Analysis Run

019bb2d5-fd11-70b6-9e2a-e8a7ed77e0b7

complete

Chain ID

1

Address

0x62714bd7cb0f167c5c27445a5107ef79a886239f

Block Number

—

Created

Mon, Jan 12, 2026 3:32 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Verified

Review Backing

Not yet

Best current signal

DELEGATECALL present

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
39545	artifact.fetch	complete	1 / 3	3 months ago
39546	proxy.resolve	complete	1 / 3	3 months ago
39547	tool.cast_disasm	complete	1 / 3	3 months ago
39548	analysis.bundle	complete	1 / 3	3 months ago
39549	capability.graph	complete	1 / 3	3 months ago
39550	detector.run	complete	1 / 3	3 months ago
39551	validation.fork	complete	1 / 3	3 months ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no not_proxy

Implementation:

—

Verified Source: yes

Proxy evidence

{
    "status": "not_proxy"
}

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

No codex job recorded yet.

Opcode Heuristics

tool.cast_disasm

Delegatecall

1

Selfdestruct

0

CREATE2

0

CALL-family (heavy)

0

EXT*/BALANCE

0

Total opcodes

44

Flags

delegatecall_present

View cast disassembly output

00000000: RETURNDATASIZE
00000001: RETURNDATASIZE
00000002: RETURNDATASIZE
00000003: RETURNDATASIZE
00000004: CALLDATASIZE
00000005: RETURNDATASIZE
00000006: RETURNDATASIZE
00000007: CALLDATACOPY
00000008: PUSH1 0x3d
0000000a: PUSH1 0x35
0000000c: CALLDATASIZE
0000000d: CODECOPY
0000000e: CALLDATASIZE
0000000f: PUSH1 0x3d
00000011: ADD
00000012: RETURNDATASIZE
00000013: PUSH20 0xcd80c916b1194beb48abf007d0b79a7238436d56
00000028: GAS
00000029: DELEGATECALL
0000002a: RETURNDATASIZE
0000002b: RETURNDATASIZE
0000002c: SWAP4
0000002d: DUP1
0000002e: RETURNDATACOPY
0000002f: PUSH1 0x33
00000031: JUMPI
00000032: REVERT
00000033: JUMPDEST
00000034: RETURN
00000035: UNKNOWN(0xB1)
00000036: PUSH13 0x1342e617a5b6e4b631eb114483
00000044: REVERT
00000045: UNKNOWN(0xB2)
00000046: DUP10
00000047: UNKNOWN(0xC0)
00000048: LOG4
00000049: NUMBER
0000004a: UNKNOWN(0x2F)
0000004b: SWAP7
0000004c: UNKNOWN(0x2D)
0000004d: DUP3
0000004e: MULMOD
0000004f: PUSH25 0x1da23fb37b6b59ee15de7d98414402a0ed0ccb8f299ed8779c
00000069: PUSH23

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
medium	upgradeability	cast	DELEGATECALL present	80	no	—	view evidence_json { "notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns", "delegatecall_count": 1 }