000a05: RETURNDATACOPY
00000a06: PUSH2 0x0a0f
00000a09: JUMP
00000a0a: JUMPDEST
00000a0b: PUSH1 0x60
00000a0d: SWAP2
00000a0e: POP
00000a0f: JUMPDEST
00000a10: POP
00000a11: SWAP2
00000a12: POP
00000a13: SWAP2
00000a14: POP
00000a15: PUSH2 0x0a1f
00000a18: DUP3
00000a19: DUP3
00000a1a: DUP7
00000a1b: PUSH2 0x0a2a
00000a1e: JUMP
00000a1f: JUMPDEST
00000a20: SWAP8
00000a21: SWAP7
00000a22: POP
00000a23: POP
00000a24: POP
00000a25: POP
00000a26: POP
00000a27: POP
00000a28: POP
00000a29: JUMP
00000a2a: JUMPDEST
00000a2b: PUSH1 0x60
00000a2d: DUP4
00000a2e: PUSH2 0x0a5b
00000a31: JUMPI
00000a32: DUP3
00000a33: MLOAD
00000a34: ISZERO
00000a35: PUSH2 0x0a41
00000a38: JUMPI
00000a39: DUP3
00000a3a: MLOAD
00000a3b: DUP1
00000a3c: DUP5
00000a3d: PUSH1 0x20
00000a3f: ADD
00000a40: REVERT
00000a41: JUMPDEST
00000a42: DUP2
00000a43: PUSH1 0x40
00000a45: MLOAD
00000a46: PUSH3 0x461bcd
00000a4a: PUSH1 0xe5
00000a4c: SHL
00000a4d: DUP2
00000a4e: MSTORE
00000a4f: PUSH1 0x04
00000a51: ADD
00000a52: PUSH2 0x0150
00000a55: SWAP2
00000a56: SWAP1
00000a57: PUSH2 0x0ce3
00000a5a: JUMP
00000a5b: JUMPDEST
00000a5c: POP
00000a5d: SWAP1
00000a5e: SWAP3
00000a5f: SWAP2
00000a60: POP
00000a61: POP
00000a62: JUMP
00000a63: JUMPDEST
00000a64: DUP1
00000a65: CALLDATALOAD
00000a66: PUSH1 0x01
00000a68: PUSH1 0x01
00000a6a: PUSH1 0xa0
00000a6c: SHL
00000a6d: SUB
00000a6e: DUP2
00000a6f: AND
00000a70: DUP2
00000a71: EQ
00000a72: PUSH2 0x0a7a
00000a75: JUMPI
00000a76: PUSH1 0x00
00000a78: DUP1
00000a79: REVERT
00000a7a: JUMPDEST
00000a7b: SWAP2
00000a7c: SWAP1
00000a7d: POP
00000a7e: JUMP
00000a7f: JUMPDEST
00000a80: PUSH1 0x00
00000a82: PUSH1 0x20
00000a84: DUP3
00000a85: DUP5
00000a86: SUB
00000a87: SLT
00000a88: ISZERO
00000a89: PUSH2 0x0a91
00000a8c: JUMPI
00000a8d: PUSH1 0x00
00000a8f: DUP1
00000a90: REVERT
00000a91: JUMPDEST
00000a92: PUSH2 0x0a9a
00000a95: DUP3
00000a96: PUSH2 0x0a63
00000a99: JUMP
00000a9a: JUMPDEST
00000a9b: SWAP4
00000a9c: SWAP3
00000a9d: POP
00000a9e: POP
00000a9f: POP
00000aa0: JUMP
00000aa1: JUMPDEST
00000aa2: PUSH1 0x00
00000aa4: DUP1
00000aa5: PUSH1 0x00
00000aa7: PUSH1 0x60
00000aa9: DUP5
00000aaa: DUP7
00000aab: SUB
00000aac: SLT
00000aad: ISZERO
00000aae: PUSH2 0x0ab6
00000ab1: JUMPI
00000ab2: PUSH1 0x00
00000ab4: DUP1
00000ab5: REVERT
00000ab6: JUMPDEST
00000ab7: PUSH2 0x0abf
00000aba: DUP5
00000abb: PUSH2 0x0a63
00000abe: JUMP
00000abf: JUMPDEST
00000ac0: SWAP3
00000ac1: POP
00000ac2: PUSH2 0x0acd
00000ac5: PUSH1 0x20
00000ac7: DUP6
00000ac8: ADD
00000ac9: PUSH2 0x0a63
00000acc: JUMP
00000acd: JUMPDEST
00000ace: SWAP2
00000acf: POP
00000ad0: PUSH1 0x40
00000ad2: DUP5
00000ad3: ADD
00000ad4: CALLDATALOAD
00000ad5: SWAP1
00000ad6: POP
00000ad7: SWAP3
00000ad8: POP
00000ad9: SWAP3
00000ada: POP
00000adb: SWAP3
00000adc: JUMP
00000add: JUMPDEST
00000ade: PUSH1 0x00
00000ae0: DUP1
00000ae1: PUSH1 0x40
00000ae3: DUP4
00000ae4: DUP6
00000ae5: SUB
00000ae6: SLT
00000ae7: ISZERO
00000ae8: PUSH2 0x0af0
00000aeb: JUMPI
00000aec: PUSH1 0x00
00000aee: DUP1
00000aef: REVERT
00000af0: JUMPDEST
00000af1: PUSH2 0x0af9
00000af4: DUP4
00000af5: PUSH2 0x0a63
00000af8: JUMP
00000af9: JUMPDEST
00000afa: SWAP5
00000afb: PUSH1 0x20
00000afd: SWAP4
00000afe: SWAP1
00000aff: SWAP4
00000b00: ADD
00000b01: CALLDATALOAD
00000b02: SWAP4
00000b03: POP
00000b04: POP
00000b05: POP
00000b06: JUMP
00000b07: JUMPDEST
00000b08: PUSH1 0x00
00000b0a: PUSH1 0x20
00000b0c: DUP1
00000b0d: DUP4
00000b0e: DUP6
00000b0f: SUB
00000b10: SLT
00000b11: ISZERO
00000b12: PUSH2 0x0b1a
00000b15: JUMPI
00000b16: PUSH1 0x00
00000b18: DUP1
00000b19: REVERT
00000b1a: JUMPDEST
00000b1b: DUP3
00000b1c: CALLDATALOAD
00000b1d: PUSH8 0xffffffffffffffff
00000b26: DUP2
00000b27: GT
00000b28: ISZERO
00000b29: PUSH2 0x0b31
00000b2c: JUMPI
00000b2d: PUSH1 0x00
00000b2f: DUP1
00000b30: REVERT
00000b31: JUMPDEST
00000b32: DUP4
00000b33: ADD
00000b34: PUSH1 0x1f
00000b36: DUP2
00000b37: ADD
00000b38: DUP6
00000b39: SGT
00000b3a: PUSH2 0x0b42
00000b3d: JUMPI
00000b3e: PUSH1 0x00
00000b40: DUP1
00000b41: REVERT
00000b42: JUMPDEST
00000b43: DUP1
00000b44: CALLDATALOAD
00000b45: PUSH2 0x0b55
00000b48: PUSH2 0x0b50
00000b4b: DUP3
00000b4c: PUSH2 0x0d94
00000b4f: JUMP
00000b50: JUMPDEST
00000b51: PUSH2 0x0d63
00000b54: JUMP
00000b55: JUMPDEST
00000b56: DUP1
00000b57: DUP3
00000b58: DUP3
00000b59: MSTORE
00000b5a: DUP5
00000b5b: DUP3
00000b5c: ADD
00000b5d: SWAP2
00000b5e: POP
00000b5f: DUP5
00000b60: DUP5
00000b61: ADD
00000b62: DUP9
00000b63: DUP7
00000b64: DUP6
00000b65: PUSH1 0x05
00000b67: SHL
00000b68: DUP8
00000b69: ADD
00000b6a: ADD
00000b6b: GT
00000b6c: ISZERO
00000b6d: PUSH2 0x0b75
00000b70: JUMPI
00000b71: PUSH1 0x00
00000b73: DUP1
00000b74: REVERT
00000b75: JUMPDEST
00000b76: PUSH1 0x00
00000b78: SWAP5
00000b79: POP
00000b7a: JUMPDEST
00000b7b: DUP4
00000b7c: DUP6
00000b7d: LT
00000b7e: ISZERO
00000b7f: PUSH2 0x0b9f
00000b82: JUMPI
00000b83: PUSH2 0x0b8b
00000b86: DUP2
00000b87: PUSH2 0x0a63
00000b8a: JUMP
00000b8b: JUMPDEST
00000b8c: DUP4
00000b8d: MSTORE
00000b8e: PUSH1 0x01
00000b90: SWAP5
00000b91: SWAP1
00000b92: SWAP5
00000b93: ADD
00000b94: SWAP4
00000b95: SWAP2
00000b96: DUP6
00000b97: ADD
00000b98: SWAP2
00000b99: DUP6
00000b9a: ADD
00000b9b: PUSH2 0x0b7a
00000b9e: JUMP
00000b9f: JUMPDEST
00000ba0: POP
00000ba1: SWAP8
00000ba2: SWAP7
00000ba3: POP
00000ba4: POP
00000ba5: POP
00000ba6: POP
00000ba7: POP
00000ba8: POP
00000ba9: POP
00000baa: JUMP
00000bab: JUMPDEST
00000bac: PUSH1 0x00
00000bae: PUSH1 0x20
00000bb0: DUP1
00000bb1: DUP4
00000bb2: DUP6
00000bb3: SUB
00000bb4: SLT
00000bb5: ISZERO
00000bb6: PUSH2 0x0bbe
00000bb9: JUMPI
00000bba: PUSH1 0x00
00000bbc: DUP1
00000bbd: REVERT
00000bbe: JUMPDEST
00000bbf: DUP3
00000bc0: CALLDATALOAD
00000bc1: PUSH8 0xffffffffffffffff
00000bca: DUP2
00000bcb: GT
00000bcc: ISZERO
00000bcd: PUSH2 0x0bd5
00000bd0: JUMPI
00000bd1: PUSH1 0x00
00000bd3: DUP1
00000bd4: REVERT
00000bd5: JUMPDEST
00000bd6: DUP4
00000bd7: ADD
00000bd8: PUSH1 0x1f
00000bda: DUP2
00000bdb: ADD
00000bdc: DUP6
00000bdd: SGT
00000bde: PUSH2 0x0be6
00000be1: JUMPI
00000be2: PUSH1 0x00
00000be4: DUP1
00000be5: REVERT
00000be6: JUMPDEST
00000be7: DUP1
00000be8: CALLDATALOAD
00000be9: PUSH2 0x0bf4
00000bec: PUSH2 0x0b50
00000bef: DUP3
00000bf0: PUSH2 0x0d94
00000bf3: JUMP
00000bf4: JUMPDEST
00000bf5: DUP2
00000bf6: DUP2
00000bf7: MSTORE
00000bf8: DUP4
00000bf9: DUP2
00000bfa: ADD
00000bfb: SWAP1
00000bfc: DUP4
00000bfd: DUP6
00000bfe: ADD
00000bff: PUSH1 0x60
00000c01: DUP1
00000c02: DUP6
00000c03: MUL
00000c04: DUP7
00000c05: ADD
00000c06: DUP8
00000c07: ADD
00000c08: DUP11
00000c09: LT
00000c0a: ISZERO
00000c0b: PUSH2 0x0c13
00000c0e: JUMPI
00000c0f: PUSH1 0x00
00000c11: DUP1
00000c12: REVERT
00000c13: JUMPDEST
00000c14: PUSH1 0x00
00000c16: SWAP6
00000c17: POP
00000c18: DUP6
00000c19: JUMPDEST
00000c1a: DUP6
00000c1b: DUP2
00000c1c: LT
00000c1d: ISZERO
00000c1e: PUSH2 0x0c6d
00000c21: JUMPI
00000c22: DUP2
00000c23: DUP4
00000c24: DUP13
00000c25: SUB
00000c26: SLT
00000c27: ISZERO
00000c28: PUSH2 0x0c2f
00000c2b: JUMPI
00000c2c: DUP7
00000c2d: DUP8
00000c2e: REVERT
00000c2f: JUMPDEST
00000c30: PUSH2 0x0c37
00000c33: PUSH2 0x0d3a
00000c36: JUMP
00000c37: JUMPDEST
00000c38: PUSH2 0x0c40
00000c3b: DUP5
00000c3c: PUSH2 0x0a63
00000c3f: JUMP
00000c40: JUMPDEST
00000c41: DUP2
00000c42: MSTORE
00000c43: PUSH2 0x0c4d
00000c46: DUP10
00000c47: DUP6
00000c48: ADD
00000c49: PUSH2 0x0a63
00000c4c: JUMP
00000c4d: JUMPDEST
00000c4e: DUP2
00000c4f: DUP11
00000c50: ADD
00000c51: MSTORE
00000c52: PUSH1 0x40
00000c54: DUP5
00000c55: DUP2
00000c56: ADD
00000c57: CALLDATALOAD
00000c58: SWAP1
00000c59: DUP3
00000c5a: ADD
00000c5b: MSTORE
00000c5c: DUP6
00000c5d: MSTORE
00000c5e: SWAP4
00000c5f: DUP8
00000c60: ADD
00000c61: SWAP4
00000c62: SWAP2
00000c63: DUP2
00000c64: ADD
00000c65: SWAP2
00000c66: PUSH1 0x01
00000c68: ADD
00000c69: PUSH2 0x0c19
00000c6c: JUMP
00000c6d: JUMPDEST
00000c6e: POP
00000c6f: SWAP2
00000c70: SWAP10
00000c71: SWAP9
00000c72: POP
00000c73: POP
00000c74: POP
00000c75: POP
00000c76: POP
00000c77: POP
00000c78: POP
00000c79: POP
00000c7a: POP
00000c7b: JUMP
00000c7c: JUMPDEST
00000c7d: PUSH1 0x00
00000c7f: PUSH1 0x20
00000c81: DUP3
00000c82: DUP5
00000c83: SUB
00000c84: SLT
00000c85: ISZERO
00000c86: PUSH2 0x0c8e
00000c89: JUMPI
00000c8a: PUSH1 0x00
00000c8c: DUP1
00000c8d: REVERT
00000c8e: JUMPDEST
00000c8f: DUP2
00000c90: MLOAD
00000c91: DUP1
00000c92: ISZERO
00000c93: ISZERO
00000c94: DUP2
00000c95: EQ
00000c96: PUSH2 0x0a9a
00000c99: JUMPI
00000c9a: PUSH1 0x00
00000c9c: DUP1
00000c9d: REVERT
00000c9e: JUMPDEST
00000c9f: PUSH1 0x00
00000ca1: PUSH1 0x20
00000ca3: DUP3
00000ca4: DUP5
00000ca5: SUB
00000ca6: SLT
00000ca7: ISZERO
00000ca8: PUSH2 0x0cb0
00000cab: JUMPI
00000cac: PUSH1 0x00
00000cae: DUP1
00000caf: REVERT
00000cb0: JUMPDEST
00000cb1: POP
00000cb2: CALLDATALOAD
00000cb3: SWAP2
00000cb4: SWAP1
00000cb5: POP
00000cb6: JUMP
00000cb7: JUMPDEST
00000cb8: DUP2
00000cb9: DUP4
00000cba: DUP3
00000cbb: CALLDATACOPY
00000cbc: PUSH1 0x00
00000cbe: SWAP2
00000cbf: ADD
00000cc0: SWAP1
00000cc1: DUP2
00000cc2: MSTORE
00000cc3: SWAP2
00000cc4: SWAP1
00000cc5: POP
00000cc6: JUMP
00000cc7: JUMPDEST
00000cc8: PUSH1 0x00
00000cca: DUP3
00000ccb: MLOAD
00000ccc: PUSH2 0x0cd9
00000ccf: DUP2
00000cd0: DUP5
00000cd1: PUSH1 0x20
00000cd3: DUP8
00000cd4: ADD
00000cd5: PUSH2 0x0db8
00000cd8: JUMP
00000cd9: JUMPDEST
00000cda: SWAP2
00000cdb: SWAP1
00000cdc: SWAP2
00000cdd: ADD
00000cde: SWAP3
00000cdf: SWAP2
00000ce0: POP
00000ce1: POP
00000ce2: JUMP
00000ce3: JUMPDEST
00000ce4: PUSH1 0x20
00000ce6: DUP2
00000ce7: MSTORE
00000ce8: PUSH1 0x00
00000cea: DUP3
00000ceb: MLOAD
00000cec: DUP1
00000ced: PUSH1 0x20
00000cef: DUP5
00000cf0: ADD
00000cf1: MSTORE
00000cf2: PUSH2 0x0d02
00000cf5: DUP2
00000cf6: PUSH1 0x40
00000cf8: DUP6
00000cf9: ADD
00000cfa: PUSH1 0x20
00000cfc: DUP8
00000cfd: ADD
00000cfe: PUSH2 0x0db8
00000d01: JUMP
00000d02: JUMPDEST
00000d03: PUSH1 0x1f
00000d05: ADD
00000d06: PUSH1 0x1f
00000d08: NOT
00000d09: AND
00000d0a: SWAP2
00000d0b: SWAP1
00000d0c: SWAP2
00000d0d: ADD
00000d0e: PUSH1 0x40
00000d10: ADD
00000d11: SWAP3
00000d12: SWAP2
00000d13: POP
00000d14: POP
00000d15: JUMP
00000d16: JUMPDEST
00000d17: PUSH1 0x20
00000d19: DUP1
00000d1a: DUP3
00000d1b: MSTORE
00000d1c: PUSH1 0x0a
00000d1e: SWAP1
00000d1f: DUP3
00000d20: ADD
00000d21: MSTORE
00000d22: PUSH10 0x2337b93134b23232b717
00000d2d: PUSH1 0xb1
00000d2f: SHL
00000d30: PUSH1 0x40
00000d32: DUP3
00000d33: ADD
00000d34: MSTORE
00000d35: PUSH1 0x60
00000d37: ADD
00000d38: SWAP1
00000d39: JUMP
00000d3a: JUMPDEST
00000d3b: PUSH1 0x40
00000d3d: MLOAD
00000d3e: PUSH1 0x60
00000d40: DUP2
00000d41: ADD
00000d42: PUSH8 0xffffffffffffffff
00000d4b: DUP2
00000d4c: GT
00000d4d: DUP3
00000d4e: DUP3
00000d4f: LT
00000d50: OR
00000d51: ISZERO
00000d52: PUSH2 0x0d5d
00000d55: JUMPI
00000d56: PUSH2 0x0d5d
00000d59: PUSH2 0x0e23
00000d5c: JUMP
00000d5d: JUMPDEST
00000d5e: PUSH1 0x40
00000d60: MSTORE
00000d61: SWAP1
00000d62: JUMP
00000d63: JUMPDEST
00000d64: PUSH1 0x40
00000d66: MLOAD
00000d67: PUSH1 0x1f
00000d69: DUP3
00000d6a: ADD
00000d6b: PUSH1 0x1f
00000d6d: NOT
00000d6e: AND
00000d6f: DUP2
00000d70: ADD
00000d71: PUSH8 0xffffffffffffffff
00000d7a: DUP2
00000d7b: GT
00000d7c: DUP3
00000d7d: DUP3
00000d7e: LT
00000d7f: OR
00000d80: ISZERO
00000d81: PUSH2 0x0d8c
00000d84: JUMPI
00000d85: PUSH2 0x0d8c
00000d88: PUSH2 0x0e23
00000d8b: JUMP
00000d8c: JUMPDEST
00000d8d: PUSH1 0x40
00000d8f: MSTORE
00000d90: SWAP2
00000d91: SWAP1
00000d92: POP
00000d93: JUMP
00000d94: JUMPDEST
00000d95: PUSH1 0x00
00000d97: PUSH8 0xffffffffffffffff
00000da0: DUP3
00000da1: GT
00000da2: ISZERO
00000da3: PUSH2 0x0dae
00000da6: JUMPI
00000da7: PUSH2 0x0dae
00000daa: PUSH2 0x0e23
00000dad: JUMP
00000dae: JUMPDEST
00000daf: POP
00000db0: PUSH1 0x05
00000db2: SHL
00000db3: PUSH1 0x20
00000db5: ADD
00000db6: SWAP1
00000db7: JUMP
00000db8: JUMPDEST
00000db9: PUSH1 0x00
00000dbb: JUMPDEST
00000dbc: DUP4
00000dbd: DUP2
00000dbe: LT
00000dbf: ISZERO
00000dc0: PUSH2 0x0dd3
00000dc3: JUMPI
00000dc4: DUP2
00000dc5: DUP2
00000dc6: ADD
00000dc7: MLOAD
00000dc8: DUP4
00000dc9: DUP3
00000dca: ADD
00000dcb: MSTORE
00000dcc: PUSH1 0x20
00000dce: ADD
00000dcf: PUSH2 0x0dbb
00000dd2: JUMP
00000dd3: JUMPDEST
00000dd4: DUP4
00000dd5: DUP2
00000dd6: GT
00000dd7: ISZERO
00000dd8: PUSH2 0x0652
00000ddb: JUMPI
00000ddc: POP
00000ddd: POP
00000dde: PUSH1 0x00
00000de0: SWAP2
00000de1: ADD
00000de2: MSTORE
00000de3: JUMP
00000de4: JUMPDEST
00000de5: PUSH1 0x00
00000de7: PUSH1 0x00
00000de9: NOT
00000dea: DUP3
00000deb: EQ
00000dec: ISZERO
00000ded: PUSH2 0x0e06
00000df0: JUMPI
00000df1: PUSH4 0x4e487b71
00000df6: PUSH1 0xe0
00000df8: SHL
00000df9: PUSH1 0x00
00000dfb: MSTORE
00000dfc: PUSH1 0x11
00000dfe: PUSH1 0x04
00000e00: MSTORE
00000e01: PUSH1 0x24
00000e03: PUSH1 0x00
00000e05: REVERT
00000e06: JUMPDEST
00000e07: POP
00000e08: PUSH1 0x01
00000e0a: ADD
00000e0b: SWAP1
00000e0c: JUMP
00000e0d: JUMPDEST
00000e0e: PUSH4 0x4e487b71
00000e13: PUSH1 0xe0
00000e15: SHL
00000e16: PUSH1 0x00
00000e18: MSTORE
00000e19: PUSH1 0x32
00000e1b: PUSH1 0x04
00000e1d: MSTORE
00000e1e: PUSH1 0x24
00000e20: PUSH1 0x00
00000e22: REVERT
00000e23: JUMPDEST
00000e24: PUSH4 0x4e487b71
00000e29: PUSH1 0xe0
00000e2b: SHL
00000e2c: PUSH1 0x00
00000e2e: MSTORE
00000e2f: PUSH1 0x41
00000e31: PUSH1 0x04
00000e33: MSTORE
00000e34: PUSH1 0x24
00000e36: PUSH1 0x00
00000e38: REVERT
00000e39: INVALID
00000e3a: LOG2
00000e3b: PUSH5 0x6970667358
00000e41: UNKNOWN(0x22)
00000e42: SLT
00000e43: KECCAK256
00000e44: UNKNOWN(0xC2)
00000e45: PUSH20 0x9b4fb04b72b8e4f8607b9ba0e9cd622024f8bc73
00000e5a: UNKNOWN(0xD5)
00000e5b: UNKNOWN(0xAE)
00000e5c: LOG4
00000e5d: PUSH25

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
critical upgradeability detector Untrusted DELEGATECALL target reachable 70 no no
view
trace_id: 0x3325434cb15a794ec465fa30e9092dd0edad7648a57cca55b385f38ad1d15646
validation_json
{
    "sink": "DELEGATECALL",
    "errors": 0,
    "status": "unknown",
    "attempts": 168,
    "trace_id": "0x3325434cb15a794ec465fa30e9092dd0edad7648a57cca55b385f38ad1d15646",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0xaa2d4a29",
            "selector": "0xaa2d4a29",
            "calldata_variants": [
                "0xaa2d4a29",
                "0xaa2d4a290000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xd89da49c",
            "selector": "0xd89da49c",
            "calldata_variants": [
                "0xd89da49c",
                "0xd89da49c0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xeded6191",
            "selector": "0xeded6191",
            "calldata_variants": [
                "0xeded6191",
                "0xeded61910000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xefbb98c2",
            "selector": "0xefbb98c2",
            "calldata_variants": [
                "0xefbb98c2",
                "0xefbb98c20000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x802a81d8",
            "selector": "0x802a81d8",
            "calldata_variants": [
                "0x802a81d8",
                "0x802a81d80000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x810d6ce5",
            "selector": "0x810d6ce5",
            "calldata_variants": [
                "0x810d6ce5",
                "0x810d6ce50000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa4358917",
            "selector": "0xa4358917",
            "calldata_variants": [
                "0xa4358917",
                "0xa43589170000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x1fceed7f",
            "selector": "0x1fceed7f",
            "calldata_variants": [
                "0x1fceed7f",
                "0x1fceed7f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 393,
            "opcode": "DELEGATECALL",
            "returndata_checked": null,
            "value_expression_category": "n/a",
            "target_expression_category": "computed"
        }
    ],
    "guards_detected": [],
    "delegatecall_count": 1,
    "untrusted_delegatecall_count": 1
}
high upgradeability codex Computed DELEGATECALL target allows potential arbitrary code execution 85 no
view
evidence_json
{
    "evidence": "Detector reports untrusted DELEGATECALL reachable with computed target and no guards detected; callsite at pc 393.",
    "locations": [
        "pc:0x189"
    ],
    "recommendation": "Make the delegatecall target immutable or only updateable by a strictly controlled admin; validate the target as a contract (e.g., extcodesize > 0). If this is a proxy, use a standard upgrade pattern (EIP-1967/transparent/UUPS) with strong access control and upgrade events.",
    "exploit_scenario": "If an attacker can influence the storage slot or input that feeds the DELEGATECALL target (e.g., via an unprotected setter or storage collision), they can redirect execution to a malicious contract and run arbitrary logic in this contract\u2019s context, draining funds or overwriting state."
}
high other detector Untrusted CALL target/value reachable 60 no no
view
trace_id: 0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be
call_targets: 0x942a70014b6ba71ec84b16e1604fc76b1071eaf9
target_varies: no
classification: constant_target
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x942a70014b6ba71ec84b16e1604fc76b1071eaf9"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0xaa2d4a29",
            "selector": "0xaa2d4a29",
            "calldata_variants": [
                "0xaa2d4a29",
                "0xaa2d4a290000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xd89da49c",
            "selector": "0xd89da49c",
            "calldata_variants": [
                "0xd89da49c",
                "0xd89da49c0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xeded6191",
            "selector": "0xeded6191",
            "calldata_variants": [
                "0xeded6191",
                "0xeded61910000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xefbb98c2",
            "selector": "0xefbb98c2",
            "calldata_variants": [
                "0xefbb98c2",
                "0xefbb98c20000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x802a81d8",
            "selector": "0x802a81d8",
            "calldata_variants": [
                "0x802a81d8",
                "0x802a81d80000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x810d6ce5",
            "selector": "0x810d6ce5",
            "calldata_variants": [
                "0x810d6ce5",
                "0x810d6ce50000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa4358917",
            "selector": "0xa4358917",
            "calldata_variants": [
                "0xa4358917",
                "0xa43589170000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x1fceed7f",
            "selector": "0x1fceed7f",
            "calldata_variants": [
                "0x1fceed7f",
                "0x1fceed7f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 1420,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1565,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1771,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 5,
    "guards_detected": [],
    "untrusted_call_count": 5
}
high other detector ETH value transfer possible 55 no no
view
trace_id: 0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be
call_targets: 0x942a70014b6ba71ec84b16e1604fc76b1071eaf9
target_varies: no
classification: constant_target
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x09fb23653385fd98254a97cabce5c11823f772ddf2835020a41fe36fbe6d19be",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x942a70014b6ba71ec84b16e1604fc76b1071eaf9"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0xaa2d4a29",
            "selector": "0xaa2d4a29",
            "calldata_variants": [
                "0xaa2d4a29",
                "0xaa2d4a290000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xd89da49c",
            "selector": "0xd89da49c",
            "calldata_variants": [
                "0xd89da49c",
                "0xd89da49c0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xeded6191",
            "selector": "0xeded6191",
            "calldata_variants": [
                "0xeded6191",
                "0xeded61910000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xefbb98c2",
            "selector": "0xefbb98c2",
            "calldata_variants": [
                "0xefbb98c2",
                "0xefbb98c20000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x802a81d8",
            "selector": "0x802a81d8",
            "calldata_variants": [
                "0x802a81d8",
                "0x802a81d80000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x810d6ce5",
            "selector": "0x810d6ce5",
            "calldata_variants": [
                "0x810d6ce5",
                "0x810d6ce50000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa4358917",
            "selector": "0xa4358917",
            "calldata_variants": [
                "0xa4358917",
                "0xa43589170000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x1fceed7f",
            "selector": "0x1fceed7f",
            "calldata_variants": [
                "0x1fceed7f",
                "0x1fceed7f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 1420,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1565,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 1771,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 5,
    "guards_detected": []
}
medium access_control codex Potential arbitrary external CALLs with value to computed targets 75 no
view
evidence_json
{
    "evidence": "Five CALL sites marked with computed target/value and no guards detected; validation observed a constant target in one trace but did not prove immutability.",
    "locations": [
        "pc:0x58c",
        "pc:0x61d",
        "pc:0x6eb",
        "pc:0x8d6",
        "pc:0x9da"
    ],
    "recommendation": "Restrict CALL targets/values to an allowlist or privileged role, or hardcode trusted targets per function. If arbitrary calls are intended, enforce strong caller authorization and consider reentrancy protections around state-changing logic.",
    "exploit_scenario": "If calldata or storage can control the target/value at these CALL sites, a caller could trigger transfers to arbitrary addresses or invoke external contracts using the contract\u2019s balance. The validation trace only observed self-calls, so exploitability depends on whether other paths allow variable targets."
}
medium upgradeability cast DELEGATECALL present 80 no
view
evidence_json
{
    "notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
    "delegatecall_count": 1
}