TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

019ba9bd-678e-713e-83c6-d1ece50b7ce0

complete
Chain ID
1
Address
Block Number
Created
Sat, Jan 10, 2026 9:08 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

Confirmed
0
Validated
0
Source
Bytecode only
Review Backing
Present
Best current signal
Untrusted CALL target/value reachable
crit 0 high 0 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
37932 artifact.fetch complete 1 / 3 3 months ago
37933 proxy.resolve complete 1 / 3 3 months ago
37934 tool.cast_disasm complete 1 / 3 3 months ago
37935 analysis.bundle complete 1 / 3 3 months ago
37936 capability.graph complete 1 / 3 3 months ago
37937 detector.run complete 1 / 3 3 months ago
37938 validation.fork complete 1 / 3 3 months ago
38154 report.consolidate complete 1 / 6 3 months ago

Artifact

Runtime bytecode: available
Creation TX:
Deployer:
Proxy: no not_proxy
Implementation:
Verified Source: no
Proxy evidence
{
    "status": "not_proxy"
}

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate
Job Status
complete
Attempts
1 / 6
Findings
1
No findings?
no
Summary
Found 1 low-severity issue: an owner-only function performs arbitrary external CALLs to computed targets with possible ETH value transfer; this is high‑blast‑radius if access control is misconfigured or compromised.
View stdout
{"no_findings":false,"summary":"Found 1 low-severity issue: an owner-only function performs arbitrary external CALLs to computed targets with possible ETH value transfer; this is high‑blast‑radius if access control is misconfigured or compromised.","findings":[{"severity":"low","category":"other","title":"Owner-only function can execute arbitrary external CALLs (computed target/value)","exploit_scenario":"The function reachable via selector 0xfe113801 performs multiple CALLs to addresses masked from stack values (computed targets). If the owner key is compromised, incorrectly initialized, or if access control can be bypassed, an attacker can trigger arbitrary external calls (potentially with ETH value), enabling fund drain or reentrancy into this contract’s logic. If the owner is a contract, reentrancy from the external call path is also possible.","recommendation":"Keep owner management tightly controlled (secure key management and strict ownership transfer). Consider whitelisting allowed call targets or selectors, and add a reentrancy guard around state-mutating paths that surround external CALLs if reentrancy would be unsafe.","evidence":"Bytecode shows owner check at pc:0x0c4e (caller == owner in slot0) before jumping into the main logic. The same function contains CALLs at pc:0x0d8e, pc:0x0e0a, pc:0x0ff7, pc:0x124d with targets derived via address-masking (AND with 0xa0 mask), implying computed targets. Detector findings also flag untrusted CALL target/value and possible ETH value transfer on these callsites.","locations":["selector:0xfe113801","pc:0x0c4e","pc:0x0d8e","pc:0x0e0a","pc:0x0ff7","pc:0x124d"]}]}
View stderr
OpenAI Codex v0.77.0 (research preview)
--------
workdir: /tmp/codex-vzbjg001
model: gpt-5.2-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: auto
session id: 019baa31-a716-7af0-a2b8-0f4438d8720f
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.

Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".

Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
mcp startup: no servers

thinking
**Searching for BYTECODE_BUNDLE.json**
exec
/bin/bash -lc 'rg --files' in /tmp/codex-vzbjg001 succeeded in 11ms:
codex-output-schema.json
BYTECODE_BUNDLE.json
exec
/bin/bash -lc 'cat BYTECODE_BUNDLE.json' in /tmp/codex-vzbjg001 succeeded in 9ms:
{
  "analysis_artifact": {
    "address": "0xe97f36717a51fd61c54f35e8fb2ca49d82c121bd",
    "artifact_hash": "0x61444ac258dffe94ae22f67da582d4cecfef1b560f7e30d98c371346807ad7e6",
    "artifact_json": {
      "auth": {
        "guards": [
          {
            "pc": 2104,
            "type": "msg_sender_eq_const",
            "value": 2.8389620141085504e+47
          },
          {
            "pc": 2631,
            "type": "msg_sender_eq_const",
            "value": 2.8389620141085504e+47
          }
        ]
      },
      "basic_blocks": [

thinking
**Analyzing bytecode for contract calls and access controls**
exec
/bin/bash -lc 'rg -n "selector" BYTECODE_BUNDLE.json | head' in /tmp/codex-vzbjg001 succeeded in 8ms:
7099:      "dispatcher_type": "selector_jump_table",
7103:          "selector": "0xbfe0c27e"
7107:          "selector": "0xcb915663"
7111:          "selector": "0xe5596e0b"
7115:          "selector": "0xf23149c6"
7119:          "selector": "0xfe113801"
7123:          "selector": "0x85a336c5"
7127:          "selector": "0xa281e965"
7131:          "selector": "0xab8cd46c"
7135:          "selector": "0xb23e0aa1"

thinking
**Searching for callsites references**
exec
/bin/bash -lc 'rg -n "callsite|CALL" BYTECODE_BUNDLE.json | head' in /tmp/codex-vzbjg001 succeeded in 8ms:
29:            "CALLDATASIZE",
41:            "CALLDATALOAD",
336:            "CALLDATASIZE",
366:            "CALLVALUE",
393:            "CALLDATASIZE",
420:            "CALLDATALOAD",
463:            "CALLVALUE",
507:            "CALLVALUE",
654:            "CALLVALUE",
681:            "CALLDATASIZE",

thinking
**Parsing callsites with jq**
exec
/bin/bash -lc "jq '.analysis_artifact.artifact_json | {callsites: [.basic_blocks[]? | select(.type==\"callsite\")], functions: [.basic_blocks[]? | select(.type==\"function\")]} | .callsites' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 76ms:
[]

thinking
**Inspecting callsite locations in JSON**
exec
/bin/bash -lc "jq 'keys' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 43ms:
[
  "analysis_artifact",
  "analysis_run",
  "artifact",
  "capability_graph",
  "detector_findings",
  "heuristics_summary"
]

thinking
**Inspecting capability_graph**
exec
/bin/bash -lc "jq 'keys' BYTECODE_BUNDLE.json | .[]' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 exited 2 in 7ms:
/bin/bash: -c: line 1: unexpected EOF while looking for matching `''
/bin/bash: -c: line 2: syntax error: unexpected end of file

thinking
**Inspecting capability_graph**
exec
/bin/bash -lc "jq 'keys' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 34ms:
[
  "analysis_artifact",
  "analysis_run",
  "artifact",
  "capability_graph",
  "detector_findings",
  "heuristics_summary"
]

thinking
**Inspecting capability_graph structure**
exec
/bin/bash -lc "jq '.capability_graph | keys' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 67ms:
[
  "address",
  "block_number",
  "chain_id",
  "codehash",
  "created_at",
  "graph_hash",
  "graph_json",
  "id",
  "updated_at",
  "version"
]

thinking
**Inspecting graph_json nodes**
exec
/bin/bash -lc "jq '.capability_graph.graph_json | keys' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 79ms:
[
  "edges",
  "nodes",
  "version"
]

thinking
**Extracting callsite nodes**
exec
/bin/bash -lc "jq '.capability_graph.graph_json.nodes[] | select(.type==\"callsite\")' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 64ms:
{
  "id": "call:3470",
  "opcode": "CALL",
  "pc": 3470,
  "type": "callsite"
}
{
  "id": "call:3594",
  "opcode": "CALL",
  "pc": 3594,
  "type": "callsite"
}
{
  "id": "call:3834",
  "opcode": "STATICCALL",
  "pc": 3834,
  "type": "callsite"
}
{
  "id": "call:4087",

thinking
**Inspecting edges for callsites**
exec
/bin/bash -lc "jq '.capability_graph.graph_json.edges[] | select(.to==\"call:3470\" or .from==\"call:3470\")' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 51ms:
{
  "from": "bb:3467",
  "to": "call:3470",
  "type": "contains"
}
{
  "from": "call:3470",
  "to": "sink:call",
  "type": "capability"
}

thinking
**Investigating basic block containment**
exec
/bin/bash -lc "jq '.capability_graph.graph_json.edges[] | select(.to==\"bb:3467\" or .from==\"bb:3467\")' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 77ms:
{
  "from": "bb:3390",
  "to": "bb:3467",
  "type": "control_flow"
}
{
  "from": "bb:3467",
  "to": "bb:3487",
  "type": "control_flow"
}
{
  "from": "bb:3467",
  "to": "bb:3478",
  "type": "control_flow_fallthrough"
}
{
  "from": "bb:3467",
  "to": "call:3470",
  "type": "contains"
}

thinking
**Searching edges for basic blocks**
exec
/bin/bash -lc "jq '.capability_graph.graph_json.edges[] | select(.to==\"bb:3467\" and .type==\"contains\")' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 32ms:


thinking
**Examining node for function membership**
exec
/bin/bash -lc "jq '.capability_graph.graph_json.nodes[] | select(.id==\"bb:3467\")' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 40ms:
{
  "end_pc": 3477,
  "hash": "0x89aa220e7723477bd2dbc1b5cd26afe3163b6a5597c1ea168598171ec88980e4",
  "id": "bb:3467",
  "start_pc": 3467,
  "type": "basic_block"
}

thinking
**Examining callsite details in artifact**
exec
/bin/bash -lc "jq '.. | objects | select(.type?==\"callsite\")' BYTECODE_BUNDLE.json | head -n 20" in /tmp/codex-vzbjg001 succeeded in 55ms:
{
  "id": "call:3470",
  "opcode": "CALL",
  "pc": 3470,
  "type": "callsite"
}
{
  "id": "call:3594",
  "opcode": "CALL",
  "pc": 3594,
  "type": "callsite"
}
{
  "id": "call:3834",
  "opcode": "STATICCALL",
  "pc": 3834,
  "type": "callsite"
}
{
  "id": "call:4087",

thinking
**Searching for evidence references**
exec
/bin/bash -lc 'rg -n "evidence" BYTECODE_BUNDLE.json | head' in /tmp/codex-vzbjg001 succeeded in 7ms:
9995:      "proxy_evidence": {
14018:      "evidence_json": {
14081:      "evidence_json": {

thinking
**Inspecting proxy_evidence section**
exec
/bin/bash -lc "sed -n '9970,10040p' BYTECODE_BUNDLE.json" in /tmp/codex-vzbjg001 succeeded in 6ms:
          "created_at": "2026-01-10T21:08:09.000000Z",
          "id": "019ba9bc-ec9b-71e8-b15a-3e13ee1d617b",
          "status": "complete",
          "updated_at": "2026-01-10T22:43:27.000000Z"
        },
        "parent_run_id": "019ba9bc-ec9b-71e8-b15a-3e13ee1d617b",
        "updated_at": "2026-01-10T21:08:40.000000Z"
      }
    ],
    "status": "running",
    "updated_at": "2026-01-10T22:35:07.000000Z"
  },
  "artifact": {
    "codehash": "0xd32ba08ec6389c11583bedf4df92201ac407ec9cb698b009d6bb351a5d3ed7c7",
    "compiler_json": {
      "compiler_version": null,
      "etherscan": {
        "contract_name": null,
        "implementation": null,
        "license": "Unknown",

thinking
**Analyzing runtime bytecode for security issues**

I'm focused on interpreting the smart contract's runtime bytecode to identify potential security concerns like reentrancy, access control, and external calls with value. I plan to write a Python script to disassemble the bytecode and examine call-related opcodes around program counters to aid in spotting risks without network access or advanced decompilers.
exec
/bin/bash -lc "python - <<'PY'
import json
import sys
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bytecode=data['artifact']['runtime_bytecode']['full']
if bytecode.startswith('0x'):
    bytecode=bytecode[2:]
code=unhexlify(bytecode)

# opcode map
opcodes = {i: name for i,name in enumerate([
    'STOP','ADD','MUL','SUB','DIV','SDIV','MOD','SMOD','ADDMOD','MULMOD','EXP','SIGNEXTEND','OP_0c','OP_0d','OP_0e','OP_0f',
    'LT','GT','SLT','SGT','EQ','ISZERO','AND','OR','XOR','NOT','BYTE','SHL','SHR','SAR','OP_1e','OP_1f',
    'SHA3','OP_21','OP_22','OP_23','OP_24','OP_25','OP_26','OP_27','OP_28','OP_29','OP_2a','OP_2b','OP_2c','OP_2d','OP_2e','OP_2f',
    'ADDRESS','BALANCE','ORIGIN','CALLER','CALLVALUE','CALLDATALOAD','CALLDATASIZE','CALLDATACOPY','CODESIZE','CODECOPY','GASPRICE','EXTCODESIZE','EXTCODECOPY','RETURNDATASIZE','RETURNDATACOPY','EXTCODEHASH',
    'BLOCKHASH','COINBASE','TIMESTAMP','NUMBER','DIFFICULTY','GASLIMIT','CHAINID','SELFBALANCE','BASEFEE','OP_48','OP_49','OP_4a','OP_4b','OP_4c','OP_4d','OP_4e','OP_4f',
    'POP','MLOAD','MSTORE','MSTORE8','SLOAD','SSTORE','JUMP','JUMPI','PC','MSIZE','GAS','JUMPDEST',
    'PUSH1','PUSH2','PUSH3','PUSH4','PUSH5','PUSH6','PUSH7','PUSH8','PUSH9','PUSH10','PUSH11','PUSH12','PUSH13','PUSH14','PUSH15','PUSH16',
    'PUSH17','PUSH18','PUSH19','PUSH20','PUSH21','PUSH22','PUSH23','PUSH24','PUSH25','PUSH26','PUSH27','PUSH28','PUSH29','PUSH30','PUSH31','PUSH32',
    'DUP1','DUP2','DUP3','DUP4','DUP5','DUP6','DUP7','DUP8','DUP9','DUP10','DUP11','DUP12','DUP13','DUP14','DUP15','DUP16',
    'SWAP1','SWAP2','SWAP3','SWAP4','SWAP5','SWAP6','SWAP7','SWAP8','SWAP9','SWAP10','SWAP11','SWAP12','SWAP13','SWAP14','SWAP15','SWAP16',
    'LOG0','LOG1','LOG2','LOG3','LOG4',
    'OP_a5','OP_a6','OP_a7','OP_a8','OP_a9','OP_aa','OP_ab','OP_ac','OP_ad','OP_ae','OP_af',
    'OP_b0','OP_b1','OP_b2','OP_b3','OP_b4','OP_b5','OP_b6','OP_b7','OP_b8','OP_b9','OP_ba','OP_bb','OP_bc','OP_bd','OP_be','OP_bf',
    'OP_c0','OP_c1','OP_c2','OP_c3','OP_c4','OP_c5','OP_c6','OP_c7','OP_c8','OP_c9','OP_ca','OP_cb','OP_cc','OP_cd','OP_ce','OP_cf',
    'OP_d0','OP_d1','OP_d2','OP_d3','OP_d4','OP_d5','OP_d6','OP_d7','OP_d8','OP_d9','OP_da','OP_db','OP_dc','OP_dd','OP_de','OP_df',
    'OP_e0','OP_e1','OP_e2','OP_e3','OP_e4','OP_e5','OP_e6','OP_e7','OP_e8','OP_e9','OP_ea','OP_eb','OP_ec','OP_ed','OP_ee','OP_ef',
    'CREATE','CALL','CALLCODE','RETURN','DELEGATECALL','CREATE2','OP_f6','OP_f7','OP_f8','OP_f9','OP_fa','STATICCALL','OP_fc','OP_fd','REVERT','INVALID','SELFDESTRUCT'
])}

# get opcodes with pc
pcs=set([3470,3594,3834,4087,4685,4831])

# disassemble around each pc
index=0
ops=[]
while index < len(code):
    pc=index
    op=code[index]
    name=opcodes.get(op, f'OP_{op:02x}')
    index +=1
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
        ops.append((pc,name,imm.hex()))
    else:
        ops.append((pc,name,None))

# build map pc->idx
pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}

for target in sorted(pcs):
    if target not in pc_index:
        print('pc',target,'not found')
        continue
    i=pc_index[target]
    start=max(0,i-10)
    end=min(len(ops),i+10)
    print('--- around pc',target,'---')
    for pc,name,imm in ops[start:end]:
        if imm is not None:
            print(f'{pc:04d}: {name} 0x{imm}')
        else:
            print(f'{pc:04d}: {name}')

PY" in /tmp/codex-vzbjg001 succeeded in 101ms:
--- around pc 3470 ---
3457: DUP4
3458: ISZERO
3459: PUSH5 0x0d8b
3462: JUMP
3463: PUSH4 0x00
3465: DUP4
3466: SELFDESTRUCT
3467: GAS
3468: OP_4f
3469: MSIZE
3470: DELEGATECALL
3471: ISZERO
3472: DUP4
3473: ISZERO
3474: PUSH5 0x0d9f
3477: JUMP
3478: RETURNDATASIZE
3479: PUSH4 0x00
3481: DUP4

thinking
**Analyzing opcode mapping discrepancies**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bytecode=data['artifact']['runtime_bytecode']['full']
if bytecode.startswith('0x'):
    bytecode=bytecode[2:]
code=unhexlify(bytecode)

opnames = {}
# base opcodes
base = [
    'STOP','ADD','MUL','SUB','DIV','SDIV','MOD','SMOD','ADDMOD','MULMOD','EXP','SIGNEXTEND','OP_0c','OP_0d','OP_0e','OP_0f',
    'LT','GT','SLT','SGT','EQ','ISZERO','AND','OR','XOR','NOT','BYTE','SHL','SHR','SAR','OP_1e','OP_1f',
    'SHA3','OP_21','OP_22','OP_23','OP_24','OP_25','OP_26','OP_27','OP_28','OP_29','OP_2a','OP_2b','OP_2c','OP_2d','OP_2e','OP_2f',
    'ADDRESS','BALANCE','ORIGIN','CALLER','CALLVALUE','CALLDATALOAD','CALLDATASIZE','CALLDATACOPY','CODESIZE','CODECOPY','GASPRICE','EXTCODESIZE','EXTCODECOPY','RETURNDATASIZE','RETURNDATACOPY','EXTCODEHASH',
    'BLOCKHASH','COINBASE','TIMESTAMP','NUMBER','DIFFICULTY','GASLIMIT','CHAINID','SELFBALANCE','BASEFEE','OP_48','OP_49','OP_4a','OP_4b','OP_4c','OP_4d','OP_4e','OP_4f',
    'POP','MLOAD','MSTORE','MSTORE8','SLOAD','SSTORE','JUMP','JUMPI','PC','MSIZE','GAS','JUMPDEST'
]
for i,name in enumerate(base):
    opnames[i]=name

# push
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
# dup
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
# swap
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
# logs
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

# system opcodes
opnames[0xf0]='CREATE'
opnames[0xf1]='CALL'
opnames[0xf2]='CALLCODE'
opnames[0xf3]='RETURN'
opnames[0xf4]='DELEGATECALL'
opnames[0xf5]='CREATE2'
opnames[0xfa]='STATICCALL'
opnames[0xfd]='REVERT'
opnames[0xfe]='INVALID'
opnames[0xff]='SELFDESTRUCT'

pcs=set([3470,3594,3834,4087,4685,4831])

ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
        ops.append((pc,name,imm.hex()))
    else:
        ops.append((pc,name,None))

pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}
for target in sorted(pcs):
    if target not in pc_index:
        print('pc',target,'not found')
        continue
    i=pc_index[target]
    start=max(0,i-12)
    end=min(len(ops),i+12)
    print('--- around pc',target,'---')
    for pc,name,imm in ops[start:end]:
        if imm is not None:
            print(f'{pc:04d}: {name} 0x{imm}')
        else:
            print(f'{pc:04d}: {name}')

PY" in /tmp/codex-vzbjg001 succeeded in 73ms:
--- around pc 3470 ---
3455: EXTCODESIZE
3456: ISZERO
3457: DUP1
3458: ISZERO
3459: PUSH2 0x0d8b
3462: JUMP
3463: PUSH1 0x00
3465: DUP1
3466: REVERT
3467: GAS
3468: OP_4f
3469: MSIZE
3470: CALL
3471: ISZERO
3472: DUP1
3473: ISZERO
3474: PUSH2 0x0d9f
3477: JUMP
3478: RETURNDATASIZE

thinking
**Investigating external call targets**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)

bytecode=data['artifact']['runtime_bytecode']['full']
if bytecode.startswith('0x'):
    bytecode=bytecode[2:]
code=unhexlify(bytecode)

opnames = {}
base = [
    'STOP','ADD','MUL','SUB','DIV','SDIV','MOD','SMOD','ADDMOD','MULMOD','EXP','SIGNEXTEND','OP_0c','OP_0d','OP_0e','OP_0f',
    'LT','GT','SLT','SGT','EQ','ISZERO','AND','OR','XOR','NOT','BYTE','SHL','SHR','SAR','OP_1e','OP_1f',
    'SHA3','OP_21','OP_22','OP_23','OP_24','OP_25','OP_26','OP_27','OP_28','OP_29','OP_2a','OP_2b','OP_2c','OP_2d','OP_2e','OP_2f',
    'ADDRESS','BALANCE','ORIGIN','CALLER','CALLVALUE','CALLDATALOAD','CALLDATASIZE','CALLDATACOPY','CODESIZE','CODECOPY','GASPRICE','EXTCODESIZE','EXTCODECOPY','RETURNDATASIZE','RETURNDATACOPY','EXTCODEHASH',
    'BLOCKHASH','COINBASE','TIMESTAMP','NUMBER','DIFFICULTY','GASLIMIT','CHAINID','SELFBALANCE','BASEFEE','OP_48','OP_49','OP_4a','OP_4b','OP_4c','OP_4d','OP_4e','OP_4f',
    'POP','MLOAD','MSTORE','MSTORE8','SLOAD','SSTORE','JUMP','JUMPI','PC','MSIZE','GAS','JUMPDEST'
]
for i,name in enumerate(base):
    opnames[i]=name
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

opnames[0xf0]='CREATE'
opnames[0xf1]='CALL'
opnames[0xf2]='CALLCODE'
opnames[0xf3]='RETURN'
opnames[0xf4]='DELEGATECALL'
opnames[0xf5]='CREATE2'
opnames[0xfa]='STATICCALL'
opnames[0xfd]='REVERT'
opnames[0xfe]='INVALID'
opnames[0xff]='SELFDESTRUCT'

# disassemble
ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
        ops.append((pc,name,imm.hex()))
    else:
        ops.append((pc,name,None))

pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}

call_pcs=[3470,3594,4087,4685]
for target in call_pcs:
    i=pc_index[target]
    start=max(0,i-50)
    end=min(len(ops),i+10)
    print('=== call at pc',target,'===')
    for pc,name,imm in ops[start:end]:
        if imm is not None:
            print(f'{pc:04d}: {name} 0x{imm}')
        else:
            print(f'{pc:04d}: {name}')
    print()

PY" in /tmp/codex-vzbjg001 succeeded in 59ms:
=== call at pc 3470 ===
3406: PUSH1 0x04
3408: DUP3
3409: ADD
3410: MLOAD
3411: SWAP1
3412: POP
3413: SWAP2
3414: SWAP3
3415: OP_4f
3416: PUSH1 0x00
3418: SWAP2
3419: PUSH1 0x01
3421: PUSH1 0x01
3423: PUSH1 0xa0
3425: SHL
3426: SUB
3427: DUP5
3428: AND
3429: SWAP2

thinking
**Analyzing external calls and storage usage**

I'm examining bytecode calls with specific function selectors and their call targets, suspecting some originate from untrusted calldata addresses. I'm also noting storage operations before calls that might act as reentrancy guards or state updates. To assess admin functions, I plan to convert a large decimal constant (auth guard) into a hex address for better insight.
exec
/bin/bash -lc "python - <<'PY'
value = int(2.8389620141085504e+47)
print(hex(value))
PY" in /tmp/codex-vzbjg001 succeeded in 22ms:
0x31ba589072278e00000000000000000000000000

thinking
**Analyzing bytecode for access control and risks**

I'm parsing the bytecode to identify admin address constants and their usage as msg.sender guards, to spot which functions require admin rights. I’m also trying to map function selectors to entry points from the dispatch table in the runtime bytecode. Meanwhile, I’m probing external calls for potential reentrancy risks, value transfers, and untrusted targets by examining stack operations and call arguments. The presence of an undefined opcode (0x4f) in the disassembly is puzzling, so I’ll validate the opcode mapping carefully to ensure accurate analysis.
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)
for pc in [3460,3464,3468,3470,3472,3474]:
    print(pc, hex(code[pc]))
PY" in /tmp/codex-vzbjg001 succeeded in 29ms:
3460 0xd
3464 0x0
3468 0x50
3470 0xf1
3472 0x80
3474 0x61

thinking
**Analyzing opcode and program counter mismatch**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify
with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {}
base = [
    'STOP','ADD','MUL','SUB','DIV','SDIV','MOD','SMOD','ADDMOD','MULMOD','EXP','SIGNEXTEND','OP_0c','OP_0d','OP_0e','OP_0f',
    'LT','GT','SLT','SGT','EQ','ISZERO','AND','OR','XOR','NOT','BYTE','SHL','SHR','SAR','OP_1e','OP_1f',
    'SHA3','OP_21','OP_22','OP_23','OP_24','OP_25','OP_26','OP_27','OP_28','OP_29','OP_2a','OP_2b','OP_2c','OP_2d','OP_2e','OP_2f',
    'ADDRESS','BALANCE','ORIGIN','CALLER','CALLVALUE','CALLDATALOAD','CALLDATASIZE','CALLDATACOPY','CODESIZE','CODECOPY','GASPRICE','EXTCODESIZE','EXTCODECOPY','RETURNDATASIZE','RETURNDATACOPY','EXTCODEHASH',
    'BLOCKHASH','COINBASE','TIMESTAMP','NUMBER','DIFFICULTY','GASLIMIT','CHAINID','SELFBALANCE','BASEFEE','OP_48','OP_49','OP_4a','OP_4b','OP_4c','OP_4d','OP_4e','OP_4f',
    'POP','MLOAD','MSTORE','MSTORE8','SLOAD','SSTORE','JUMP','JUMPI','PC','MSIZE','GAS','JUMPDEST'
]
for i,name in enumerate(base):
    opnames[i]=name
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

opnames[0xf0]='CREATE'
opnames[0xf1]='CALL'
opnames[0xf2]='CALLCODE'
opnames[0xf3]='RETURN'
opnames[0xf4]='DELEGATECALL'
opnames[0xf5]='CREATE2'
opnames[0xfa]='STATICCALL'
opnames[0xfd]='REVERT'
opnames[0xfe]='INVALID'
opnames[0xff]='SELFDESTRUCT'

for pc in range(3464,3472):
    op=code[pc]
    print(pc, hex(op), opnames.get(op))
PY" in /tmp/codex-vzbjg001 succeeded in 27ms:
3464 0x0 STOP
3465 0x80 DUP1
3466 0xfd REVERT
3467 0x5b GAS
3468 0x50 OP_4f
3469 0x5a MSIZE
3470 0xf1 CALL
3471 0x15 ISZERO

thinking
**Analyzing opcode mapping discrepancy**
exec
/bin/bash -lc "python - <<'PY'
base = [
    'STOP','ADD','MUL','SUB','DIV','SDIV','MOD','SMOD','ADDMOD','MULMOD','EXP','SIGNEXTEND','OP_0c','OP_0d','OP_0e','OP_0f',
    'LT','GT','SLT','SGT','EQ','ISZERO','AND','OR','XOR','NOT','BYTE','SHL','SHR','SAR','OP_1e','OP_1f',
    'SHA3','OP_21','OP_22','OP_23','OP_24','OP_25','OP_26','OP_27','OP_28','OP_29','OP_2a','OP_2b','OP_2c','OP_2d','OP_2e','OP_2f',
    'ADDRESS','BALANCE','ORIGIN','CALLER','CALLVALUE','CALLDATALOAD','CALLDATASIZE','CALLDATACOPY','CODESIZE','CODECOPY','GASPRICE','EXTCODESIZE','EXTCODECOPY','RETURNDATASIZE','RETURNDATACOPY','EXTCODEHASH',
    'BLOCKHASH','COINBASE','TIMESTAMP','NUMBER','DIFFICULTY','GASLIMIT','CHAINID','SELFBALANCE','BASEFEE','OP_48','OP_49','OP_4a','OP_4b','OP_4c','OP_4d','OP_4e','OP_4f',
    'POP','MLOAD','MSTORE','MSTORE8','SLOAD','SSTORE','JUMP','JUMPI','PC','MSIZE','GAS','JUMPDEST'
]
print('len',len(base))
print('index of POP', base.index('POP'))
print('item at 0x50', base[0x50])
print('item at 0x4f', base[0x4f])
PY" in /tmp/codex-vzbjg001 succeeded in 62ms:
len 93
index of POP 81
item at 0x50 OP_4f
item at 0x4f OP_4e

thinking
**Adjusting opcode mapping alignment**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
# add PUSH, DUP, SWAP, LOG
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

# disassemble
ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
        ops.append((pc,name,imm.hex()))
    else:
        ops.append((pc,name,None))

pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}

for target in [3470]:
    i=pc_index[target]
    start=max(0,i-6)
    end=min(len(ops),i+6)
    for pc,name,imm in ops[start:end]:
        if imm:
            print(f'{pc}: {name} 0x{imm}')
        else:
            print(f'{pc}: {name}')

PY" in /tmp/codex-vzbjg001 succeeded in 44ms:
3463: PUSH1 0x00
3465: DUP1
3466: REVERT
3467: JUMPDEST
3468: POP
3469: GAS
3470: CALL
3471: ISZERO
3472: DUP1
3473: ISZERO
3474: PUSH2 0x0d9f
3477: JUMPI

thinking
**Revalidating disassembly with corrected mapping**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
        ops.append((pc,name,imm.hex()))
    else:
        ops.append((pc,name,None))

pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}

call_pcs=[3470,3594,4087,4685]
for target in call_pcs:
    i=pc_index[target]
    start=max(0,i-50)
    end=min(len(ops),i+12)
    print('=== call at pc',target,'===')
    for pc,name,imm in ops[start:end]:
        if imm is not None:
            print(f'{pc:04d}: {name} 0x{imm}')
        else:
            print(f'{pc:04d}: {name}')
    print()

PY" in /tmp/codex-vzbjg001 succeeded in 70ms:
=== call at pc 3470 ===
3406: PUSH1 0x04
3408: DUP3
3409: ADD
3410: MSTORE
3411: SWAP1
3412: MLOAD
3413: SWAP2
3414: SWAP3
3415: POP
3416: PUSH1 0x00
3418: SWAP2
3419: PUSH1 0x01
3421: PUSH1 0x01
3423: PUSH1 0xa0
3425: SHL
3426: SUB
3427: DUP5
3428: AND
3429: SWAP2

thinking
**Analyzing untrusted calls and admin guards**

I'm working through complex bytecode to map untrusted external calls by their selectors and targets, aiming to identify which functions these calls belong to and whether admin-only guards protect them. I plan to parse the dispatcher code to associate function selectors with entry points and approximate function ranges to check if calls fall under admin restrictions. I'll write a script to extract selector-to-entry mappings by recognizing bytecode patterns for dispatch jumps. This should help gauge the risk levels more accurately.
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

# disassemble
ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    imm=None
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
    ops.append((pc,name,imm))

# find selector dispatch patterns
selectors={}
for i in range(len(ops)-3):
    pc,name,imm=ops[i]
    if name=='PUSH4':
        sel=imm.hex()
        # pattern: PUSH4 sel, EQ, PUSH2 dest, JUMPI
        n1=ops[i+1][1]
        n2=ops[i+2][1]
        n3=ops[i+3][1]
        if n1=='EQ' and n2=='PUSH2' and n3=='JUMPI':
            dest=int.from_bytes(ops[i+2][2], 'big')
            selectors['0x'+sel]=dest

# print selectors sorted by dest
for sel,dest in sorted(selectors.items(), key=lambda x:x[1]):
    print(sel, hex(dest))
PY" in /tmp/codex-vzbjg001 succeeded in 31ms:
0x0707a945 0x119
0x0c08bf88 0x15f
0x0d13e1a1 0x176
0x102b198d 0x1ed
0x2e1a7d4d 0x225
0x61985506 0x263
0x6ff7c94e 0x2ac
0x763bf7dc 0x2ec
0x7d61bf99 0x32b
0x85a336c5 0x340
0xa281e965 0x370
0xab8cd46c 0x385
0xb23e0aa1 0x3b8
0xbfe0c27e 0x3eb
0xcb915663 0x41c
0xe5596e0b 0x431
0xf23149c6 0x446
0xfe113801 0x45b

thinking
**Mapping call PCs to functions**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    imm=None
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
    ops.append((pc,name,imm))

# gather selector->dest
def parse_dispatch(ops):
    selectors={}
    for i in range(len(ops)-3):
        pc,name,imm=ops[i]
        if name=='PUSH4':
            sel='0x'+imm.hex()
            if ops[i+1][1]=='EQ' and ops[i+2][1]=='PUSH2' and ops[i+3][1]=='JUMPI':
                dest=int.from_bytes(ops[i+2][2], 'big')
                selectors[dest]=sel
    return selectors

selectors=parse_dispatch(ops)
entries=sorted(selectors.keys())

call_pcs=[3470,3594,4087,4685,3834,4831]
for pc in call_pcs:
    entry=None
    for e in entries:
        if e<=pc:
            entry=e
        else:
            break
    sel=selectors.get(entry)
    print(pc, 'in function entry', hex(entry) if entry is not None else None, sel)

PY" in /tmp/codex-vzbjg001 succeeded in 51ms:
3470 in function entry 0x45b 0xfe113801
3594 in function entry 0x45b 0xfe113801
4087 in function entry 0x45b 0xfe113801
4685 in function entry 0x45b 0xfe113801
3834 in function entry 0x45b 0xfe113801
4831 in function entry 0x45b 0xfe113801

thinking
**Analyzing main function calls**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

# disassemble
def disasm(code):
    ops=[]
    index=0
    while index < len(code):
        pc=index
        op=code[index]
        name=opnames.get(op, f'OP_{op:02x}')
        index +=1
        imm=None
        if 0x60 <= op <= 0x7f:
            n=op-0x5f
            imm=code[index:index+n]
            index += n
        ops.append((pc,name,imm))
    return ops

ops=disasm(code)
pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}
entry=0x45b
start=pc_index[entry]
end=min(len(ops), start+200)
for pc,name,imm in ops[start:end]:
    if imm is not None:
        print(f'{pc:04d}: {name} 0x{imm.hex()}')
    else:
        print(f'{pc:04d}: {name}')
PY" in /tmp/codex-vzbjg001 succeeded in 40ms:
1115: JUMPDEST
1116: CALLVALUE
1117: DUP1
1118: ISZERO
1119: PUSH2 0x0467
1122: JUMPI
1123: PUSH1 0x00
1125: DUP1
1126: REVERT
1127: JUMPDEST
1128: POP
1129: PUSH2 0x0174
1132: PUSH1 0x04
1134: DUP1
1135: CALLDATASIZE
1136: SUB
1137: PUSH1 0x80
1139: DUP2
1140: LT
1141: ISZERO

thinking
**Analyzing admin-only external call risks**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

# find ORIGIN opcode 0x32
pcs=[i for i,b in enumerate(code) if b==0x32]
print('ORIGIN pcs', pcs[:20], 'count', len(pcs))
PY" in /tmp/codex-vzbjg001 succeeded in 41ms:
ORIGIN pcs [3738, 5398] count 2

thinking
**Investigating ORIGIN usage points**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

# disassemble
ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    imm=None
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
    ops.append((pc,name,imm))

pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}
for target in [3738,5398]:
    print('--- around',target,'---')
    i=pc_index[target]
    for pc,name,imm in ops[i-10:i+10]:
        if imm:
            print(f'{pc:04d}: {name} 0x{imm.hex()}')
        else:
            print(f'{pc:04d}: {name}')
    print()
PY" in /tmp/codex-vzbjg001 exited 1 in 39ms:
--- around 3738 ---
Traceback (most recent call last):
  File "<stdin>", line 47, in <module>
KeyError: 3738

thinking
**Verifying opcode locations**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    imm=None
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
    ops.append((pc,name,imm))

origin_pcs=[pc for pc,name,_ in ops if name=='ORIGIN']
print('origin pcs', origin_pcs)

# print context
for target in origin_pcs:
    i=[j for j,(pc,_,_) in enumerate(ops) if pc==target][0]
    print('--- around',target,'---')
    for pc,name,imm in ops[i-8:i+8]:
        if imm:
            print(f'{pc:04d}: {name} 0x{imm.hex()}')
        else:
            print(f'{pc:04d}: {name}')

PY" in /tmp/codex-vzbjg001 succeeded in 75ms:
origin pcs []

thinking
**Analyzing function entry and access checks**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

# disassemble
ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    imm=None
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
    ops.append((pc,name,imm))

pc_index={pc:i for i,(pc,_,_) in enumerate(ops)}
start_pc=0x0c4e
start=pc_index[start_pc]
end=start+200
for pc,name,imm in ops[start:end]:
    if imm:
        print(f'{pc:04d}: {name} 0x{imm.hex()}')
    else:
        print(f'{pc:04d}: {name}')
PY" in /tmp/codex-vzbjg001 succeeded in 63ms:
3150: JUMPDEST
3151: PUSH1 0x00
3153: SLOAD
3154: PUSH3 0x010000
3158: SWAP1
3159: DIV
3160: PUSH1 0x01
3162: PUSH1 0x01
3164: PUSH1 0xa0
3166: SHL
3167: SUB
3168: AND
3169: CALLER
3170: EQ
3171: PUSH2 0x0cb3
3174: JUMPI
3175: PUSH1 0x40
3177: DUP1
3178: MLOAD
3179: PUSH3 0x461bcd

thinking
**Analyzing owner access control and storage slot 0 writes**
exec
/bin/bash -lc "python - <<'PY'
import json
from binascii import unhexlify

with open('BYTECODE_BUNDLE.json') as f:
    data=json.load(f)
code=data['artifact']['runtime_bytecode']['full']
if code.startswith('0x'):
    code=code[2:]
code=unhexlify(code)

opnames = {
    0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
    0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
    0x20:'SHA3',
    0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
    0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
    0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
    0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
}
for i in range(1,33):
    opnames[0x5f+i]=f'PUSH{i}'
for i in range(1,17):
    opnames[0x7f+i]=f'DUP{i}'
for i in range(1,17):
    opnames[0x8f+i]=f'SWAP{i}'
for i in range(5):
    opnames[0xa0+i]=f'LOG{i}'

# disassemble
ops=[]
index=0
while index < len(code):
    pc=index
    op=code[index]
    name=opnames.get(op, f'OP_{op:02x}')
    index +=1
    imm=None
    if 0x60 <= op <= 0x7f:
        n=op-0x5f
        imm=code[index:index+n]
        index += n
    ops.append((pc,name,imm))

# find SSTORE and print previous instruction
for i,(pc,name,imm) in enumerate(ops):
    if name=='SSTORE':
        prev = ops[i-1] if i>0 else None
        print('SSTORE at', pc, 'prev', prev)
PY" in /tmp/codex-vzbjg001 succeeded in 37ms:
SSTORE at 1337 prev (1336, 'ADD', None)
SSTORE at 1679 prev (1678, 'SWAP1', None)
SSTORE at 1760 prev (1759, 'SWAP1', None)
SSTORE at 1777 prev (1776, 'SWAP1', None)
SSTORE at 2825 prev (2823, 'PUSH1', b'\x03')
SSTORE at 3892 prev (3890, 'PUSH1', b'\x03')
SSTORE at 4047 prev (4046, 'ADD', None)
SSTORE at 4179 prev (4178, 'SWAP1', None)
SSTORE at 4232 prev (4231, 'SWAP1', None)
SSTORE at 4287 prev (4286, 'SWAP1', None)

thinking
**Analyzing owner-only external calls and reentrancy risks**

There is a possible low-severity issue regarding an owner-only function that executes arbitrary external CALLs with computed targets and possible ETH transfers, presenting reentrancy and fund loss risks if the owner key is compromised or access control misconfigured. I’m gathering detailed evidence from call sites and access control checks to create a precise JSON findings summary highlighting this and recommending strict access control, reentrancy guards, and target whitelisting.
codex
{"no_findings":false,"summary":"Found 1 low-severity issue: an owner-only function performs arbitrary external CALLs to computed targets with possible ETH value transfer; this is high‑blast‑radius if access control is misconfigured or compromised.","findings":[{"severity":"low","category":"other","title":"Owner-only function can execute arbitrary external CALLs (computed target/value)","exploit_scenario":"The function reachable via selector 0xfe113801 performs multiple CALLs to addresses masked from stack values (computed targets). If the owner key is compromised, incorrectly initialized, or if access control can be bypassed, an attacker can trigger arbitrary external calls (potentially with ETH value), enabling fund drain or reentrancy into this contract’s logic. If the owner is a contract, reentrancy from the external call path is also possible.","recommendation":"Keep owner management tightly controlled (secure key management and strict ownership transfer). Consider whitelisting allowed call targets or selectors, and add a reentrancy guard around state-mutating paths that surround external CALLs if reentrancy would be unsafe.","evidence":"Bytecode shows owner check at pc:0x0c4e (caller == owner in slot0) before jumping into the main logic. The same function contains CALLs at pc:0x0d8e, pc:0x0e0a, pc:0x0ff7, pc:0x124d with targets derived via address-masking (AND with 0xa0 mask), implying computed targets. Detector findings also flag untrusted CALL target/value and possible ETH value transfer on these callsites.","locations":["selector:0xfe113801","pc:0x0c4e","pc:0x0d8e","pc:0x0e0a","pc:0x0ff7","pc:0x124d"]}]}
tokens used
415,756
Metadata
{
    "codex": {
        "ran_at": "2026-01-10T23:24:43.967224+00:00",
        "returncode": 0
    },
    "project": {
        "mode": "bytecode",
        "bytecode_length": 10844,
        "bytecode_truncated": false,
        "capability_graph_present": true,
        "analysis_artifact_present": true
    },
    "summary": "Found 1 low-severity issue: an owner-only function performs arbitrary external CALLs to computed targets with possible ETH value transfer; this is high\u2011blast\u2011radius if access control is misconfigured or compromised.",
    "raw_final": {
        "summary": "Found 1 low-severity issue: an owner-only function performs arbitrary external CALLs to computed targets with possible ETH value transfer; this is high\u2011blast\u2011radius if access control is misconfigured or compromised.",
        "findings": [
            {
                "title": "Owner-only function can execute arbitrary external CALLs (computed target/value)",
                "category": "other",
                "evidence": "Bytecode shows owner check at pc:0x0c4e (caller == owner in slot0) before jumping into the main logic. The same function contains CALLs at pc:0x0d8e, pc:0x0e0a, pc:0x0ff7, pc:0x124d with targets derived via address-masking (AND with 0xa0 mask), implying computed targets. Detector findings also flag untrusted CALL target/value and possible ETH value transfer on these callsites.",
                "severity": "low",
                "locations": [
                    "selector:0xfe113801",
                    "pc:0x0c4e",
                    "pc:0x0d8e",
                    "pc:0x0e0a",
                    "pc:0x0ff7",
                    "pc:0x124d"
                ],
                "recommendation": "Keep owner management tightly controlled (secure key management and strict ownership transfer). Consider whitelisting allowed call targets or selectors, and add a reentrancy guard around state-mutating paths that surround external CALLs if reentrancy would be unsafe.",
                "exploit_scenario": "The function reachable via selector 0xfe113801 performs multiple CALLs to addresses masked from stack values (computed targets). If the owner key is compromised, incorrectly initialized, or if access control can be bypassed, an attacker can trigger arbitrary external calls (potentially with ETH value), enabling fund drain or reentrancy into this contract\u2019s logic. If the owner is a contract, reentrancy from the external call path is also possible."
            }
        ],
        "no_findings": false
    },
    "no_findings": false,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
0
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
6
EXT*/BALANCE
6
Total opcodes
3325
Flags
heavy_ext_balance_usage
View cast disassembly output
00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x010d
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x85a336c5
00000019: GT
0000001a: PUSH2 0x0095
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0xbfe0c27e
00000024: GT
00000025: PUSH2 0x0064
00000028: JUMPI
00000029: DUP1
0000002a: PUSH4 0xbfe0c27e
0000002f: EQ
00000030: PUSH2 0x03eb
00000033: JUMPI
00000034: DUP1
00000035: PUSH4 0xcb915663
0000003a: EQ
0000003b: PUSH2 0x041c
0000003e: JUMPI
0000003f: DUP1
00000040: PUSH4 0xe5596e0b
00000045: EQ
00000046: PUSH2 0x0431
00000049: JUMPI
0000004a: DUP1
0000004b: PUSH4 0xf23149c6
00000050: EQ
00000051: PUSH2 0x0446
00000054: JUMPI
00000055: DUP1
00000056: PUSH4 0xfe113801
0000005b: EQ
0000005c: PUSH2 0x045b
0000005f: JUMPI
00000060: PUSH2 0x0114
00000063: JUMP
00000064: JUMPDEST
00000065: DUP1
00000066: PUSH4 0x85a336c5
0000006b: EQ
0000006c: PUSH2 0x0340
0000006f: JUMPI
00000070: DUP1
00000071: PUSH4 0xa281e965
00000076: EQ
00000077: PUSH2 0x0370
0000007a: JUMPI
0000007b: DUP1
0000007c: PUSH4 0xab8cd46c
00000081: EQ
00000082: PUSH2 0x0385
00000085: JUMPI
00000086: DUP1
00000087: PUSH4 0xb23e0aa1
0000008c: EQ
0000008d: PUSH2 0x03b8
00000090: JUMPI
00000091: PUSH2 0x0114
00000094: JUMP
00000095: JUMPDEST
00000096: DUP1
00000097: PUSH4 0x2e1a7d4d
0000009c: GT
0000009d: PUSH2 0x00dc
000000a0: JUMPI
000000a1: DUP1
000000a2: PUSH4 0x2e1a7d4d
000000a7: EQ
000000a8: PUSH2 0x0225
000000ab: JUMPI
000000ac: DUP1
000000ad: PUSH4 0x61985506
000000b2: EQ
000000b3: PUSH2 0x0263
000000b6: JUMPI
000000b7: DUP1
000000b8: PUSH4 0x6ff7c94e
000000bd: EQ
000000be: PUSH2 0x02ac
000000c1: JUMPI
000000c2: DUP1
000000c3: PUSH4 0x763bf7dc
000000c8: EQ
000000c9: PUSH2 0x02ec
000000cc: JUMPI
000000cd: DUP1
000000ce: PUSH4 0x7d61bf99
000000d3: EQ
000000d4: PUSH2 0x032b
000000d7: JUMPI
000000d8: PUSH2 0x0114
000000db: JUMP
000000dc: JUMPDEST
000000dd: DUP1
000000de: PUSH4 0x0707a945
000000e3: EQ
000000e4: PUSH2 0x0119
000000e7: JUMPI
000000e8: DUP1
000000e9: PUSH4 0x0c08bf88
000000ee: EQ
000000ef: PUSH2 0x015f
000000f2: JUMPI
000000f3: DUP1
000000f4: PUSH4 0x0d13e1a1
000000f9: EQ
000000fa: PUSH2 0x0176
000000fd: JUMPI
000000fe: DUP1
000000ff: PUSH4 0x102b198d
00000104: EQ
00000105: PUSH2 0x01ed
00000108: JUMPI
00000109: PUSH2 0x0114
0000010c: JUMP
0000010d: JUMPDEST
0000010e: CALLDATASIZE
0000010f: PUSH2 0x0114
00000112: JUMPI
00000113: STOP
00000114: JUMPDEST
00000115: PUSH1 0x00
00000117: DUP1
00000118: REVERT
00000119: JUMPDEST
0000011a: CALLVALUE
0000011b: DUP1
0000011c: ISZERO
0000011d: PUSH2 0x0125
00000120: JUMPI
00000121: PUSH1 0x00
00000123: DUP1
00000124: REVERT
00000125: JUMPDEST
00000126: POP
00000127: PUSH2 0x0146
0000012a: PUSH1 0x04
0000012c: DUP1
0000012d: CALLDATASIZE
0000012e: SUB
0000012f: PUSH1 0x20
00000131: DUP2
00000132: LT
00000133: ISZERO
00000134: PUSH2 0x013c
00000137: JUMPI
00000138: PUSH1 0x00
0000013a: DUP1
0000013b: REVERT
0000013c: JUMPDEST
0000013d: POP
0000013e: CALLDATALOAD
0000013f: PUSH1 0xff
00000141: AND
00000142: PUSH2 0x0484
00000145: JUMP
00000146: JUMPDEST
00000147: PUSH1 0x40
00000149: DUP1
0000014a: MLOAD
0000014b: SWAP3
0000014c: DUP4
0000014d: MSTORE
0000014e: PUSH1 0x20
00000150: DUP4
00000151: ADD
00000152: SWAP2
00000153: SWAP1
00000154: SWAP2
00000155: MSTORE
00000156: DUP1
00000157: MLOAD
00000158: SWAP2
00000159: DUP3
0000015a: SWAP1
0000015b: SUB
0000015c: ADD
0000015d: SWAP1
0000015e: RETURN
0000015f: JUMPDEST
00000160: CALLVALUE
00000161: DUP1
00000162: ISZERO
00000163: PUSH2 0x016b
00000166: JUMPI
00000167: PUSH1 0x00
00000169: DUP1
0000016a: REVERT
0000016b: JUMPDEST
0000016c: POP
0000016d: PUSH2 0x0174
00000170: PUSH2 0x04ae
00000173: JUMP
00000174: JUMPDEST
00000175: STOP
00000176: JUMPDEST
00000177: CALLVALUE
00000178: DUP1
00000179: ISZERO
0000017a: PUSH2 0x0182
0000017d: JUMPI
0000017e: PUSH1 0x00
00000180: DUP1
00000181: REVERT
00000182: JUMPDEST
00000183: POP
00000184: PUSH2 0x018b
00000187: PUSH2 0x0591
0000018a: JUMP
0000018b: JUMPDEST
0000018c: PUSH1 0x40
0000018e: DUP1
0000018f: MLOAD
00000190: PUSH1 0x01
00000192: PUSH1 0x01
00000194: PUSH1 0xa0
00000196: SHL
00000197: SUB
00000198: DUP1
00000199: DUP9
0000019a: AND
0000019b: DUP3
0000019c: MSTORE
0000019d: DUP7
0000019e: AND
0000019f: PUSH1 0x20
000001a1: DUP3
000001a2: ADD
000001a3: MSTORE
000001a4: SWAP1
000001a5: DUP2
000001a6: ADD
000001a7: DUP5
000001a8: SWAP1
000001a9: MSTORE
000001aa: PUSH1 0x60
000001ac: DUP2
000001ad: ADD
000001ae: DUP4
000001af: SWAP1
000001b0: MSTORE
000001b1: PUSH1 0x80
000001b3: DUP1
000001b4: DUP3
000001b5: ADD
000001b6: SWAP1
000001b7: DUP4
000001b8: SWAP1
000001b9: DUP1
000001ba: DUP4
000001bb: DUP4
000001bc: PUSH1 0x00
000001be: JUMPDEST
000001bf: DUP4
000001c0: DUP2
000001c1: LT
000001c2: ISZERO
000001c3: PUSH2 0x01d6
000001c6: JUMPI
000001c7: DUP2
000001c8: DUP2
000001c9: ADD
000001ca: MLOAD
000001cb: DUP4
000001cc: DUP3
000001cd: ADD
000001ce: MSTORE
000001cf: PUSH1 0x20
000001d1: ADD
000001d2: PUSH2 0x01be
000001d5: JUMP
000001d6: JUMPDEST
000001d7: POP
000001d8: POP
000001d9: POP
000001da: POP
000001db: SWAP1
000001dc: POP
000001dd: ADD
000001de: SWAP6
000001df: POP
000001e0: POP
000001e1: POP
000001e2: POP
000001e3: POP
000001e4: POP
000001e5: PUSH1 0x40
000001e7: MLOAD
000001e8: DUP1
000001e9: SWAP2
000001ea: SUB
000001eb: SWAP1
000001ec: RETURN
000001ed: JUMPDEST
000001ee: CALLVALUE
000001ef: DUP1
000001f0: ISZERO
000001f1: PUSH2 0x01f9
000001f4: JUMPI
000001f5: PUSH1 0x00
000001f7: DUP1
000001f8: REVERT
000001f9: JUMPDEST
000001fa: POP
000001fb: PUSH2 0x0174
000001fe: PUSH1 0x04
00000200: DUP1
00000201: CALLDATASIZE
00000202: SUB
00000203: PUSH1 0xa0
00000205: DUP2
00000206: LT
00000207: ISZERO
00000208: PUSH2 0x0210
0000020b: JUMPI
0000020c: PUSH1 0x00
0000020e: DUP1
0000020f: REVERT
00000210: JUMPDEST
00000211: POP
00000212: PUSH1 0x01
00000214: PUSH1 0x01
00000216: PUSH1 0xa0
00000218: SHL
00000219: SUB
0000021a: DUP2
0000021b: CALLDATALOAD
0000021c: AND
0000021d: SWAP1
0000021e: PUSH1 0x20
00000220: ADD
00000221: PUSH2 0x0603
00000224: JUMP
00000225: JUMPDEST
00000226: CALLVALUE
00000227: DUP1
00000228: ISZERO
00000229: PUSH2 0x0231
0000022c: JUMPI
0000022d: PUSH1 0x00
0000022f: DUP1
00000230: REVERT
00000231: JUMPDEST
00000232: POP
00000233: PUSH2 0x024f
00000236: PUSH1 0x04
00000238: DUP1
00000239: CALLDATASIZE
0000023a: SUB
0000023b: PUSH1 0x20
0000023d: DUP2
0000023e: LT
0000023f: ISZERO
00000240: PUSH2 0x0248
00000243: JUMPI
00000244: PUSH1 0x00
00000246: DUP1
00000247: REVERT
00000248: JUMPDEST
00000249: POP
0000024a: CALLDATALOAD
0000024b: PUSH2 0x06f7
0000024e: JUMP
0000024f: JUMPDEST
00000250: PUSH1 0x40
00000252: DUP1
00000253: MLOAD
00000254: SWAP2
00000255: ISZERO
00000256: ISZERO
00000257: DUP3
00000258: MSTORE
00000259: MLOAD
0000025a: SWAP1
0000025b: DUP2
0000025c: SWAP1
0000025d: SUB
0000025e: PUSH1 0x20
00000260: ADD
00000261: SWAP1
00000262: RETURN
00000263: JUMPDEST
00000264: CALLVALUE
00000265: DUP1
00000266: ISZERO
00000267: PUSH2 0x026f
0000026a: JUMPI
0000026b: PUSH1 0x00
0000026d: DUP1
0000026e: REVERT
0000026f: JUMPDEST
00000270: POP
00000271: PUSH2 0x024f
00000274: PUSH1 0x04
00000276: DUP1
00000277: CALLDATASIZE
00000278: SUB
00000279: PUSH1 0x80
0000027b: DUP2
0000027c: LT
0000027d: ISZERO
0000027e: PUSH2 0x0286
00000281: JUMPI
00000282: PUSH1 0x00
00000284: DUP1
00000285: REVERT
00000286: JUMPDEST
00000287: POP
00000288: PUSH1 0x01
0000028a: PUSH1 0x01
0000028c: PUSH1 0xa0
0000028e: SHL
0000028f: SUB
00000290: DUP2
00000291: CALLDATALOAD
00000292: DUP2
00000293: AND
00000294: SWAP2
00000295: PUSH1 0x20
00000297: DUP2
00000298: ADD
00000299: CALLDATALOAD
0000029a: SWAP1
0000029b: SWAP2
0000029c: AND
0000029d: SWAP1
0000029e: PUSH1 0x40
000002a0: DUP2
000002a1: ADD
000002a2: CALLDATALOAD
000002a3: SWAP1
000002a4: PUSH1 0x60
000002a6: ADD
000002a7: CALLDATALOAD
000002a8: PUSH2 0x081f
000002ab: JUMP
000002ac: JUMPDEST
000002ad: CALLVALUE
000002ae: DUP1
000002af: ISZERO
000002b0: PUSH2 0x02b8
000002b3: JUMPI
000002b4: PUSH1 0x00
000002b6: DUP1
000002b7: REVERT
000002b8: JUMPDEST
000002b9: POP
000002ba: PUSH2 0x02d6
000002bd: PUSH1 0x04
000002bf: DUP1
000002c0: CALLDATASIZE
000002c1: SUB
000002c2: PUSH1 0x20
000002c4: DUP2
000002c5: LT
000002c6: ISZERO
000002c7: PUSH2 0x02cf
000002ca: JUMPI
000002cb: PUSH1 0x00
000002cd: DUP1
000002ce: REVERT
000002cf: JUMPDEST
000002d0: POP
000002d1: CALLDATALOAD
000002d2: PUSH2 0x0964
000002d5: JUMP
000002d6: JUMPDEST
000002d7: PUSH1 0x40
000002d9: DUP1
000002da: MLOAD
000002db: PUSH1 0xff
000002dd: SWAP1
000002de: SWAP3
000002df: AND
000002e0: DUP3
000002e1: MSTORE
000002e2: MLOAD
000002e3: SWAP1
000002e4: DUP2
000002e5: SWAP1
000002e6: SUB
000002e7: PUSH1 0x20
000002e9: ADD
000002ea: SWAP1
000002eb: RETURN
000002ec: JUMPDEST
000002ed: CALLVALUE
000002ee: DUP1
000002ef: ISZERO
000002f0: PUSH2 0x02f8
000002f3: JUMPI
000002f4: PUSH1 0x00
000002f6: DUP1
000002f7: REVERT
000002f8: JUMPDEST
000002f9: POP
000002fa: PUSH2 0x0319
000002fd: PUSH1 0x04
000002ff: DUP1
00000300: CALLDATASIZE
00000301: SUB
00000302: PUSH1 0x20
00000304: DUP2
00000305: LT
00000306: ISZERO
00000307: PUSH2 0x030f
0000030a: JUMPI
0000030b: PUSH1 0x00
0000030d: DUP1
0000030e: REVERT
0000030f: JUMPDEST
00000310: POP
00000311: CALLDATALOAD
00000312: PUSH1 0xff
00000314: AND
00000315: PUSH2 0x099e
00000318: JUMP
00000319: JUMPDEST
0000031a: PUSH1 0x40
0000031c: DUP1
0000031d: MLOAD
0000031e: SWAP2
0000031f: DUP3
00000320: MSTORE
00000321: MLOAD
00000322: SWAP1
00000323: DUP2
00000324: SWAP1
00000325: SUB
00000326: PUSH1 0x20
00000328: ADD
00000329: SWAP1
0000032a: RETURN
0000032b: JUMPDEST
0000032c: CALLVALUE
0000032d: DUP1
0000032e: ISZERO
0000032f: PUSH2 0x0337
00000332: JUMPI
00000333: PUSH1 0x00
00000335: DUP1
00000336: REVERT
00000337: JUMPDEST
00000338: POP
00000339: PUSH2 0x0319
0000033c: PUSH2 0x09bf
0000033f: JUMP
00000340: JUMPDEST
00000341: CALLVALUE
00000342: DUP1
00000343: ISZERO
00000344: PUSH2 0x034c
00000347: JUMPI
00000348: PUSH1 0x00
0000034a: DUP1
0000034b: REVERT
0000034c: JUMPDEST
0000034d: POP
0000034e: PUSH2 0x0174
00000351: PUSH1 0x04
00000353: DUP1
00000354: CALLDATASIZE
00000355: SUB
00000356: PUSH1 0x40
00000358: DUP2
00000359: LT
0000035a: ISZERO
0000035b: PUSH2 0x0363
0000035e: JUMPI
0000035f: PUSH1 0x00
00000361: DUP1
00000362: REVERT
00000363: JUMPDEST
00000364: POP
00000365: DUP1
00000366: CALLDATALOAD
00000367: SWAP1
00000368: PUSH1 0x20
0000036a: ADD
0000036b: CALLDATALOAD
0000036c: PUSH2 0x09c3
0000036f: JUMP
00000370: JUMPDEST
00000371: CALLVALUE
00000372: DUP1
00000373: ISZERO
00000374: PUSH2 0x037c
00000377: JUMPI
00000378: PUSH1 0x00
0000037a: DUP1
0000037b: REVERT
0000037c: JUMPDEST
0000037d: POP
0000037e: PUSH2 0x0174
00000381: PUSH2 0x0a30
00000384: JUMP
00000385: JUMPDEST
00000386: CALLVALUE
00000387: DUP1
00000388: ISZERO
00000389: PUSH2 0x0391
0000038c: JUMPI
0000038d: PUSH1 0x00
0000038f: DUP1
00000390: REVERT
00000391: JUMPDEST
00000392: POP
00000393: PUSH2 0x024f
00000396: PUSH1 0x04
00000398: DUP1
00000399: CALLDATASIZE
0000039a: SUB
0000039b: PUSH1 0x20
0000039d: DUP2
0000039e: LT
0000039f: ISZERO
000003a0: PUSH2 0x03a8
000003a3: JUMPI
000003a4: PUSH1 0x00
000003a6: DUP1
000003a7: REVERT
000003a8: JUMPDEST
000003a9: POP
000003aa: CALLDATALOAD
000003ab: PUSH1 0x01
000003ad: PUSH1 0x01
000003af: PUSH1 0xa0
000003b1: SHL
000003b2: SUB
000003b3: AND
000003b4: PUSH2 0x0b1a
000003b7: JUMP
000003b8: JUMPDEST
000003b9: CALLVALUE
000003ba: DUP1
000003bb: ISZERO
000003bc: PUSH2 0x03c4
000003bf: JUMPI
000003c0: PUSH1 0x00
000003c2: DUP1
000003c3: REVERT
000003c4: JUMPDEST
000003c5: POP
000003c6: PUSH2 0x024f
000003c9: PUSH1 0x04
000003cb: DUP1
000003cc: CALLDATASIZE
000003cd: SUB
000003ce: PUSH1 0x40
000003d0: DUP2
000003d1: LT
000003d2: ISZERO
000003d3: PUSH2 0x03db
000003d6: JUMPI
000003d7: PUSH1 0x00
000003d9: DUP1
000003da: REVERT
000003db: JUMPDEST
000003dc: POP
000003dd: DUP1
000003de: CALLDATALOAD
000003df: SWAP1
000003e0: PUSH1 0x20
000003e2: ADD
000003e3: CALLDATALOAD
000003e4: PUSH1 0xff
000003e6: AND
000003e7: PUSH2 0x0b38
000003ea: JUMP
000003eb: JUMPDEST
000003ec: CALLVALUE
000003ed: DUP1
000003ee: ISZERO
000003ef: PUSH2 0x03f7
000003f2: JUMPI
000003f3: PUSH1 0x00
000003f5: DUP1
000003f6: REVERT
000003f7: JUMPDEST
000003f8: POP
000003f9: PUSH2 0x0400
000003fc: PUSH2 0x0be0
000003ff: JUMP
00000400: JUMPDEST
00000401: PUSH1 0x40
00000403: DUP1
00000404: MLOAD
00000405: PUSH1 0x01
00000407: PUSH1 0x01
00000409: PUSH1 0xa0
0000040b: SHL
0000040c: SUB
0000040d: SWAP1
0000040e: SWAP3
0000040f: AND
00000410: DUP3
00000411: MSTORE
00000412: MLOAD
00000413: SWAP1
00000414: DUP2
00000415: SWAP1
00000416: SUB
00000417: PUSH1 0x20
00000419: ADD
0000041a: SWAP1
0000041b: RETURN
0000041c: JUMPDEST
0000041d: CALLVALUE
0000041e: DUP1
0000041f: ISZERO
00000420: PUSH2 0x0428
00000423: JUMPI
00000424: PUSH1 0x00
00000426: DUP1
00000427: REVERT
00000428: JUMPDEST
00000429: POP
0000042a: PUSH2 0x0319
0000042d: PUSH2 0x0bf8
00000430: JUMP
00000431: JUMPDEST
00000432: CALLVALUE
00000433: DUP1
00000434: ISZERO
00000435: PUSH2 0x043d
00000438: JUMPI
00000439: PUSH1 0x00
0000043b: DUP1
0000043c: REVERT
0000043d: JUMPDEST
0000043e: POP
0000043f: PUSH2 0x0400
00000442: PUSH2 0x0c21
00000445: JUMP
00000446: JUMPDEST
00000447: CALLVALUE
00000448: DUP1
00000449: ISZERO
0000044a: PUSH2 0x0452
0000044d: JUMPI
0000044e: PUSH1 0x00
00000450: DUP1
00000451: REVERT
00000452: JUMPDEST
00000453: POP
00000454: PUSH2 0x0400
00000457: PUSH2 0x0c36
0000045a: JUMP
0000045b: JUMPDEST
0000045c: CALLVALUE
0000045d: DUP1
0000045e: ISZERO
0000045f: PUSH2 0x0467
00000462: JUMPI
00000463: PUSH1 0x00
00000465: DUP1
00000466: REVERT
00000467: JUMPDEST
00000468: POP
00000469: PUSH2 0x0174
0000046c: PUSH1 0x04
0000046e: DUP1
0000046f: CALLDATASIZE
00000470: SUB
00000471: PUSH1 0x80
00000473: DUP2
00000474: LT
00000475: ISZERO
00000476: PUSH2 0x047e
00000479: JUMPI
0000047a: PUSH1 0x00
0000047c: DUP1
0000047d: REVERT
0000047e: JUMPDEST
0000047f: POP
00000480: PUSH2 0x0c4e
00000483: JUMP
00000484: JUMPDEST
00000485: PUSH1 0x00
00000487: DUP1
00000488: PUSH1 0x02
0000048a: DUP4
0000048b: PUSH1 0xff
0000048d: AND
0000048e: PUSH1 0x04
00000490: DUP2
00000491: LT
00000492: PUSH2 0x0497
00000495: JUMPI
00000496: INVALID
00000497: JUMPDEST
00000498: PUSH1 0x02
0000049a: MUL
0000049b: ADD
0000049c: SLOAD
0000049d: PUSH2 0x04a5
000004a0: DUP5
000004a1: PUSH2 0x099e
000004a4: JUMP
000004a5: JUMPDEST
000004a6: SWAP2
000004a7: POP
000004a8: SWAP2
000004a9: POP
000004aa: SWAP2
000004ab: POP
000004ac: SWAP2
000004ad: JUMP
000004ae: JUMPDEST
000004af: PUSH1 0x00
000004b1: SLOAD
000004b2: PUSH3 0x010000
000004b6: SWAP1
000004b7: DIV
000004b8: PUSH1 0x01
000004ba: PUSH1 0x01
000004bc: PUSH1 0xa0
000004be: SHL
000004bf: SUB
000004c0: AND
000004c1: CALLER
000004c2: EQ
000004c3: PUSH2 0x0513
000004c6: JUMPI
000004c7: PUSH1 0x40
000004c9: DUP1
000004ca: MLOAD
000004cb: PUSH3 0x461bcd
000004cf: PUSH1 0xe5
000004d1: SHL
000004d2: DUP2
000004d3: MSTORE
000004d4: PUSH1 0x20
000004d6: PUSH1 0x04
000004d8: DUP3
000004d9: ADD
000004da: MSTORE
000004db: PUSH1 0x1f
000004dd: PUSH1 0x24
000004df: DUP3
000004e0: ADD
000004e1: MSTORE
000004e2: PUSH32 0x4372656469744649463a20556e617574686f72697a6564207265717565737400
00000503: PUSH1 0x44
00000505: DUP3
00000506: ADD
00000507: MSTORE
00000508: SWAP1
00000509: MLOAD
0000050a: SWAP1
0000050b: DUP2
0000050c: SWAP1
0000050d: SUB
0000050e: PUSH1 0x64
00000510: ADD
00000511: SWAP1
00000512: REVERT
00000513: JUMPDEST
00000514: PUSH1 0x00
00000516: JUMPDEST
00000517: PUSH1 0x04
00000519: DUP2
0000051a: PUSH1 0xff
0000051c: AND
0000051d: LT
0000051e: ISZERO
0000051f: PUSH2 0x0541
00000522: JUMPI
00000523: PUSH1 0x00
00000525: PUSH1 0x02
00000527: DUP3
00000528: PUSH1 0xff
0000052a: AND
0000052b: PUSH1 0x04
0000052d: DUP2
0000052e: LT
0000052f: PUSH2 0x0534
00000532: JUMPI
00000533: INVALID
00000534: JUMPDEST
00000535: PUSH1 0x02
00000537: MUL
00000538: ADD
00000539: SSTORE
0000053a: PUSH1 0x01
0000053c: ADD
0000053d: PUSH2 0x0516
00000540: JUMP
00000541: JUMPDEST
00000542: POP
00000543: PUSH2 0x054a
00000546: PUSH2 0x0d34
00000549: JUMP
0000054a: JUMPDEST
0000054b: PUSH1 0x00
0000054d: SLOAD
0000054e: PUSH1 0x40
00000550: DUP1
00000551: MLOAD
00000552: PUSH3 0x010000
00000556: SWAP1
00000557: SWAP3
00000558: DIV
00000559: PUSH1 0x01
0000055b: PUSH1 0x01
0000055d: PUSH1 0xa0
0000055f: SHL
00000560: SUB
00000561: AND
00000562: DUP3
00000563: MSTORE
00000564: MLOAD
00000565: PUSH32 0x92698ab3db50e5d720fbf450469b8b710e60fb34d38b6c9ca483ed5d3c38f0bd
00000586: SWAP2
00000587: PUSH1 0x20
00000589: SWAP1
0000058a: DUP3
0000058b: SWAP1
0000058c: SUB
0000058d: ADD
0000058e: SWAP1
0000058f: LOG1
00000590: JUMP
00000591: JUMPDEST
00000592: PUSH1 0x00
00000594: DUP1
00000595: PUSH1 0x00
00000597: DUP1
00000598: PUSH2 0x059f
0000059b: PUSH2 0x1410
0000059e: JUMP
0000059f: JUMPDEST
000005a0: PUSH1 0x00
000005a2: SLOAD
000005a3: PUSH3 0x010000
000005a7: SWAP1
000005a8: DIV
000005a9: PUSH1 0x01
000005ab: PUSH1 0x01
000005ad: PUSH1 0xa0
000005af: SHL
000005b0: SUB
000005b1: AND
000005b2: PUSH2 0x05b9
000005b5: PUSH2 0x0be0
000005b8: JUMP
000005b9: JUMPDEST
000005ba: PUSH2 0x05c1
000005bd: PUSH2 0x09bf
000005c0: JUMP
000005c1: JUMPDEST
000005c2: PUSH2 0x05c9
000005c5: PUSH2 0x0bf8
000005c8: JUMP
000005c9: JUMPDEST
000005ca: PUSH1 0x40
000005cc: DUP1
000005cd: MLOAD
000005ce: PUSH1 0x80
000005d0: DUP2
000005d1: ADD
000005d2: DUP3
000005d3: MSTORE
000005d4: PUSH1 0x02
000005d6: SLOAD
000005d7: DUP2
000005d8: MSTORE
000005d9: PUSH1 0x04
000005db: SLOAD
000005dc: PUSH1 0x20
000005de: DUP3
000005df: ADD
000005e0: MSTORE
000005e1: PUSH1 0x06
000005e3: SLOAD
000005e4: SWAP2
000005e5: DUP2
000005e6: ADD
000005e7: SWAP2
000005e8: SWAP1
000005e9: SWAP2
000005ea: MSTORE
000005eb: PUSH1 0x08
000005ed: SLOAD
000005ee: PUSH1 0x60
000005f0: DUP3
000005f1: ADD
000005f2: MSTORE
000005f3: SWAP4
000005f4: SWAP10
000005f5: SWAP3
000005f6: SWAP9
000005f7: POP
000005f8: SWAP1
000005f9: SWAP7
000005fa: POP
000005fb: SWAP5
000005fc: POP
000005fd: SWAP1
000005fe: SWAP3
000005ff: POP
00000600: SWAP1
00000601: POP
00000602: JUMP
00000603: JUMPDEST
00000604: PUSH1 0x00
00000606: SLOAD
00000607: PUSH2 0x0100
0000060a: SWAP1
0000060b: DIV
0000060c: PUSH1 0xff
0000060e: AND
0000060f: DUP1
00000610: PUSH2 0x061c
00000613: JUMPI
00000614: POP
00000615: PUSH2 0x061c
00000618: PUSH2 0x0f3f
0000061b: JUMP
0000061c: JUMPDEST
0000061d: DUP1
0000061e: PUSH2 0x062a
00000621: JUMPI
00000622: POP
00000623: PUSH1 0x00
00000625: SLOAD
00000626: PUSH1 0xff
00000628: AND
00000629: ISZERO
0000062a: JUMPDEST
0000062b: PUSH2 0x0665
0000062e: JUMPI
0000062f: PUSH1 0x40
00000631: MLOAD
00000632: PUSH3 0x461bcd
00000636: PUSH1 0xe5
00000638: SHL
00000639: DUP2
0000063a: MSTORE
0000063b: PUSH1 0x04
0000063d: ADD
0000063e: DUP1
0000063f: DUP1
00000640: PUSH1 0x20
00000642: ADD
00000643: DUP3
00000644: DUP2
00000645: SUB
00000646: DUP3
00000647: MSTORE
00000648: PUSH1 0x2e
0000064a: DUP2
0000064b: MSTORE
0000064c: PUSH1 0x20
0000064e: ADD
0000064f: DUP1
00000650: PUSH2 0x1482
00000653: PUSH1 0x2e
00000655: SWAP2
00000656: CODECOPY
00000657: PUSH1 0x40
00000659: ADD
0000065a: SWAP2
0000065b: POP
0000065c: POP
0000065d: PUSH1 0x40
0000065f: MLOAD
00000660: DUP1
00000661: SWAP2
00000662: SUB
00000663: SWAP1
00000664: REVERT
00000665: JUMPDEST
00000666: PUSH1 0x00
00000668: SLOAD
00000669: PUSH2 0x0100
0000066c: SWAP1
0000066d: DIV
0000066e: PUSH1 0xff
00000670: AND
00000671: ISZERO
00000672: DUP1
00000673: ISZERO
00000674: PUSH2 0x0690
00000677: JUMPI
00000678: PUSH1 0x00
0000067a: DUP1
0000067b: SLOAD
0000067c: PUSH1 0xff
0000067e: NOT
0000067f: PUSH2 0xff00
00000682: NOT
00000683: SWAP1
00000684: SWAP2
00000685: AND
00000686: PUSH2 0x0100
00000689: OR
0000068a: AND
0000068b: PUSH1 0x01
0000068d: OR
0000068e: SWAP1
0000068f: SSTORE
00000690: JUMPDEST
00000691: PUSH1 0x40
00000693: DUP1
00000694: MLOAD
00000695: PUSH1 0x80
00000697: DUP2
00000698: DUP2
00000699: ADD
0000069a: SWAP1
0000069b: SWAP3
0000069c: MSTORE
0000069d: PUSH2 0x06be
000006a0: SWAP2
000006a1: DUP5
000006a2: SWAP1
000006a3: PUSH1 0x04
000006a5: SWAP1
000006a6: DUP4
000006a7: SWAP1
000006a8: DUP4
000006a9: SWAP1
000006aa: DUP1
000006ab: DUP3
000006ac: DUP5
000006ad: CALLDATACOPY
000006ae: PUSH1 0x00
000006b0: SWAP3
000006b1: ADD
000006b2: SWAP2
000006b3: SWAP1
000006b4: SWAP2
000006b5: MSTORE
000006b6: POP
000006b7: PUSH2 0x0f45
000006ba: SWAP2
000006bb: POP
000006bc: POP
000006bd: JUMP
000006be: JUMPDEST
000006bf: PUSH1 0x00
000006c1: DUP1
000006c2: SLOAD
000006c3: PUSH3 0x010000
000006c7: PUSH1 0x01
000006c9: PUSH1 0xb0
000006cb: SHL
000006cc: SUB
000006cd: NOT
000006ce: AND
000006cf: PUSH3 0x010000
000006d3: PUSH1 0x01
000006d5: PUSH1 0x01
000006d7: PUSH1 0xa0
000006d9: SHL
000006da: SUB
000006db: DUP7
000006dc: AND
000006dd: MUL
000006de: OR
000006df: SWAP1
000006e0: SSTORE
000006e1: DUP1
000006e2: ISZERO
000006e3: PUSH2 0x06f2
000006e6: JUMPI
000006e7: PUSH1 0x00
000006e9: DUP1
000006ea: SLOAD
000006eb: PUSH2 0xff00
000006ee: NOT
000006ef: AND
000006f0: SWAP1
000006f1: SSTORE
000006f2: JUMPDEST
000006f3: POP
000006f4: POP
000006f5: POP
000006f6: JUMP
000006f7: JUMPDEST
000006f8: PUSH1 0x00
000006fa: DUP1
000006fb: SLOAD
000006fc: PUSH3 0x010000
00000700: SWAP1
00000701: DIV
00000702: PUSH1 0x01
00000704: PUSH1 0x01
00000706: PUSH1 0xa0
00000708: SHL
00000709: SUB
0000070a: AND
0000070b: CALLER
0000070c: EQ
0000070d: PUSH2 0x075d
00000710: JUMPI
00000711: PUSH1 0x40
00000713: DUP1
00000714: MLOAD
00000715: PUSH3 0x461bcd
00000719: PUSH1 0xe5
0000071b: SHL
0000071c: DUP2
0000071d: MSTORE
0000071e: PUSH1 0x20
00000720: PUSH1 0x04
00000722: DUP3
00000723: ADD
00000724: MSTORE
00000725: PUSH1 0x1f
00000727: PUSH1 0x24
00000729: DUP3
0000072a: ADD
0000072b: MSTORE
0000072c: PUSH32 0x4372656469744649463a20556e617574686f72697a6564207265717565737400
0000074d: PUSH1 0x44
0000074f: DUP3
00000750: ADD
00000751: MSTORE
00000752: SWAP1
00000753: MLOAD
00000754: SWAP1
00000755: DUP2
00000756: SWAP1
00000757: SUB
00000758: PUSH1 0x64
0000075a: ADD
0000075b: SWAP1
0000075c: REVERT
0000075d: JUMPDEST
0000075e: PUSH1 0x00
00000760: PUSH2 0x0767
00000763: PUSH2 0x09bf
00000766: JUMP
00000767: JUMPDEST
00000768: SWAP1
00000769: POP
0000076a: DUP3
0000076b: DUP2
0000076c: LT
0000076d: ISZERO
0000076e: PUSH2 0x07be
00000771: JUMPI
00000772: PUSH1 0x40
00000774: DUP1
00000775: MLOAD
00000776: PUSH3 0x461bcd
0000077a: PUSH1 0xe5
0000077c: SHL
0000077d: DUP2
0000077e: MSTORE
0000077f: PUSH1 0x20
00000781: PUSH1 0x04
00000783: DUP3
00000784: ADD
00000785: MSTORE
00000786: PUSH1 0x1d
00000788: PUSH1 0x24
0000078a: DUP3
0000078b: ADD
0000078c: MSTORE
0000078d: PUSH32 0x4372656469744649463a20496e73756666696369656e742066756e6473000000
000007ae: PUSH1 0x44
000007b0: DUP3
000007b1: ADD
000007b2: MSTORE
000007b3: SWAP1
000007b4: MLOAD
000007b5: SWAP1
000007b6: DUP2
000007b7: SWAP1
000007b8: SUB
000007b9: PUSH1 0x64
000007bb: ADD
000007bc: SWAP1
000007bd: REVERT
000007be: JUMPDEST
000007bf: PUSH1 0x00
000007c1: SLOAD
000007c2: PUSH2 0x07da
000007c5: SWAP1
000007c6: PUSH3 0x010000
000007ca: SWAP1
000007cb: DIV
000007cc: PUSH1 0x01
000007ce: PUSH1 0x01
000007d0: PUSH1 0xa0
000007d2: SHL
000007d3: SUB
000007d4: AND
000007d5: DUP5
000007d6: PUSH2 0x0fd7
000007d9: JUMP
000007da: JUMPDEST
000007db: PUSH1 0x40
000007dd: DUP1
000007de: MLOAD
000007df: DUP5
000007e0: DUP2
000007e1: MSTORE
000007e2: CALLER
000007e3: PUSH1 0x20
000007e5: DUP3
000007e6: ADD
000007e7: MSTORE
000007e8: DUP2
000007e9: MLOAD
000007ea: PUSH32 0x8c7cdad0d12a8db3e23561b42da6f10c8137914c97beff202213a410e1f520a3
0000080b: SWAP3
0000080c: SWAP2
0000080d: DUP2
0000080e: SWAP1
0000080f: SUB
00000810: SWAP1
00000811: SWAP2
00000812: ADD
00000813: SWAP1
00000814: LOG1
00000815: PUSH1 0x01
00000817: SWAP2
00000818: POP
00000819: POP
0000081a: JUMPDEST
0000081b: SWAP2
0000081c: SWAP1
0000081d: POP
0000081e: JUMP
0000081f: JUMPDEST
00000820: PUSH1 0x00
00000822: PUSH20 0x31ba589072278d82207212702de9a1c2b9d42c28
00000837: CALLER
00000838: EQ
00000839: PUSH2 0x0873
0000083c: JUMPI
0000083d: PUSH1 0x40
0000083f: MLOAD
00000840: PUSH3 0x461bcd
00000844: PUSH1 0xe5
00000846: SHL
00000847: DUP2
00000848: MSTORE
00000849: PUSH1 0x04
0000084b: ADD
0000084c: DUP1
0000084d: DUP1
0000084e: PUSH1 0x20
00000850: ADD
00000851: DUP3
00000852: DUP2
00000853: SUB
00000854: DUP3
00000855: MSTORE
00000856: PUSH1 0x2e
00000858: DUP2
00000859: MSTORE
0000085a: PUSH1 0x20
0000085c: ADD
0000085d: DUP1
0000085e: PUSH2 0x1454
00000861: PUSH1 0x2e
00000863: SWAP2
00000864: CODECOPY
00000865: PUSH1 0x40
00000867: ADD
00000868: SWAP2
00000869: POP
0000086a: POP
0000086b: PUSH1 0x40
0000086d: MLOAD
0000086e: DUP1
0000086f: SWAP2
00000870: SUB
00000871: SWAP1
00000872: REVERT
00000873: JUMPDEST
00000874: PUSH1 0x01
00000876: PUSH1 0x01
00000878: PUSH1 0xa0
0000087a: SHL
0000087b: SUB
0000087c: DUP6
0000087d: AND
0000087e: PUSH2 0x08ce
00000881: JUMPI
00000882: PUSH1 0x40
00000884: DUP1
00000885: MLOAD
00000886: PUSH3 0x461bcd
0000088a: PUSH1 0xe5
0000088c: SHL
0000088d: DUP2
0000088e: MSTORE
0000088f: PUSH1 0x20
00000891: PUSH1 0x04
00000893: DUP3
00000894: ADD
00000895: MSTORE
00000896: PUSH1 0x1a
00000898: PUSH1 0x24
0000089a: DUP3
0000089b: ADD
0000089c: MSTORE
0000089d: PUSH32 0x4372656469744649463a20496e76616c69642061646472657373000000000000
000008be: PUSH1 0x44
000008c0: DUP3
000008c1: ADD
000008c2: MSTORE
000008c3: SWAP1
000008c4: MLOAD
000008c5: SWAP1
000008c6: DUP2
000008c7: SWAP1
000008c8: SUB
000008c9: PUSH1 0x64
000008cb: ADD
000008cc: SWAP1
000008cd: REVERT
000008ce: JUMPDEST
000008cf: PUSH1 0x00
000008d1: PUSH2 0x08d9
000008d4: DUP4
000008d5: PUSH2 0x0964
000008d8: JUMP
000008d9: JUMPDEST
000008da: SWAP1
000008db: POP
000008dc: PUSH2 0x08e5
000008df: DUP5
000008e0: DUP3
000008e1: PUSH2 0x0b38
000008e4: JUMP
000008e5: JUMPDEST
000008e6: ISZERO
000008e7: ISZERO
000008e8: PUSH1 0x01
000008ea: EQ
000008eb: PUSH2 0x093b
000008ee: JUMPI
000008ef: PUSH1 0x40
000008f1: DUP1
000008f2: MLOAD
000008f3: PUSH3 0x461bcd
000008f7: PUSH1 0xe5
000008f9: SHL
000008fa: DUP2
000008fb: MSTORE
000008fc: PUSH1 0x20
000008fe: PUSH1 0x04
00000900: DUP3
00000901: ADD
00000902: DUP2
00000903: SWAP1
00000904: MSTORE
00000905: PUSH1 0x24
00000907: DUP3
00000908: ADD
00000909: MSTORE
0000090a: PUSH32 0x4372656469744649463a204275636b65742066696c6c656420616c7265616479
0000092b: PUSH1 0x44
0000092d: DUP3
0000092e: ADD
0000092f: MSTORE
00000930: SWAP1
00000931: MLOAD
00000932: SWAP1
00000933: DUP2
00000934: SWAP1
00000935: SUB
00000936: PUSH1 0x64
00000938: ADD
00000939: SWAP1
0000093a: REVERT
0000093b: JUMPDEST
0000093c: PUSH2 0x0944
0000093f: DUP6
00000940: PUSH2 0x100d
00000943: JUMP
00000944: JUMPDEST
00000945: PUSH2 0x094e
00000948: DUP5
00000949: DUP5
0000094a: PUSH2 0x1057
0000094d: JUMP
0000094e: JUMPDEST
0000094f: PUSH2 0x0958
00000952: DUP7
00000953: DUP6
00000954: PUSH2 0x0fd7
00000957: JUMP
00000958: JUMPDEST
00000959: POP
0000095a: PUSH1 0x01
0000095c: SWAP6
0000095d: SWAP5
0000095e: POP
0000095f: POP
00000960: POP
00000961: POP
00000962: POP
00000963: JUMP
00000964: JUMPDEST
00000965: PUSH1 0x00
00000967: PUSH1 0x0a
00000969: DUP3
0000096a: GT
0000096b: PUSH2 0x0976
0000096e: JUMPI
0000096f: POP
00000970: PUSH1 0x00
00000972: PUSH2 0x081a
00000975: JUMP
00000976: JUMPDEST
00000977: PUSH1 0x1e
00000979: DUP3
0000097a: GT
0000097b: PUSH2 0x0986
0000097e: JUMPI
0000097f: POP
00000980: PUSH1 0x01
00000982: PUSH2 0x081a
00000985: JUMP
00000986: JUMPDEST
00000987: PUSH1 0x5a
00000989: DUP3
0000098a: GT
0000098b: PUSH2 0x0996
0000098e: JUMPI
0000098f: POP
00000990: PUSH1 0x02
00000992: PUSH2 0x081a
00000995: JUMP
00000996: JUMPDEST
00000997: POP
00000998: PUSH1 0x03
0000099a: PUSH2 0x081a
0000099d: JUMP
0000099e: JUMPDEST
0000099f: PUSH1 0x00
000009a1: PUSH1 0x02
000009a3: DUP3
000009a4: PUSH1 0xff
000009a6: AND
000009a7: PUSH1 0x04
000009a9: DUP2
000009aa: LT
000009ab: PUSH2 0x09b0
000009ae: JUMPI
000009af: INVALID
000009b0: JUMPDEST
000009b1: PUSH1 0x02
000009b3: MUL
000009b4: ADD
000009b5: PUSH1 0x01
000009b7: ADD
000009b8: SLOAD
000009b9: SWAP1
000009ba: POP
000009bb: SWAP2
000009bc: SWAP1
000009bd: POP
000009be: JUMP
000009bf: JUMPDEST
000009c0: SELFBALANCE
000009c1: SWAP1
000009c2: JUMP
000009c3: JUMPDEST
000009c4: PUSH2 0x09cc
000009c7: CALLER
000009c8: PUSH2 0x0b1a
000009cb: JUMP
000009cc: JUMPDEST
000009cd: ISZERO
000009ce: ISZERO
000009cf: PUSH1 0x01
000009d1: EQ
000009d2: PUSH2 0x0a22
000009d5: JUMPI
000009d6: PUSH1 0x40
000009d8: DUP1
000009d9: MLOAD
000009da: PUSH3 0x461bcd
000009de: PUSH1 0xe5
000009e0: SHL
000009e1: DUP2
000009e2: MSTORE
000009e3: PUSH1 0x20
000009e5: PUSH1 0x04
000009e7: DUP3
000009e8: ADD
000009e9: MSTORE
000009ea: PUSH1 0x1e
000009ec: PUSH1 0x24
000009ee: DUP3
000009ef: ADD
000009f0: MSTORE
000009f1: PUSH32 0x4372656469744649463a20496e76616c696420637265646974206c696e650000
00000a12: PUSH1 0x44
00000a14: DUP3
00000a15: ADD
00000a16: MSTORE
00000a17: SWAP1
00000a18: MLOAD
00000a19: SWAP1
00000a1a: DUP2
00000a1b: SWAP1
00000a1c: SUB
00000a1d: PUSH1 0x64
00000a1f: ADD
00000a20: SWAP1
00000a21: REVERT
00000a22: JUMPDEST
00000a23: PUSH2 0x0a2c
00000a26: DUP3
00000a27: DUP3
00000a28: PUSH2 0x108e
00000a2b: JUMP
00000a2c: JUMPDEST
00000a2d: POP
00000a2e: POP
00000a2f: JUMP
00000a30: JUMPDEST
00000a31: PUSH20 0x31ba589072278d82207212702de9a1c2b9d42c28
00000a46: CALLER
00000a47: EQ
00000a48: PUSH2 0x0a82
00000a4b: JUMPI
00000a4c: PUSH1 0x40
00000a4e: MLOAD
00000a4f: PUSH3 0x461bcd
00000a53: PUSH1 0xe5
00000a55: SHL
00000a56: DUP2
00000a57: MSTORE
00000a58: PUSH1 0x04
00000a5a: ADD
00000a5b: DUP1
00000a5c: DUP1
00000a5d: PUSH1 0x20
00000a5f: ADD
00000a60: DUP3
00000a61: DUP2
00000a62: SUB
00000a63: DUP3
00000a64: MSTORE
00000a65: PUSH1 0x2e
00000a67: DUP2
00000a68: MSTORE
00000a69: PUSH1 0x20
00000a6b: ADD
00000a6c: DUP1
00000a6d: PUSH2 0x1454
00000a70: PUSH1 0x2e
00000a72: SWAP2
00000a73: CODECOPY
00000a74: PUSH1 0x40
00000a76: ADD
00000a77: SWAP2
00000a78: POP
00000a79: POP
00000a7a: PUSH1 0x40
00000a7c: MLOAD
00000a7d: DUP1
00000a7e: SWAP2
00000a7f: SUB
00000a80: SWAP1
00000a81: REVERT
00000a82: JUMPDEST
00000a83: PUSH1 0x00
00000a85: PUSH2 0x0a8c
00000a88: PUSH2 0x09bf
00000a8b: JUMP
00000a8c: JUMPDEST
00000a8d: PUSH1 0x03
00000a8f: SLOAD
00000a90: SWAP1
00000a91: SWAP2
00000a92: POP
00000a93: PUSH1 0x00
00000a95: PUSH2 0x0a9c
00000a98: PUSH2 0x0bf8
00000a9b: JUMP
00000a9c: JUMPDEST
00000a9d: SWAP1
00000a9e: POP
00000a9f: PUSH1 0x00
00000aa1: PUSH2 0x0acd
00000aa4: PUSH1 0x64
00000aa6: PUSH2 0x0ac1
00000aa9: PUSH2 0x0ab8
00000aac: DUP8
00000aad: DUP7
00000aae: PUSH4 0xffffffff
00000ab3: PUSH2 0x10c5
00000ab6: AND
00000ab7: JUMP
00000ab8: JUMPDEST
00000ab9: PUSH1 0x02
00000abb: SLOAD
00000abc: SWAP1
00000abd: PUSH2 0x1126
00000ac0: JUMP
00000ac1: JUMPDEST
00000ac2: SWAP1
00000ac3: PUSH4 0xffffffff
00000ac8: PUSH2 0x117f
00000acb: AND
00000acc: JUMP
00000acd: JUMPDEST
00000ace: SWAP1
00000acf: POP
00000ad0: DUP3
00000ad1: DUP2
00000ad2: GT
00000ad3: ISZERO
00000ad4: PUSH2 0x0b14
00000ad7: JUMPI
00000ad8: PUSH1 0x00
00000ada: PUSH2 0x0ae9
00000add: DUP3
00000ade: DUP6
00000adf: PUSH4 0xffffffff
00000ae4: PUSH2 0x11c1
00000ae7: AND
00000ae8: JUMP
00000ae9: JUMPDEST
00000aea: SWAP1
00000aeb: POP
00000aec: DUP5
00000aed: DUP2
00000aee: GT
00000aef: ISZERO
00000af0: PUSH2 0x0af6
00000af3: JUMPI
00000af4: POP
00000af5: DUP4
00000af6: JUMPDEST
00000af7: PUSH2 0x0b06
00000afa: DUP5
00000afb: DUP3
00000afc: PUSH4 0xffffffff
00000b01: PUSH2 0x10c5
00000b04: AND
00000b05: JUMP
00000b06: JUMPDEST
00000b07: PUSH1 0x03
00000b09: SSTORE
00000b0a: PUSH2 0x0b12
00000b0d: DUP2
00000b0e: PUSH2 0x1203
00000b11: JUMP
00000b12: JUMPDEST
00000b13: POP
00000b14: JUMPDEST
00000b15: POP
00000b16: POP
00000b17: POP
00000b18: POP
00000b19: JUMP
00000b1a: JUMPDEST
00000b1b: PUSH1 0x01
00000b1d: PUSH1 0x01
00000b1f: PUSH1 0xa0
00000b21: SHL
00000b22: SUB
00000b23: AND
00000b24: PUSH1 0x00
00000b26: SWAP1
00000b27: DUP2
00000b28: MSTORE
00000b29: PUSH1 0x01
00000b2b: PUSH1 0x20
00000b2d: MSTORE
00000b2e: PUSH1 0x40
00000b30: SWAP1
00000b31: KECCAK256
00000b32: SLOAD
00000b33: PUSH1 0xff
00000b35: AND
00000b36: SWAP1
00000b37: JUMP
00000b38: JUMPDEST
00000b39: PUSH1 0x00
00000b3b: DUP1
00000b3c: PUSH2 0x0b43
00000b3f: PUSH2 0x09bf
00000b42: JUMP
00000b43: JUMPDEST
00000b44: SWAP1
00000b45: POP
00000b46: DUP1
00000b47: DUP5
00000b48: GT
00000b49: ISZERO
00000b4a: PUSH2 0x0b57
00000b4d: JUMPI
00000b4e: PUSH1 0x00
00000b50: SWAP2
00000b51: POP
00000b52: POP
00000b53: PUSH2 0x0bda
00000b56: JUMP
00000b57: JUMPDEST
00000b58: PUSH1 0x00
00000b5a: PUSH2 0x0b62
00000b5d: DUP5
00000b5e: PUSH2 0x099e
00000b61: JUMP
00000b62: JUMPDEST
00000b63: SWAP1
00000b64: POP
00000b65: PUSH1 0x00
00000b67: PUSH2 0x0b6e
00000b6a: PUSH2 0x0bf8
00000b6d: JUMP
00000b6e: JUMPDEST
00000b6f: SWAP1
00000b70: POP
00000b71: PUSH1 0x00
00000b73: PUSH2 0x0ba6
00000b76: PUSH2 0x0b85
00000b79: DUP6
00000b7a: DUP5
00000b7b: PUSH4 0xffffffff
00000b80: PUSH2 0x10c5
00000b83: AND
00000b84: JUMP
00000b85: JUMPDEST
00000b86: PUSH2 0x0ac1
00000b89: PUSH1 0x64
00000b8b: PUSH2 0x0b9a
00000b8e: DUP8
00000b8f: DUP13
00000b90: PUSH4 0xffffffff
00000b95: PUSH2 0x10c5
00000b98: AND
00000b99: JUMP
00000b9a: JUMPDEST
00000b9b: SWAP1
00000b9c: PUSH4 0xffffffff
00000ba1: PUSH2 0x1126
00000ba4: AND
00000ba5: JUMP
00000ba6: JUMPDEST
00000ba7: SWAP1
00000ba8: POP
00000ba9: PUSH1 0x02
00000bab: DUP7
00000bac: PUSH1 0xff
00000bae: AND
00000baf: PUSH1 0x04
00000bb1: DUP2
00000bb2: LT
00000bb3: PUSH2 0x0bb8
00000bb6: JUMPI
00000bb7: INVALID
00000bb8: JUMPDEST
00000bb9: PUSH1 0x02
00000bbb: MUL
00000bbc: ADD
00000bbd: SLOAD
00000bbe: DUP2
00000bbf: GT
00000bc0: ISZERO
00000bc1: PUSH2 0x0bd1
00000bc4: JUMPI
00000bc5: PUSH1 0x00
00000bc7: SWAP5
00000bc8: POP
00000bc9: POP
00000bca: POP
00000bcb: POP
00000bcc: POP
00000bcd: PUSH2 0x0bda
00000bd0: JUMP
00000bd1: JUMPDEST
00000bd2: PUSH1 0x01
00000bd4: SWAP5
00000bd5: POP
00000bd6: POP
00000bd7: POP
00000bd8: POP
00000bd9: POP
00000bda: JUMPDEST
00000bdb: SWAP3
00000bdc: SWAP2
00000bdd: POP
00000bde: POP
00000bdf: JUMP
00000be0: JUMPDEST
00000be1: PUSH20 0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
00000bf6: SWAP1
00000bf7: JUMP
00000bf8: JUMPDEST
00000bf9: PUSH1 0x00
00000bfb: DUP1
00000bfc: JUMPDEST
00000bfd: PUSH1 0x04
00000bff: DUP2
00000c00: PUSH1 0xff
00000c02: AND
00000c03: LT
00000c04: ISZERO
00000c05: PUSH2 0x0c1d
00000c08: JUMPI
00000c09: PUSH2 0x0c11
00000c0c: DUP2
00000c0d: PUSH2 0x099e
00000c10: JUMP
00000c11: JUMPDEST
00000c12: SWAP1
00000c13: SWAP2
00000c14: ADD
00000c15: SWAP1
00000c16: PUSH1 0x01
00000c18: ADD
00000c19: PUSH2 0x0bfc
00000c1c: JUMP
00000c1d: JUMPDEST
00000c1e: POP
00000c1f: SWAP1
00000c20: JUMP
00000c21: JUMPDEST
00000c22: PUSH1 0x00
00000c24: SLOAD
00000c25: PUSH3 0x010000
00000c29: SWAP1
00000c2a: DIV
00000c2b: PUSH1 0x01
00000c2d: PUSH1 0x01
00000c2f: PUSH1 0xa0
00000c31: SHL
00000c32: SUB
00000c33: AND
00000c34: SWAP1
00000c35: JUMP
00000c36: JUMPDEST
00000c37: PUSH20 0x4ddc2d193948926d02f9b1fe9e1daa0718270ed5
00000c4c: SWAP1
00000c4d: JUMP
00000c4e: JUMPDEST
00000c4f: PUSH1 0x00
00000c51: SLOAD
00000c52: PUSH3 0x010000
00000c56: SWAP1
00000c57: DIV
00000c58: PUSH1 0x01
00000c5a: PUSH1 0x01
00000c5c: PUSH1 0xa0
00000c5e: SHL
00000c5f: SUB
00000c60: AND
00000c61: CALLER
00000c62: EQ
00000c63: PUSH2 0x0cb3
00000c66: JUMPI
00000c67: PUSH1 0x40
00000c69: DUP1
00000c6a: MLOAD
00000c6b: PUSH3 0x461bcd
00000c6f: PUSH1 0xe5
00000c71: SHL
00000c72: DUP2
00000c73: MSTORE
00000c74: PUSH1 0x20
00000c76: PUSH1 0x04
00000c78: DUP3
00000c79: ADD
00000c7a: MSTORE
00000c7b: PUSH1 0x1f
00000c7d: PUSH1 0x24
00000c7f: DUP3
00000c80: ADD
00000c81: MSTORE
00000c82: PUSH32 0x4372656469744649463a20556e617574686f72697a6564207265717565737400
00000ca3: PUSH1 0x44
00000ca5: DUP3
00000ca6: ADD
00000ca7: MSTORE
00000ca8: SWAP1
00000ca9: MLOAD
00000caa: SWAP1
00000cab: DUP2
00000cac: SWAP1
00000cad: SUB
00000cae: PUSH1 0x64
00000cb0: ADD
00000cb1: SWAP1
00000cb2: REVERT
00000cb3: JUMPDEST
00000cb4: PUSH1 0x40
00000cb6: DUP1
00000cb7: MLOAD
00000cb8: PUSH1 0x80
00000cba: DUP2
00000cbb: DUP2
00000cbc: ADD
00000cbd: SWAP1
00000cbe: SWAP3
00000cbf: MSTORE
00000cc0: PUSH2 0x0ce1
00000cc3: SWAP2
00000cc4: DUP4
00000cc5: SWAP1
00000cc6: PUSH1 0x04
00000cc8: SWAP1
00000cc9: DUP4
00000cca: SWAP1
00000ccb: DUP4
00000ccc: SWAP1
00000ccd: DUP1
00000cce: DUP3
00000ccf: DUP5
00000cd0: CALLDATACOPY
00000cd1: PUSH1 0x00
00000cd3: SWAP3
00000cd4: ADD
00000cd5: SWAP2
00000cd6: SWAP1
00000cd7: SWAP2
00000cd8: MSTORE
00000cd9: POP
00000cda: PUSH2 0x0f45
00000cdd: SWAP2
00000cde: POP
00000cdf: POP
00000ce0: JUMP
00000ce1: JUMPDEST
00000ce2: PUSH1 0x40
00000ce4: DUP1
00000ce5: MLOAD
00000ce6: DUP3
00000ce7: CALLDATALOAD
00000ce8: DUP2
00000ce9: MSTORE
00000cea: PUSH1 0x20
00000cec: DUP1
00000ced: DUP5
00000cee: ADD
00000cef: CALLDATALOAD
00000cf0: SWAP1
00000cf1: DUP3
00000cf2: ADD
00000cf3: MSTORE
00000cf4: DUP2
00000cf5: DUP4
00000cf6: ADD
00000cf7: CALLDATALOAD
00000cf8: DUP2
00000cf9: DUP4
00000cfa: ADD
00000cfb: MSTORE
00000cfc: PUSH1 0x60
00000cfe: DUP1
00000cff: DUP5
00000d00: ADD
00000d01: CALLDATALOAD
00000d02: SWAP1
00000d03: DUP3
00000d04: ADD
00000d05: MSTORE
00000d06: SWAP1
00000d07: MLOAD
00000d08: PUSH32 0x94e5b382c1f48774cbbcb88b099e6795b759b36a99a7872ccd66df0d4678f2ed
00000d29: SWAP2
00000d2a: DUP2
00000d2b: SWAP1
00000d2c: SUB
00000d2d: PUSH1 0x80
00000d2f: ADD
00000d30: SWAP1
00000d31: LOG1
00000d32: POP
00000d33: JUMP
00000d34: JUMPDEST
00000d35: PUSH1 0x00
00000d37: PUSH2 0x0d3e
00000d3a: PUSH2 0x0c36
00000d3d: JUMP
00000d3e: JUMPDEST
00000d3f: PUSH1 0x40
00000d41: DUP1
00000d42: MLOAD
00000d43: PUSH4 0x3af9e669
00000d48: PUSH1 0xe0
00000d4a: SHL
00000d4b: DUP2
00000d4c: MSTORE
00000d4d: ADDRESS
00000d4e: PUSH1 0x04
00000d50: DUP3
00000d51: ADD
00000d52: MSTORE
00000d53: SWAP1
00000d54: MLOAD
00000d55: SWAP2
00000d56: SWAP3
00000d57: POP
00000d58: PUSH1 0x00
00000d5a: SWAP2
00000d5b: PUSH1 0x01
00000d5d: PUSH1 0x01
00000d5f: PUSH1 0xa0
00000d61: SHL
00000d62: SUB
00000d63: DUP5
00000d64: AND
00000d65: SWAP2
00000d66: PUSH4 0x3af9e669
00000d6b: SWAP2
00000d6c: PUSH1 0x24
00000d6e: DUP1
00000d6f: DUP4
00000d70: ADD
00000d71: SWAP3
00000d72: PUSH1 0x20
00000d74: SWAP3
00000d75: SWAP2
00000d76: SWAP1
00000d77: DUP3
00000d78: SWAP1
00000d79: SUB
00000d7a: ADD
00000d7b: DUP2
00000d7c: DUP8
00000d7d: DUP8
00000d7e: DUP1
00000d7f: EXTCODESIZE
00000d80: ISZERO
00000d81: DUP1
00000d82: ISZERO
00000d83: PUSH2 0x0d8b
00000d86: JUMPI
00000d87: PUSH1 0x00
00000d89: DUP1
00000d8a: REVERT
00000d8b: JUMPDEST
00000d8c: POP
00000d8d: GAS
00000d8e: CALL
00000d8f: ISZERO
00000d90: DUP1
00000d91: ISZERO
00000d92: PUSH2 0x0d9f
00000d95: JUMPI
00000d96: RETURNDATASIZE
00000d97: PUSH1 0x00
00000d99: DUP1
00000d9a: RETURNDATACOPY
00000d9b: RETURNDATASIZE
00000d9c: PUSH1 0x00
00000d9e: REVERT
00000d9f: JUMPDEST
00000da0: POP
00000da1: POP
00000da2: POP
00000da3: POP
00000da4: PUSH1 0x40
00000da6: MLOAD
00000da7: RETURNDATASIZE
00000da8: PUSH1 0x20
00000daa: DUP2
00000dab: LT
00000dac: ISZERO
00000dad: PUSH2 0x0db5
00000db0: JUMPI
00000db1: PUSH1 0x00
00000db3: DUP1
00000db4: REVERT
00000db5: JUMPDEST
00000db6: POP
00000db7: MLOAD
00000db8: SWAP1
00000db9: POP
00000dba: DUP1
00000dbb: ISZERO
00000dbc: PUSH2 0x0a2c
00000dbf: JUMPI
00000dc0: PUSH1 0x00
00000dc2: DUP3
00000dc3: PUSH1 0x01
00000dc5: PUSH1 0x01
00000dc7: PUSH1 0xa0
00000dc9: SHL
00000dca: SUB
00000dcb: AND
00000dcc: PUSH4 0x852a12e3
00000dd1: DUP4
00000dd2: PUSH1 0x40
00000dd4: MLOAD
00000dd5: DUP3
00000dd6: PUSH4 0xffffffff
00000ddb: AND
00000ddc: PUSH1 0xe0
00000dde: SHL
00000ddf: DUP2
00000de0: MSTORE
00000de1: PUSH1 0x04
00000de3: ADD
00000de4: DUP1
00000de5: DUP3
00000de6: DUP2
00000de7: MSTORE
00000de8: PUSH1 0x20
00000dea: ADD
00000deb: SWAP2
00000dec: POP
00000ded: POP
00000dee: PUSH1 0x20
00000df0: PUSH1 0x40
00000df2: MLOAD
00000df3: DUP1
00000df4: DUP4
00000df5: SUB
00000df6: DUP2
00000df7: PUSH1 0x00
00000df9: DUP8
00000dfa: DUP1
00000dfb: EXTCODESIZE
00000dfc: ISZERO
00000dfd: DUP1
00000dfe: ISZERO
00000dff: PUSH2 0x0e07
00000e02: JUMPI
00000e03: PUSH1 0x00
00000e05: DUP1
00000e06: REVERT
00000e07: JUMPDEST
00000e08: POP
00000e09: GAS
00000e0a: CALL
00000e0b: ISZERO
00000e0c: DUP1
00000e0d: ISZERO
00000e0e: PUSH2 0x0e1b
00000e11: JUMPI
00000e12: RETURNDATASIZE
00000e13: PUSH1 0x00
00000e15: DUP1
00000e16: RETURNDATACOPY
00000e17: RETURNDATASIZE
00000e18: PUSH1 0x00
00000e1a: REVERT
00000e1b: JUMPDEST
00000e1c: POP
00000e1d: POP
00000e1e: POP
00000e1f: POP
00000e20: PUSH1 0x40
00000e22: MLOAD
00000e23: RETURNDATASIZE
00000e24: PUSH1 0x20
00000e26: DUP2
00000e27: LT
00000e28: ISZERO
00000e29: PUSH2 0x0e31
00000e2c: JUMPI
00000e2d: PUSH1 0x00
00000e2f: DUP1
00000e30: REVERT
00000e31: JUMPDEST
00000e32: POP
00000e33: MLOAD
00000e34: SWAP1
00000e35: POP
00000e36: DUP1
00000e37: ISZERO
00000e38: PUSH2 0x0e72
00000e3b: JUMPI
00000e3c: PUSH1 0x40
00000e3e: MLOAD
00000e3f: PUSH3 0x461bcd
00000e43: PUSH1 0xe5
00000e45: SHL
00000e46: DUP2
00000e47: MSTORE
00000e48: PUSH1 0x04
00000e4a: ADD
00000e4b: DUP1
00000e4c: DUP1
00000e4d: PUSH1 0x20
00000e4f: ADD
00000e50: DUP3
00000e51: DUP2
00000e52: SUB
00000e53: DUP3
00000e54: MSTORE
00000e55: PUSH1 0x27
00000e57: DUP2
00000e58: MSTORE
00000e59: PUSH1 0x20
00000e5b: ADD
00000e5c: DUP1
00000e5d: PUSH2 0x14d1
00000e60: PUSH1 0x27
00000e62: SWAP2
00000e63: CODECOPY
00000e64: PUSH1 0x40
00000e66: ADD
00000e67: SWAP2
00000e68: POP
00000e69: POP
00000e6a: PUSH1 0x40
00000e6c: MLOAD
00000e6d: DUP1
00000e6e: SWAP2
00000e6f: SUB
00000e70: SWAP1
00000e71: REVERT
00000e72: JUMPDEST
00000e73: PUSH1 0x03
00000e75: SLOAD
00000e76: PUSH1 0x40
00000e78: DUP1
00000e79: MLOAD
00000e7a: PUSH4 0x01a610e5
00000e7f: PUSH1 0xe6
00000e81: SHL
00000e82: DUP2
00000e83: MSTORE
00000e84: PUSH32 0x1be57b66523678295077340a3527d37915b8de6e1e3218c7e176ae2d1f922530
00000ea5: PUSH1 0x04
00000ea7: DUP3
00000ea8: ADD
00000ea9: MSTORE
00000eaa: SWAP1
00000eab: MLOAD
00000eac: PUSH1 0x00
00000eae: SWAP3
00000eaf: PUSH2 0x0f2f
00000eb2: SWAP3
00000eb3: PUSH2 0x2710
00000eb6: SWAP3
00000eb7: PUSH2 0x0ac1
00000eba: SWAP3
00000ebb: SWAP2
00000ebc: PUSH20 0x550bf90cf0a0478a9b1f9b6d0b45a4c8268b1d86
00000ed1: SWAP2
00000ed2: PUSH4 0x69843940
00000ed7: SWAP2
00000ed8: PUSH1 0x24
00000eda: DUP1
00000edb: DUP3
00000edc: ADD
00000edd: SWAP3
00000ede: PUSH1 0x20
00000ee0: SWAP3
00000ee1: SWAP1
00000ee2: SWAP2
00000ee3: SWAP1
00000ee4: DUP3
00000ee5: SWAP1
00000ee6: SUB
00000ee7: ADD
00000ee8: DUP2
00000ee9: DUP7
00000eea: DUP1
00000eeb: EXTCODESIZE
00000eec: ISZERO
00000eed: DUP1
00000eee: ISZERO
00000eef: PUSH2 0x0ef7
00000ef2: JUMPI
00000ef3: PUSH1 0x00
00000ef5: DUP1
00000ef6: REVERT
00000ef7: JUMPDEST
00000ef8: POP
00000ef9: GAS
00000efa: STATICCALL
00000efb: ISZERO
00000efc: DUP1
00000efd: ISZERO
00000efe: PUSH2 0x0f0b
00000f01: JUMPI
00000f02: RETURNDATASIZE
00000f03: PUSH1 0x00
00000f05: DUP1
00000f06: RETURNDATACOPY
00000f07: RETURNDATASIZE
00000f08: PUSH1 0x00
00000f0a: REVERT
00000f0b: JUMPDEST
00000f0c: POP
00000f0d: POP
00000f0e: POP
00000f0f: POP
00000f10: PUSH1 0x40
00000f12: MLOAD
00000f13: RETURNDATASIZE
00000f14: PUSH1 0x20
00000f16: DUP2
00000f17: LT
00000f18: ISZERO
00000f19: PUSH2 0x0f21
00000f1c: JUMPI
00000f1d: PUSH1 0x00
00000f1f: DUP1
00000f20: REVERT
00000f21: JUMPDEST
00000f22: POP
00000f23: MLOAD
00000f24: SWAP1
00000f25: PUSH4 0xffffffff
00000f2a: PUSH2 0x1126
00000f2d: AND
00000f2e: JUMP
00000f2f: JUMPDEST
00000f30: PUSH1 0x00
00000f32: PUSH1 0x03
00000f34: SSTORE
00000f35: SWAP1
00000f36: POP
00000f37: PUSH2 0x0b14
00000f3a: DUP2
00000f3b: PUSH2 0x1267
00000f3e: JUMP
00000f3f: JUMPDEST
00000f40: ADDRESS
00000f41: EXTCODESIZE
00000f42: ISZERO
00000f43: SWAP1
00000f44: JUMP
00000f45: JUMPDEST
00000f46: PUSH1 0x60
00000f48: DUP2
00000f49: ADD
00000f4a: MLOAD
00000f4b: PUSH1 0x40
00000f4d: DUP3
00000f4e: ADD
00000f4f: MLOAD
00000f50: PUSH1 0x20
00000f52: DUP4
00000f53: ADD
00000f54: MLOAD
00000f55: DUP4
00000f56: MLOAD
00000f57: ADD
00000f58: ADD
00000f59: ADD
00000f5a: PUSH1 0x64
00000f5c: EQ
00000f5d: PUSH2 0x0f97
00000f60: JUMPI
00000f61: PUSH1 0x40
00000f63: MLOAD
00000f64: PUSH3 0x461bcd
00000f68: PUSH1 0xe5
00000f6a: SHL
00000f6b: DUP2
00000f6c: MSTORE
00000f6d: PUSH1 0x04
00000f6f: ADD
00000f70: DUP1
00000f71: DUP1
00000f72: PUSH1 0x20
00000f74: ADD
00000f75: DUP3
00000f76: DUP2
00000f77: SUB
00000f78: DUP3
00000f79: MSTORE
00000f7a: PUSH1 0x25
00000f7c: DUP2
00000f7d: MSTORE
00000f7e: PUSH1 0x20
00000f80: ADD
00000f81: DUP1
00000f82: PUSH2 0x142f
00000f85: PUSH1 0x25
00000f87: SWAP2
00000f88: CODECOPY
00000f89: PUSH1 0x40
00000f8b: ADD
00000f8c: SWAP2
00000f8d: POP
00000f8e: POP
00000f8f: PUSH1 0x40
00000f91: MLOAD
00000f92: DUP1
00000f93: SWAP2
00000f94: SUB
00000f95: SWAP1
00000f96: REVERT
00000f97: JUMPDEST
00000f98: PUSH1 0x00
00000f9a: JUMPDEST
00000f9b: PUSH1 0x04
00000f9d: DUP2
00000f9e: PUSH1 0xff
00000fa0: AND
00000fa1: LT
00000fa2: ISZERO
00000fa3: PUSH2 0x0a2c
00000fa6: JUMPI
00000fa7: DUP2
00000fa8: DUP2
00000fa9: PUSH1 0xff
00000fab: AND
00000fac: PUSH1 0x04
00000fae: DUP2
00000faf: LT
00000fb0: PUSH2 0x0fb5
00000fb3: JUMPI
00000fb4: INVALID
00000fb5: JUMPDEST
00000fb6: PUSH1 0x20
00000fb8: MUL
00000fb9: ADD
00000fba: MLOAD
00000fbb: PUSH1 0x02
00000fbd: DUP3
00000fbe: PUSH1 0xff
00000fc0: AND
00000fc1: PUSH1 0x04
00000fc3: DUP2
00000fc4: LT
00000fc5: PUSH2 0x0fca
00000fc8: JUMPI
00000fc9: INVALID
00000fca: JUMPDEST
00000fcb: PUSH1 0x02
00000fcd: MUL
00000fce: ADD
00000fcf: SSTORE
00000fd0: PUSH1 0x01
00000fd2: ADD
00000fd3: PUSH2 0x0f9a
00000fd6: JUMP
00000fd7: JUMPDEST
00000fd8: PUSH1 0x40
00000fda: MLOAD
00000fdb: PUSH1 0x01
00000fdd: PUSH1 0x01
00000fdf: PUSH1 0xa0
00000fe1: SHL
00000fe2: SUB
00000fe3: DUP4
00000fe4: AND
00000fe5: SWAP1
00000fe6: DUP3
00000fe7: ISZERO
00000fe8: PUSH2 0x08fc
00000feb: MUL
00000fec: SWAP1
00000fed: DUP4
00000fee: SWAP1
00000fef: PUSH1 0x00
00000ff1: DUP2
00000ff2: DUP2
00000ff3: DUP2
00000ff4: DUP6
00000ff5: DUP9
00000ff6: DUP9
00000ff7: CALL
00000ff8: SWAP4
00000ff9: POP
00000ffa: POP
00000ffb: POP
00000ffc: POP
00000ffd: ISZERO
00000ffe: DUP1
00000fff: ISZERO
00001000: PUSH2 0x06f2
00001003: JUMPI
00001004: RETURNDATASIZE
00001005: PUSH1 0x00
00001007: DUP1
00001008: RETURNDATACOPY
00001009: RETURNDATASIZE
0000100a: PUSH1 0x00
0000100c: REVERT
0000100d: JUMPDEST
0000100e: PUSH1 0x01
00001010: PUSH1 0x01
00001012: PUSH1 0xa0
00001014: SHL
00001015: SUB
00001016: DUP2
00001017: AND
00001018: PUSH1 0x00
0000101a: SWAP1
0000101b: DUP2
0000101c: MSTORE
0000101d: PUSH1 0x01
0000101f: PUSH1 0x20
00001021: MSTORE
00001022: PUSH1 0x40
00001024: SWAP1
00001025: KECCAK256
00001026: SLOAD
00001027: PUSH1 0xff
00001029: AND
0000102a: PUSH2 0x1054
0000102d: JUMPI
0000102e: PUSH1 0x01
00001030: PUSH1 0x01
00001032: PUSH1 0xa0
00001034: SHL
00001035: SUB
00001036: DUP2
00001037: AND
00001038: PUSH1 0x00
0000103a: SWAP1
0000103b: DUP2
0000103c: MSTORE
0000103d: PUSH1 0x01
0000103f: PUSH1 0x20
00001041: DUP2
00001042: SWAP1
00001043: MSTORE
00001044: PUSH1 0x40
00001046: SWAP1
00001047: SWAP2
00001048: KECCAK256
00001049: DUP1
0000104a: SLOAD
0000104b: PUSH1 0xff
0000104d: NOT
0000104e: AND
0000104f: SWAP1
00001050: SWAP2
00001051: OR
00001052: SWAP1
00001053: SSTORE
00001054: JUMPDEST
00001055: POP
00001056: JUMP
00001057: JUMPDEST
00001058: PUSH1 0x00
0000105a: PUSH2 0x1062
0000105d: DUP3
0000105e: PUSH2 0x0964
00001061: JUMP
00001062: JUMPDEST
00001063: SWAP1
00001064: POP
00001065: DUP3
00001066: PUSH1 0x02
00001068: DUP3
00001069: PUSH1 0xff
0000106b: AND
0000106c: PUSH1 0x04
0000106e: DUP2
0000106f: LT
00001070: PUSH2 0x1075
00001073: JUMPI
00001074: INVALID
00001075: JUMPDEST
00001076: PUSH1 0x02
00001078: MUL
00001079: ADD
0000107a: PUSH1 0x01
0000107c: ADD
0000107d: PUSH1 0x00
0000107f: DUP3
00001080: DUP3
00001081: SLOAD
00001082: ADD
00001083: SWAP3
00001084: POP
00001085: POP
00001086: DUP2
00001087: SWAP1
00001088: SSTORE
00001089: POP
0000108a: POP
0000108b: POP
0000108c: POP
0000108d: JUMP
0000108e: JUMPDEST
0000108f: PUSH1 0x00
00001091: PUSH2 0x1099
00001094: DUP3
00001095: PUSH2 0x0964
00001098: JUMP
00001099: JUMPDEST
0000109a: SWAP1
0000109b: POP
0000109c: DUP3
0000109d: PUSH1 0x02
0000109f: DUP3
000010a0: PUSH1 0xff
000010a2: AND
000010a3: PUSH1 0x04
000010a5: DUP2
000010a6: LT
000010a7: PUSH2 0x10ac
000010aa: JUMPI
000010ab: INVALID
000010ac: JUMPDEST
000010ad: PUSH1 0x02
000010af: MUL
000010b0: ADD
000010b1: PUSH1 0x01
000010b3: ADD
000010b4: PUSH1 0x00
000010b6: DUP3
000010b7: DUP3
000010b8: SLOAD
000010b9: SUB
000010ba: SWAP3
000010bb: POP
000010bc: POP
000010bd: DUP2
000010be: SWAP1
000010bf: SSTORE
000010c0: POP
000010c1: POP
000010c2: POP
000010c3: POP
000010c4: JUMP
000010c5: JUMPDEST
000010c6: PUSH1 0x00
000010c8: DUP3
000010c9: DUP3
000010ca: ADD
000010cb: DUP4
000010cc: DUP2
000010cd: LT
000010ce: ISZERO
000010cf: PUSH2 0x111f
000010d2: JUMPI
000010d3: PUSH1 0x40
000010d5: DUP1
000010d6: MLOAD
000010d7: PUSH3 0x461bcd
000010db: PUSH1 0xe5
000010dd: SHL
000010de: DUP2
000010df: MSTORE
000010e0: PUSH1 0x20
000010e2: PUSH1 0x04
000010e4: DUP3
000010e5: ADD
000010e6: MSTORE
000010e7: PUSH1 0x1b
000010e9: PUSH1 0x24
000010eb: DUP3
000010ec: ADD
000010ed: MSTORE
000010ee: PUSH32 0x536166654d6174683a206164646974696f6e206f766572666c6f770000000000
0000110f: PUSH1 0x44
00001111: DUP3
00001112: ADD
00001113: MSTORE
00001114: SWAP1
00001115: MLOAD
00001116: SWAP1
00001117: DUP2
00001118: SWAP1
00001119: SUB
0000111a: PUSH1 0x64
0000111c: ADD
0000111d: SWAP1
0000111e: REVERT
0000111f: JUMPDEST
00001120: SWAP4
00001121: SWAP3
00001122: POP
00001123: POP
00001124: POP
00001125: JUMP
00001126: JUMPDEST
00001127: PUSH1 0x00
00001129: DUP3
0000112a: PUSH2 0x1135
0000112d: JUMPI
0000112e: POP
0000112f: PUSH1 0x00
00001131: PUSH2 0x0bda
00001134: JUMP
00001135: JUMPDEST
00001136: DUP3
00001137: DUP3
00001138: MUL
00001139: DUP3
0000113a: DUP5
0000113b: DUP3
0000113c: DUP2
0000113d: PUSH2 0x1142
00001140: JUMPI
00001141: INVALID
00001142: JUMPDEST
00001143: DIV
00001144: EQ
00001145: PUSH2 0x111f
00001148: JUMPI
00001149: PUSH1 0x40
0000114b: MLOAD
0000114c: PUSH3 0x461bcd
00001150: PUSH1 0xe5
00001152: SHL
00001153: DUP2
00001154: MSTORE
00001155: PUSH1 0x04
00001157: ADD
00001158: DUP1
00001159: DUP1
0000115a: PUSH1 0x20
0000115c: ADD
0000115d: DUP3
0000115e: DUP2
0000115f: SUB
00001160: DUP3
00001161: MSTORE
00001162: PUSH1 0x21
00001164: DUP2
00001165: MSTORE
00001166: PUSH1 0x20
00001168: ADD
00001169: DUP1
0000116a: PUSH2 0x14b0
0000116d: PUSH1 0x21
0000116f: SWAP2
00001170: CODECOPY
00001171: PUSH1 0x40
00001173: ADD
00001174: SWAP2
00001175: POP
00001176: POP
00001177: PUSH1 0x40
00001179: MLOAD
0000117a: DUP1
0000117b: SWAP2
0000117c: SUB
0000117d: SWAP1
0000117e: REVERT
0000117f: JUMPDEST
00001180: PUSH1 0x00
00001182: PUSH2 0x111f
00001185: DUP4
00001186: DUP4
00001187: PUSH1 0x40
00001189: MLOAD
0000118a: DUP1
0000118b: PUSH1 0x40
0000118d: ADD
0000118e: PUSH1 0x40
00001190: MSTORE
00001191: DUP1
00001192: PUSH1 0x1a
00001194: DUP2
00001195: MSTORE
00001196: PUSH1 0x20
00001198: ADD
00001199: PUSH32 0x536166654d6174683a206469766973696f6e206279207a65726f000000000000
000011ba: DUP2
000011bb: MSTORE
000011bc: POP
000011bd: PUSH2 0x1314
000011c0: JUMP
000011c1: JUMPDEST
000011c2: PUSH1 0x00
000011c4: PUSH2 0x111f
000011c7: DUP4
000011c8: DUP4
000011c9: PUSH1 0x40
000011cb: MLOAD
000011cc: DUP1
000011cd: PUSH1 0x40
000011cf: ADD
000011d0: PUSH1 0x40
000011d2: MSTORE
000011d3: DUP1
000011d4: PUSH1 0x1e
000011d6: DUP2
000011d7: MSTORE
000011d8: PUSH1 0x20
000011da: ADD
000011db: PUSH32 0x536166654d6174683a207375627472616374696f6e206f766572666c6f770000
000011fc: DUP2
000011fd: MSTORE
000011fe: POP
000011ff: PUSH2 0x13b6
00001202: JUMP
00001203: JUMPDEST
00001204: PUSH1 0x00
00001206: PUSH2 0x120d
00001209: PUSH2 0x0c36
0000120c: JUMP
0000120d: JUMPDEST
0000120e: SWAP1
0000120f: POP
00001210: DUP1
00001211: PUSH1 0x01
00001213: PUSH1 0x01
00001215: PUSH1 0xa0
00001217: SHL
00001218: SUB
00001219: AND
0000121a: PUSH4 0x1249c58b
0000121f: DUP4
00001220: PUSH1 0x40
00001222: MLOAD
00001223: DUP3
00001224: PUSH4 0xffffffff
00001229: AND
0000122a: PUSH1 0xe0
0000122c: SHL
0000122d: DUP2
0000122e: MSTORE
0000122f: PUSH1 0x04
00001231: ADD
00001232: PUSH1 0x00
00001234: PUSH1 0x40
00001236: MLOAD
00001237: DUP1
00001238: DUP4
00001239: SUB
0000123a: DUP2
0000123b: DUP6
0000123c: DUP9
0000123d: DUP1
0000123e: EXTCODESIZE
0000123f: ISZERO
00001240: DUP1
00001241: ISZERO
00001242: PUSH2 0x124a
00001245: JUMPI
00001246: PUSH1 0x00
00001248: DUP1
00001249: REVERT
0000124a: JUMPDEST
0000124b: POP
0000124c: GAS
0000124d: CALL
0000124e: ISZERO
0000124f: DUP1
00001250: ISZERO
00001251: PUSH2 0x125e
00001254: JUMPI
00001255: RETURNDATASIZE
00001256: PUSH1 0x00
00001258: DUP1
00001259: RETURNDATACOPY
0000125a: RETURNDATASIZE
0000125b: PUSH1 0x00
0000125d: REVERT
0000125e: JUMPDEST
0000125f: POP
00001260: POP
00001261: POP
00001262: POP
00001263: POP
00001264: POP
00001265: POP
00001266: JUMP
00001267: JUMPDEST
00001268: PUSH1 0x40
0000126a: DUP1
0000126b: MLOAD
0000126c: PUSH4 0x21f8a721
00001271: PUSH1 0xe0
00001273: SHL
00001274: DUP2
00001275: MSTORE
00001276: PUSH32 0xcbc3019154635bc9d83c4767ef7c360258e1886a6895b5091421f1f65aba8e96
00001297: PUSH1 0x04
00001299: DUP3
0000129a: ADD
0000129b: MSTORE
0000129c: SWAP1
0000129d: MLOAD
0000129e: PUSH1 0x00
000012a0: SWAP2
000012a1: PUSH20 0x550bf90cf0a0478a9b1f9b6d0b45a4c8268b1d86
000012b6: SWAP2
000012b7: PUSH4 0x21f8a721
000012bc: SWAP2
000012bd: PUSH1 0x24
000012bf: DUP1
000012c0: DUP3
000012c1: ADD
000012c2: SWAP3
000012c3: PUSH1 0x20
000012c5: SWAP3
000012c6: SWAP1
000012c7: SWAP2
000012c8: SWAP1
000012c9: DUP3
000012ca: SWAP1
000012cb: SUB
000012cc: ADD
000012cd: DUP2
000012ce: DUP7
000012cf: DUP1
000012d0: EXTCODESIZE
000012d1: ISZERO
000012d2: DUP1
000012d3: ISZERO
000012d4: PUSH2 0x12dc
000012d7: JUMPI
000012d8: PUSH1 0x00
000012da: DUP1
000012db: REVERT
000012dc: JUMPDEST
000012dd: POP
000012de: GAS
000012df: STATICCALL
000012e0: ISZERO
000012e1: DUP1
000012e2: ISZERO
000012e3: PUSH2 0x12f0
000012e6: JUMPI
000012e7: RETURNDATASIZE
000012e8: PUSH1 0x00
000012ea: DUP1
000012eb: RETURNDATACOPY
000012ec: RETURNDATASIZE
000012ed: PUSH1 0x00
000012ef: REVERT
000012f0: JUMPDEST
000012f1: POP
000012f2: POP
000012f3: POP
000012f4: POP
000012f5: PUSH1 0x40
000012f7: MLOAD
000012f8: RETURNDATASIZE
000012f9: PUSH1 0x20
000012fb: DUP2
000012fc: LT
000012fd: ISZERO
000012fe: PUSH2 0x1306
00001301: JUMPI
00001302: PUSH1 0x00
00001304: DUP1
00001305: REVERT
00001306: JUMPDEST
00001307: POP
00001308: MLOAD
00001309: SWAP1
0000130a: POP
0000130b: PUSH2 0x0a2c
0000130e: DUP2
0000130f: DUP4
00001310: PUSH2 0x0fd7
00001313: JUMP
00001314: JUMPDEST
00001315: PUSH1 0x00
00001317: DUP2
00001318: DUP4
00001319: PUSH2 0x13a0
0000131c: JUMPI
0000131d: PUSH1 0x40
0000131f: MLOAD
00001320: PUSH3 0x461bcd
00001324: PUSH1 0xe5
00001326: SHL
00001327: DUP2
00001328: MSTORE
00001329: PUSH1 0x04
0000132b: ADD
0000132c: DUP1
0000132d: DUP1
0000132e: PUSH1 0x20
00001330: ADD
00001331: DUP3
00001332: DUP2
00001333: SUB
00001334: DUP3
00001335: MSTORE
00001336: DUP4
00001337: DUP2
00001338: DUP2
00001339: MLOAD
0000133a: DUP2
0000133b: MSTORE
0000133c: PUSH1 0x20
0000133e: ADD
0000133f: SWAP2
00001340: POP
00001341: DUP1
00001342: MLOAD
00001343: SWAP1
00001344: PUSH1 0x20
00001346: ADD
00001347: SWAP1
00001348: DUP1
00001349: DUP4
0000134a: DUP4
0000134b: PUSH1 0x00
0000134d: JUMPDEST
0000134e: DUP4
0000134f: DUP2
00001350: LT
00001351: ISZERO
00001352: PUSH2 0x1365
00001355: JUMPI
00001356: DUP2
00001357: DUP2
00001358: ADD
00001359: MLOAD
0000135a: DUP4
0000135b: DUP3
0000135c: ADD
0000135d: MSTORE
0000135e: PUSH1 0x20
00001360: ADD
00001361: PUSH2 0x134d
00001364: JUMP
00001365: JUMPDEST
00001366: POP
00001367: POP
00001368: POP
00001369: POP
0000136a: SWAP1
0000136b: POP
0000136c: SWAP1
0000136d: DUP2
0000136e: ADD
0000136f: SWAP1
00001370: PUSH1 0x1f
00001372: AND
00001373: DUP1
00001374: ISZERO
00001375: PUSH2 0x1392
00001378: JUMPI
00001379: DUP1
0000137a: DUP3
0000137b: SUB
0000137c: DUP1
0000137d: MLOAD
0000137e: PUSH1 0x01
00001380: DUP4
00001381: PUSH1 0x20
00001383: SUB
00001384: PUSH2 0x0100
00001387: EXP
00001388: SUB
00001389: NOT
0000138a: AND
0000138b: DUP2
0000138c: MSTORE
0000138d: PUSH1 0x20
0000138f: ADD
00001390: SWAP2
00001391: POP
00001392: JUMPDEST
00001393: POP
00001394: SWAP3
00001395: POP
00001396: POP
00001397: POP
00001398: PUSH1 0x40
0000139a: MLOAD
0000139b: DUP1
0000139c: SWAP2
0000139d: SUB
0000139e: SWAP1
0000139f: REVERT
000013a0: JUMPDEST
000013a1: POP
000013a2: PUSH1 0x00
000013a4: DUP4
000013a5: DUP6
000013a6: DUP2
000013a7: PUSH2 0x13ac
000013aa: JUMPI
000013ab: INVALID
000013ac: JUMPDEST
000013ad: DIV
000013ae: SWAP6
000013af: SWAP5
000013b0: POP
000013b1: POP
000013b2: POP
000013b3: POP
000013b4: POP
000013b5: JUMP
000013b6: JUMPDEST
000013b7: PUSH1 0x00
000013b9: DUP2
000013ba: DUP5
000013bb: DUP5
000013bc: GT
000013bd: ISZERO
000013be: PUSH2 0x1408
000013c1: JUMPI
000013c2: PUSH1 0x40
000013c4: MLOAD
000013c5: PUSH3 0x461bcd
000013c9: PUSH1 0xe5
000013cb: SHL
000013cc: DUP2
000013cd: MSTORE
000013ce: PUSH1 0x20
000013d0: PUSH1 0x04
000013d2: DUP3
000013d3: ADD
000013d4: DUP2
000013d5: DUP2
000013d6: MSTORE
000013d7: DUP4
000013d8: MLOAD
000013d9: PUSH1 0x24
000013db: DUP5
000013dc: ADD
000013dd: MSTORE
000013de: DUP4
000013df: MLOAD
000013e0: SWAP1
000013e1: SWAP3
000013e2: DUP4
000013e3: SWAP3
000013e4: PUSH1 0x44
000013e6: SWAP1
000013e7: SWAP2
000013e8: ADD
000013e9: SWAP2
000013ea: SWAP1
000013eb: DUP6
000013ec: ADD
000013ed: SWAP1
000013ee: DUP1
000013ef: DUP4
000013f0: DUP4
000013f1: PUSH1 0x00
000013f3: DUP4
000013f4: ISZERO
000013f5: PUSH2 0x1365
000013f8: JUMPI
000013f9: DUP2
000013fa: DUP2
000013fb: ADD
000013fc: MLOAD
000013fd: DUP4
000013fe: DUP3
000013ff: ADD
00001400: MSTORE
00001401: PUSH1 0x20
00001403: ADD
00001404: PUSH2 0x134d
00001407: JUMP
00001408: JUMPDEST
00001409: POP
0000140a: POP
0000140b: POP
0000140c: SWAP1
0000140d: SUB
0000140e: SWAP1
0000140f: JUMP
00001410: JUMPDEST
00001411: PUSH1 0x40
00001413: MLOAD
00001414: DUP1
00001415: PUSH1 0x80
00001417: ADD
00001418: PUSH1 0x40
0000141a: MSTORE
0000141b: DUP1
0000141c: PUSH1 0x04
0000141e: SWAP1
0000141f: PUSH1 0x20
00001421: DUP3
00001422: MUL
00001423: DUP1
00001424: CALLDATASIZE
00001425: DUP4
00001426: CALLDATACOPY
00001427: POP
00001428: SWAP2
00001429: SWAP3
0000142a: SWAP2
0000142b: POP
0000142c: POP
0000142d: JUMP
0000142e: INVALID
0000142f: NUMBER
00001430: PUSH19 0x656469744649463a2053756d2073686f756c64
00001444: KECCAK256
00001445: PUSH3 0x652065
00001449: PUSH18 0x75616c20746f203130304372656469744649
0000145c: CHAINID
0000145d: GASPRICE
0000145e: KECCAK256
0000145f: NUMBER
00001460: PUSH2 0x6c6c
00001463: PUSH6 0x72206d757374
0000146a: KECCAK256
0000146b: PUSH3 0x652053
0000146f: PUSH14 0x61727443726564697420436f6e74
0000147e: PUSH19 0x616374496e697469616c697a61626c653a2063
00001492: PUSH16 0x6e747261637420697320616c72656164
000014a3: PUSH26 0x20696e697469616c697a6564536166654d6174683a206d756c74
000014be: PUSH10 0x706c69636174696f6e20
000014c9: PUSH16 0x766572666c6f77437265646974464946
000014da: GASPRICE
000014db: KECCAK256
000014dc: MSTORE
000014dd: PUSH6 0x6465656d2046
000014e4: PUSH2 0x696c
000014e7: PUSH22 0x72652066726f6d20636f6d706f756e64a26469706673
000014fe: PC
000014ff: UNKNOWN(0x22)
00001500: SLT
00001501: KECCAK256
00001502: SWAP5
00001503: SWAP9
00001504: UNKNOWN(0xC0)
00001505: UNKNOWN(0xDD)
00001506: UNKNOWN(0xD2)
00001507: UNKNOWN(0xF7)
00001508: PUSH5 0xe655e90be5
0000150e: UNKNOWN(0x4D)
0000150f: UNKNOWN(0xC5)
00001510: UNKNOWN(0x2F)
00001511: UNKNOWN(0x28)
00001512: REVERT
00001513: PUSH26

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
medium other detector Untrusted CALL target/value reachable 45 no no
view
trace_id: 0x54d81da080d6c835582f777a55bade6f42d7ad5f818cdcc97aa06154096230ef
call_targets: 0xe97f36717a51fd61c54f35e8fb2ca49d82c121bd
target_varies: no
classification: constant_target
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x54d81da080d6c835582f777a55bade6f42d7ad5f818cdcc97aa06154096230ef",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xe97f36717a51fd61c54f35e8fb2ca49d82c121bd"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0xbfe0c27e",
            "selector": "0xbfe0c27e",
            "calldata_variants": [
                "0xbfe0c27e",
                "0xbfe0c27e0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xcb915663",
            "selector": "0xcb915663",
            "calldata_variants": [
                "0xcb915663",
                "0xcb9156630000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xe5596e0b",
            "selector": "0xe5596e0b",
            "calldata_variants": [
                "0xe5596e0b",
                "0xe5596e0b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xf23149c6",
            "selector": "0xf23149c6",
            "calldata_variants": [
                "0xf23149c6",
                "0xf23149c60000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xfe113801",
            "selector": "0xfe113801",
            "calldata_variants": [
                "0xfe113801",
                "0xfe1138010000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x85a336c5",
            "selector": "0x85a336c5",
            "calldata_variants": [
                "0x85a336c5",
                "0x85a336c50000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa281e965",
            "selector": "0xa281e965",
            "calldata_variants": [
                "0xa281e965",
                "0xa281e9650000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xab8cd46c",
            "selector": "0xab8cd46c",
            "calldata_variants": [
                "0xab8cd46c",
                "0xab8cd46c0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 3470,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 3594,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 4087,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 4,
    "guards_detected": [
        {
            "pc": 2104,
            "type": "msg_sender_eq_const",
            "value": 2.8389620141085504e+47
        },
        {
            "pc": 2631,
            "type": "msg_sender_eq_const",
            "value": 2.8389620141085504e+47
        }
    ],
    "untrusted_call_count": 4
}
medium other detector ETH value transfer possible 40 no no
view
trace_id: 0x54d81da080d6c835582f777a55bade6f42d7ad5f818cdcc97aa06154096230ef
call_targets: 0xe97f36717a51fd61c54f35e8fb2ca49d82c121bd
target_varies: no
classification: constant_target
validation_json
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x54d81da080d6c835582f777a55bade6f42d7ad5f818cdcc97aa06154096230ef",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xe97f36717a51fd61c54f35e8fb2ca49d82c121bd"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0xbfe0c27e",
            "selector": "0xbfe0c27e",
            "calldata_variants": [
                "0xbfe0c27e",
                "0xbfe0c27e0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xcb915663",
            "selector": "0xcb915663",
            "calldata_variants": [
                "0xcb915663",
                "0xcb9156630000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xe5596e0b",
            "selector": "0xe5596e0b",
            "calldata_variants": [
                "0xe5596e0b",
                "0xe5596e0b0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xf23149c6",
            "selector": "0xf23149c6",
            "calldata_variants": [
                "0xf23149c6",
                "0xf23149c60000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xfe113801",
            "selector": "0xfe113801",
            "calldata_variants": [
                "0xfe113801",
                "0xfe1138010000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x85a336c5",
            "selector": "0x85a336c5",
            "calldata_variants": [
                "0x85a336c5",
                "0x85a336c50000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xa281e965",
            "selector": "0xa281e965",
            "calldata_variants": [
                "0xa281e965",
                "0xa281e9650000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xab8cd46c",
            "selector": "0xab8cd46c",
            "calldata_variants": [
                "0xab8cd46c",
                "0xab8cd46c0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json
{
    "examples": [
        {
            "pc": 3470,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 3594,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 4087,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 4,
    "guards_detected": [
        {
            "pc": 2104,
            "type": "msg_sender_eq_const",
            "value": 2.8389620141085504e+47
        },
        {
            "pc": 2631,
            "type": "msg_sender_eq_const",
            "value": 2.8389620141085504e+47
        }
    ]
}
low other codex Owner-only function can execute arbitrary external CALLs (computed target/value) 65 no
view
evidence_json
{
    "evidence": "Bytecode shows owner check at pc:0x0c4e (caller == owner in slot0) before jumping into the main logic. The same function contains CALLs at pc:0x0d8e, pc:0x0e0a, pc:0x0ff7, pc:0x124d with targets derived via address-masking (AND with 0xa0 mask), implying computed targets. Detector findings also flag untrusted CALL target/value and possible ETH value transfer on these callsites.",
    "locations": [
        "selector:0xfe113801",
        "pc:0x0c4e",
        "pc:0x0d8e",
        "pc:0x0e0a",
        "pc:0x0ff7",
        "pc:0x124d"
    ],
    "recommendation": "Keep owner management tightly controlled (secure key management and strict ownership transfer). Consider whitelisting allowed call targets or selectors, and add a reentrancy guard around state-mutating paths that surround external CALLs if reentrancy would be unsafe.",
    "exploit_scenario": "The function reachable via selector 0xfe113801 performs multiple CALLs to addresses masked from stack values (computed targets). If the owner key is compromised, incorrectly initialized, or if access control can be bypassed, an attacker can trigger arbitrary external calls (potentially with ETH value), enabling fund drain or reentrancy into this contract\u2019s logic. If the owner is a contract, reentrancy from the external call path is also possible."
}
info other cast Heavy EXTCODE*/BALANCE usage 55 no
view
evidence_json
{
    "notes": "frequent external code or balance checks; may indicate introspection or validation logic",
    "ext_balance_count": 6
}