019bb50b-e133-727a-95cf-35a36617ffba
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 40345 | artifact.fetch | complete | 1 / 3 | 3 months ago |
| 40346 | proxy.resolve | complete | 1 / 3 | 3 months ago |
| 40347 | tool.cast_disasm | complete | 1 / 3 | 3 months ago |
| 40348 | analysis.bundle | complete | 1 / 3 | 3 months ago |
| 40349 | capability.graph | complete | 1 / 3 | 3 months ago |
| 40350 | detector.run | complete | 1 / 3 | 3 months ago |
| 40351 | validation.fork | complete | 1 / 3 | 3 months ago |
| 40483 | report.consolidate | complete | 1 / 6 | 3 months ago |
| 40484 | tool.slither | failed | 2 / 2 | 3 months ago |
{
"method": "etherscan+onchain",
"status": "confirmed",
"etherscan_hint": {
"source": "etherscan",
"etherscan": {
"proxy_flag": true,
"implementation": "0x5d7b782ec34cae8b38a56c1a3487337583178466"
}
},
"implementation": "0x5d7b782ec34cae8b38a56c1a3487337583178466",
"onchain_method": "eip1967"
}
Traceback (most recent call last):
File "/var/www/tripwire/worker/worker.py", line 198, in main
payload = dispatch_job(job_type, job_id, job_meta, run_data, config, laravel_client)
File "/var/www/tripwire/worker/worker.py", line 114, in dispatch_job
return slither_run.run(job_id, job_meta, run_data, config, log, laravel_client)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/www/tripwire/worker/jobs/slither_run.py", line 1084, in run
stdout_text, stderr_text, result_json = _run_slither(
~~~~~~~~~~~~^
workspace,
^^^^^^^^^^
...<4 lines>...
target_path=target_path,
^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/var/www/tripwire/worker/jobs/slither_run.py", line 958, in _run_slither
raise RuntimeError(f"slither failed (exit {result.returncode}): {stderr_text or stdout_text}")
RuntimeError: slither failed (exit 1): 'forge clean' running (wd: /tmp/slither-mhkx21eg)
'forge config --json' running
'forge build --build-info --skip ./test/** ./script/** --force' running (wd: /tmp/slither-mhkx21eg)
'forge' returned non-zero exit code 1
Error: Encountered invalid solc version in lib/openzeppelin-contracts/contracts/proxy/beacon/BeaconProxy.sol: No solc version exists that matches the version requirement: ^0.8.22
Traceback (most recent call last):
File "/var/www/tripwire/.venv/bin/slither", line 10, in <module>
sys.exit(main())
~~~~^^
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/slither/__main__.py", line 776, in main
main_impl(all_detector_classes=detectors, all_printer_classes=printers)
~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/slither/__main__.py", line 882, in main_impl
) = process_all(filename, args, detector_classes, printer_classes)
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/slither/__main__.py", line 96, in process_all
compilations = compile_all(target, **vars(args))
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/crytic_compile.py", line 722, in compile_all
compilations.append(CryticCompile(target, **kwargs))
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/crytic_compile.py", line 211, in __init__
self._compile(**kwargs)
~~~~~~~~~~~~~^^^^^^^^^^
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/crytic_compile.py", line 633, in _compile
self._platform.compile(self, **kwargs)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/platform/foundry.py", line 102, in compile
hardhat_like_parsing(
~~~~~~~~~~~~~~~~~~~~^
crytic_compile, str(self._target), build_directory, str(self._project_root)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/platform/hardhat.py", line 52, in hardhat_like_parsing
raise InvalidCompilation(txt)
crytic_compile.platform.exceptions.InvalidCompilation: Compilation failed. Can you run build command?
/tmp/slither-mhkx21eg/out/build-info is not a directory.
{"no_findings":false,"summary":"Found 1 medium-severity accounting issue in the implementation: withdrawal tracking in `withdrawSales` can allow repeated withdrawals if sales parameters change, risking refund insolvency.","findings":[{"severity":"medium","category":"math","title":"Incorrect withdrawal accounting enables repeated sales withdrawals after parameter changes","exploit_scenario":"The owner calls `withdrawSales()` once, then later increases `wonBiddedItems` or `finalPrice` and calls `withdrawSales()` again. Because `withdrawed` is overwritten with `available` instead of accumulated, the remaining sales balance is miscomputed and can be withdrawn multiple times, draining funds needed for refunds.","recommendation":"Track withdrawals cumulatively (e.g., `withdrawed += available` or set `withdrawed = sales` after withdrawal) and consider freezing `wonBiddedItems`/`finalPrice` after the first withdrawal or adding an invariant check that total withdrawals never exceed `sales`.","evidence":"`withdrawed` is set to `available` instead of incrementing by `available`, so the tracked withdrawn total can decrease or remain stale when sales change.","locations":["contracts/BlindAuction.sol:268","contracts/BlindAuction.sol:270"]}]}
OpenAI Codex v0.77.0 (research preview)
--------
workdir: /tmp/codex-cvcgboo6
model: gpt-5.2-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: auto
session id: 019bb51f-7ba4-7100-8b1c-245699de50f4
--------
user
Context: The user requested the proxy at 0x52a494dbf47107cc0c624ee10703abecaf586776.
Audit the implementation at 0x5d7b782ec34cae8b38a56c1a3487337583178466.
Findings should refer to the implementation unless explicitly about proxy mechanics.
You are a security auditor. Audit this Solidity codebase for exploitable vulnerabilities.
Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation, oracle manipulation,
accounting/invariant breaks, external call patterns, unchecked return values, and dangerous delegatecall.
Scope rules:
- You MUST fully read `AUDIT_BUNDLE.txt` before concluding. It contains the complete contents of all first-party Solidity sources in this workspace.
- Treat `lib/` and `@openzeppelin/` as third-party dependencies; skip them unless there is a concrete misuse angle in first-party code.
- If there are only dependency files and no first-party sources, set no_findings=true and explain in summary.
Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title and file/line locations when possible.
Output constraints (IMPORTANT):
- severity MUST be exactly one of: info, low, medium, high, critical (lowercase).
- category MUST be exactly one of: access_control, reentrancy, math, oracle, upgradeability, auth, other.
Keep summary short and concrete.
mcp startup: no servers
thinking
**Reading AUDIT_BUNDLE file**
exec
/bin/bash -lc ls in /tmp/codex-cvcgboo6 succeeded in 6ms:
AUDIT_BUNDLE.txt
codex-output-schema.json
contracts
@openzeppelin
exec
/bin/bash -lc 'cat AUDIT_BUNDLE.txt' in /tmp/codex-cvcgboo6 succeeded in 6ms:
This file concatenates the full contents of first-party Solidity sources for auditing.
Do not treat dependency code under lib/ or @openzeppelin/ as first-party.
================================================================================
FILE: contracts/BlindAuction.sol
================================================================================
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
import "@openzeppelin/contracts/utils/Strings.sol";
import "@openzeppelin/contracts/utils/math/Math.sol";
import "@openzeppelin/contracts/utils/structs/EnumerableMap.sol";
import "@openzeppelin/contracts/utils/cryptography/MerkleProof.sol";
import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
import "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
// ===========================================================================================
// # # ######
// # # ###### ###### # # #### # # ####
thinking
**Analyzing withdrawSales accounting and upgrade risks**
I'm carefully examining the withdrawSales function and noticing a significant bug where the withdrawed variable gets reset instead of incremented, allowing the owner to withdraw more funds repeatedly if they manipulate sales values. This could unintentionally or maliciously drain refund funds early. Although only the owner can trigger this, the flawed accounting poses a medium-to-high risk for user funds, especially since fund segregation isn't enforced and reentrancy isn't fully guarded in owner-only withdrawals. I'm also noting potential admin errors in refund calculations and auction state management but overall these issues align with owner-central control rather than direct security vulnerabilities.
exec
/bin/bash -lc 'nl -ba contracts/BlindAuction.sol' in /tmp/codex-cvcgboo6 succeeded in 26ms:
1 // SPDX-License-Identifier: MIT
2 pragma solidity ^0.8.19;
3 import "@openzeppelin/contracts/utils/Strings.sol";
4 import "@openzeppelin/contracts/utils/math/Math.sol";
5 import "@openzeppelin/contracts/utils/structs/EnumerableMap.sol";
6 import "@openzeppelin/contracts/utils/cryptography/MerkleProof.sol";
7 import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
8 import "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";
9 import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
10 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
11
12 // ===========================================================================================
13 // # # ######
14 // # # ###### ###### # # #### # # ####
15 // # # # # # # # # ## # # #
16 // ####### ##### ##### # # # # # # # #
17 // # # # # # # # # # # # # ###
18 // # # # # # # # # # ## # #
19 // # # ###### ###### ###### #### # # ####
20 //
thinking
**Summarizing withdrawal accounting bug**
codex
{"no_findings":false,"summary":"Found 1 medium-severity accounting issue in the implementation: withdrawal tracking in `withdrawSales` can allow repeated withdrawals if sales parameters change, risking refund insolvency.","findings":[{"severity":"medium","category":"math","title":"Incorrect withdrawal accounting enables repeated sales withdrawals after parameter changes","exploit_scenario":"The owner calls `withdrawSales()` once, then later increases `wonBiddedItems` or `finalPrice` and calls `withdrawSales()` again. Because `withdrawed` is overwritten with `available` instead of accumulated, the remaining sales balance is miscomputed and can be withdrawn multiple times, draining funds needed for refunds.","recommendation":"Track withdrawals cumulatively (e.g., `withdrawed += available` or set `withdrawed = sales` after withdrawal) and consider freezing `wonBiddedItems`/`finalPrice` after the first withdrawal or adding an invariant check that total withdrawals never exceed `sales`.","evidence":"`withdrawed` is set to `available` instead of incrementing by `available`, so the tracked withdrawn total can decrease or remain stale when sales change.","locations":["contracts/BlindAuction.sol:268","contracts/BlindAuction.sol:270"]}]}
tokens used
20,327
{
"codex": {
"ran_at": "2026-01-13T02:13:03.127623+00:00",
"returncode": 0
},
"project": {
"mode": "source",
"file_count": 12,
"import_count": 14,
"first_party_contracts_count": 1
},
"summary": "Found 1 medium-severity accounting issue in the implementation: withdrawal tracking in `withdrawSales` can allow repeated withdrawals if sales parameters change, risking refund insolvency.",
"raw_final": {
"summary": "Found 1 medium-severity accounting issue in the implementation: withdrawal tracking in `withdrawSales` can allow repeated withdrawals if sales parameters change, risking refund insolvency.",
"findings": [
{
"title": "Incorrect withdrawal accounting enables repeated sales withdrawals after parameter changes",
"category": "math",
"evidence": "`withdrawed` is set to `available` instead of incrementing by `available`, so the tracked withdrawn total can decrease or remain stale when sales change.",
"severity": "medium",
"locations": [
"contracts/BlindAuction.sol:268",
"contracts/BlindAuction.sol:270"
],
"recommendation": "Track withdrawals cumulatively (e.g., `withdrawed += available` or set `withdrawed = sales` after withdrawal) and consider freezing `wonBiddedItems`/`finalPrice` after the first withdrawal or adding an invariant check that total withdrawals never exceed `sales`.",
"exploit_scenario": "The owner calls `withdrawSales()` once, then later increases `wonBiddedItems` or `finalPrice` and calls `withdrawSales()` again. Because `withdrawed` is overwritten with `available` instead of accumulated, the remaining sales balance is miscomputed and can be withdrawn multiple times, draining funds needed for refunds."
}
],
"no_findings": false
},
"no_findings": false,
"proxy_context": {
"proxy_run_id": "019bb50b-e133-727a-95cf-35a36617ffba",
"proxy_address": "0x52a494dbf47107cc0c624ee10703abecaf586776",
"implementation_run_id": "019bb50c-36be-73f5-8aa5-abd83ca7a6ba",
"implementation_address": "0x5d7b782ec34cae8b38a56c1a3487337583178466"
},
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x004e 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH1 0xe0 00000012: SHR 00000013: DUP1 00000014: PUSH4 0x3659cfe6 00000019: EQ 0000001a: PUSH2 0x0065 0000001d: JUMPI 0000001e: DUP1 0000001f: PUSH4 0x4f1ef286 00000024: EQ 00000025: PUSH2 0x0085 00000028: JUMPI 00000029: DUP1 0000002a: PUSH4 0x5c60da1b 0000002f: EQ 00000030: PUSH2 0x0098 00000033: JUMPI 00000034: DUP1 00000035: PUSH4 0x8f283970 0000003a: EQ 0000003b: PUSH2 0x00c9 0000003e: JUMPI 0000003f: DUP1 00000040: PUSH4 0xf851a440 00000045: EQ 00000046: PUSH2 0x00e9 00000049: JUMPI 0000004a: PUSH2 0x005d 0000004d: JUMP 0000004e: JUMPDEST 0000004f: CALLDATASIZE 00000050: PUSH2 0x005d 00000053: JUMPI 00000054: PUSH2 0x005b 00000057: PUSH2 0x00fe 0000005a: JUMP 0000005b: JUMPDEST 0000005c: STOP 0000005d: JUMPDEST 0000005e: PUSH2 0x005b 00000061: PUSH2 0x00fe 00000064: JUMP 00000065: JUMPDEST 00000066: CALLVALUE 00000067: DUP1 00000068: ISZERO 00000069: PUSH2 0x0071 0000006c: JUMPI 0000006d: PUSH1 0x00 0000006f: DUP1 00000070: REVERT 00000071: JUMPDEST 00000072: POP 00000073: PUSH2 0x005b 00000076: PUSH2 0x0080 00000079: CALLDATASIZE 0000007a: PUSH1 0x04 0000007c: PUSH2 0x06ca 0000007f: JUMP 00000080: JUMPDEST 00000081: PUSH2 0x0118 00000084: JUMP 00000085: JUMPDEST 00000086: PUSH2 0x005b 00000089: PUSH2 0x0093 0000008c: CALLDATASIZE 0000008d: PUSH1 0x04 0000008f: PUSH2 0x06e5 00000092: JUMP 00000093: JUMPDEST 00000094: PUSH2 0x015f 00000097: JUMP 00000098: JUMPDEST 00000099: CALLVALUE 0000009a: DUP1 0000009b: ISZERO 0000009c: PUSH2 0x00a4 0000009f: JUMPI 000000a0: PUSH1 0x00 000000a2: DUP1 000000a3: REVERT 000000a4: JUMPDEST 000000a5: POP 000000a6: PUSH2 0x00ad 000000a9: PUSH2 0x01d0 000000ac: JUMP 000000ad: JUMPDEST 000000ae: PUSH1 0x40 000000b0: MLOAD 000000b1: PUSH1 0x01 000000b3: PUSH1 0x01 000000b5: PUSH1 0xa0 000000b7: SHL 000000b8: SUB 000000b9: SWAP1 000000ba: SWAP2 000000bb: AND 000000bc: DUP2 000000bd: MSTORE 000000be: PUSH1 0x20 000000c0: ADD 000000c1: PUSH1 0x40 000000c3: MLOAD 000000c4: DUP1 000000c5: SWAP2 000000c6: SUB 000000c7: SWAP1 000000c8: RETURN 000000c9: JUMPDEST 000000ca: CALLVALUE 000000cb: DUP1 000000cc: ISZERO 000000cd: PUSH2 0x00d5 000000d0: JUMPI 000000d1: PUSH1 0x00 000000d3: DUP1 000000d4: REVERT 000000d5: JUMPDEST 000000d6: POP 000000d7: PUSH2 0x005b 000000da: PUSH2 0x00e4 000000dd: CALLDATASIZE 000000de: PUSH1 0x04 000000e0: PUSH2 0x06ca 000000e3: JUMP 000000e4: JUMPDEST 000000e5: PUSH2 0x020b 000000e8: JUMP 000000e9: JUMPDEST 000000ea: CALLVALUE 000000eb: DUP1 000000ec: ISZERO 000000ed: PUSH2 0x00f5 000000f0: JUMPI 000000f1: PUSH1 0x00 000000f3: DUP1 000000f4: REVERT 000000f5: JUMPDEST 000000f6: POP 000000f7: PUSH2 0x00ad 000000fa: PUSH2 0x0235 000000fd: JUMP 000000fe: JUMPDEST 000000ff: PUSH2 0x0106 00000102: PUSH2 0x0292 00000105: JUMP 00000106: JUMPDEST 00000107: PUSH2 0x0116 0000010a: PUSH2 0x0111 0000010d: PUSH2 0x0331 00000110: JUMP 00000111: JUMPDEST 00000112: PUSH2 0x033b 00000115: JUMP 00000116: JUMPDEST 00000117: JUMP 00000118: JUMPDEST 00000119: PUSH2 0x0120 0000011c: PUSH2 0x035f 0000011f: JUMP 00000120: JUMPDEST 00000121: PUSH1 0x01 00000123: PUSH1 0x01 00000125: PUSH1 0xa0 00000127: SHL 00000128: SUB 00000129: AND 0000012a: CALLER 0000012b: PUSH1 0x01 0000012d: PUSH1 0x01 0000012f: PUSH1 0xa0 00000131: SHL 00000132: SUB 00000133: AND 00000134: EQ 00000135: ISZERO 00000136: PUSH2 0x0157 00000139: JUMPI 0000013a: PUSH2 0x0154 0000013d: DUP2 0000013e: PUSH1 0x40 00000140: MLOAD 00000141: DUP1 00000142: PUSH1 0x20 00000144: ADD 00000145: PUSH1 0x40 00000147: MSTORE 00000148: DUP1 00000149: PUSH1 0x00 0000014b: DUP2 0000014c: MSTORE 0000014d: POP 0000014e: PUSH1 0x00 00000150: PUSH2 0x0392 00000153: JUMP 00000154: JUMPDEST 00000155: POP 00000156: JUMP 00000157: JUMPDEST 00000158: PUSH2 0x0154 0000015b: PUSH2 0x00fe 0000015e: JUMP 0000015f: JUMPDEST 00000160: PUSH2 0x0167 00000163: PUSH2 0x035f 00000166: JUMP 00000167: JUMPDEST 00000168: PUSH1 0x01 0000016a: PUSH1 0x01 0000016c: PUSH1 0xa0 0000016e: SHL 0000016f: SUB 00000170: AND 00000171: CALLER 00000172: PUSH1 0x01 00000174: PUSH1 0x01 00000176: PUSH1 0xa0 00000178: SHL 00000179: SUB 0000017a: AND 0000017b: EQ 0000017c: ISZERO 0000017d: PUSH2 0x01c8 00000180: JUMPI 00000181: PUSH2 0x01c3 00000184: DUP4 00000185: DUP4 00000186: DUP4 00000187: DUP1 00000188: DUP1 00000189: PUSH1 0x1f 0000018b: ADD 0000018c: PUSH1 0x20 0000018e: DUP1 0000018f: SWAP2 00000190: DIV 00000191: MUL 00000192: PUSH1 0x20 00000194: ADD 00000195: PUSH1 0x40 00000197: MLOAD 00000198: SWAP1 00000199: DUP2 0000019a: ADD 0000019b: PUSH1 0x40 0000019d: MSTORE 0000019e: DUP1 0000019f: SWAP4 000001a0: SWAP3 000001a1: SWAP2 000001a2: SWAP1 000001a3: DUP2 000001a4: DUP2 000001a5: MSTORE 000001a6: PUSH1 0x20 000001a8: ADD 000001a9: DUP4 000001aa: DUP4 000001ab: DUP1 000001ac: DUP3 000001ad: DUP5 000001ae: CALLDATACOPY 000001af: PUSH1 0x00 000001b1: SWAP3 000001b2: ADD 000001b3: SWAP2 000001b4: SWAP1 000001b5: SWAP2 000001b6: MSTORE 000001b7: POP 000001b8: PUSH1 0x01 000001ba: SWAP3 000001bb: POP 000001bc: PUSH2 0x0392 000001bf: SWAP2 000001c0: POP 000001c1: POP 000001c2: JUMP 000001c3: JUMPDEST 000001c4: POP 000001c5: POP 000001c6: POP 000001c7: JUMP 000001c8: JUMPDEST 000001c9: PUSH2 0x01c3 000001cc: PUSH2 0x00fe 000001cf: JUMP 000001d0: JUMPDEST 000001d1: PUSH1 0x00 000001d3: PUSH2 0x01da 000001d6: PUSH2 0x035f 000001d9: JUMP 000001da: JUMPDEST 000001db: PUSH1 0x01 000001dd: PUSH1 0x01 000001df: PUSH1 0xa0 000001e1: SHL 000001e2: SUB 000001e3: AND 000001e4: CALLER 000001e5: PUSH1 0x01 000001e7: PUSH1 0x01 000001e9: PUSH1 0xa0 000001eb: SHL 000001ec: SUB 000001ed: AND 000001ee: EQ 000001ef: ISZERO 000001f0: PUSH2 0x0200 000001f3: JUMPI 000001f4: PUSH2 0x01fb 000001f7: PUSH2 0x0331 000001fa: JUMP 000001fb: JUMPDEST 000001fc: SWAP1 000001fd: POP 000001fe: SWAP1 000001ff: JUMP 00000200: JUMPDEST 00000201: PUSH2 0x0208 00000204: PUSH2 0x00fe 00000207: JUMP 00000208: JUMPDEST 00000209: SWAP1 0000020a: JUMP 0000020b: JUMPDEST 0000020c: PUSH2 0x0213 0000020f: PUSH2 0x035f 00000212: JUMP 00000213: JUMPDEST 00000214: PUSH1 0x01 00000216: PUSH1 0x01 00000218: PUSH1 0xa0 0000021a: SHL 0000021b: SUB 0000021c: AND 0000021d: CALLER 0000021e: PUSH1 0x01 00000220: PUSH1 0x01 00000222: PUSH1 0xa0 00000224: SHL 00000225: SUB 00000226: AND 00000227: EQ 00000228: ISZERO 00000229: PUSH2 0x0157 0000022c: JUMPI 0000022d: PUSH2 0x0154 00000230: DUP2 00000231: PUSH2 0x03f1 00000234: JUMP 00000235: JUMPDEST 00000236: PUSH1 0x00 00000238: PUSH2 0x023f 0000023b: PUSH2 0x035f 0000023e: JUMP 0000023f: JUMPDEST 00000240: PUSH1 0x01 00000242: PUSH1 0x01 00000244: PUSH1 0xa0 00000246: SHL 00000247: SUB 00000248: AND 00000249: CALLER 0000024a: PUSH1 0x01 0000024c: PUSH1 0x01 0000024e: PUSH1 0xa0 00000250: SHL 00000251: SUB 00000252: AND 00000253: EQ 00000254: ISZERO 00000255: PUSH2 0x0200 00000258: JUMPI 00000259: PUSH2 0x01fb 0000025c: PUSH2 0x035f 0000025f: JUMP 00000260: JUMPDEST 00000261: PUSH1 0x60 00000263: PUSH2 0x0285 00000266: DUP4 00000267: DUP4 00000268: PUSH1 0x40 0000026a: MLOAD 0000026b: DUP1 0000026c: PUSH1 0x60 0000026e: ADD 0000026f: PUSH1 0x40 00000271: MSTORE 00000272: DUP1 00000273: PUSH1 0x27 00000275: DUP2 00000276: MSTORE 00000277: PUSH1 0x20 00000279: ADD 0000027a: PUSH2 0x07e4 0000027d: PUSH1 0x27 0000027f: SWAP2 00000280: CODECOPY 00000281: PUSH2 0x0445 00000284: JUMP 00000285: JUMPDEST 00000286: SWAP4 00000287: SWAP3 00000288: POP 00000289: POP 0000028a: POP 0000028b: JUMP 0000028c: JUMPDEST 0000028d: EXTCODESIZE 0000028e: ISZERO 0000028f: ISZERO 00000290: SWAP1 00000291: JUMP 00000292: JUMPDEST 00000293: PUSH2 0x029a 00000296: PUSH2 0x035f 00000299: JUMP 0000029a: JUMPDEST 0000029b: PUSH1 0x01 0000029d: PUSH1 0x01 0000029f: PUSH1 0xa0 000002a1: SHL 000002a2: SUB 000002a3: AND 000002a4: CALLER 000002a5: PUSH1 0x01 000002a7: PUSH1 0x01 000002a9: PUSH1 0xa0 000002ab: SHL 000002ac: SUB 000002ad: AND 000002ae: EQ 000002af: ISZERO 000002b0: PUSH2 0x0116 000002b3: JUMPI 000002b4: PUSH1 0x40 000002b6: MLOAD 000002b7: PUSH3 0x461bcd 000002bb: PUSH1 0xe5 000002bd: SHL 000002be: DUP2 000002bf: MSTORE 000002c0: PUSH1 0x20 000002c2: PUSH1 0x04 000002c4: DUP3 000002c5: ADD 000002c6: MSTORE 000002c7: PUSH1 0x42 000002c9: PUSH1 0x24 000002cb: DUP3 000002cc: ADD 000002cd: MSTORE 000002ce: PUSH32 0x5472616e73706172656e745570677261646561626c6550726f78793a2061646d 000002ef: PUSH1 0x44 000002f1: DUP3 000002f2: ADD 000002f3: MSTORE 000002f4: PUSH32 0x696e2063616e6e6f742066616c6c6261636b20746f2070726f78792074617267 00000315: PUSH1 0x64 00000317: DUP3 00000318: ADD 00000319: MSTORE 0000031a: PUSH2 0x195d 0000031d: PUSH1 0xf2 0000031f: SHL 00000320: PUSH1 0x84 00000322: DUP3 00000323: ADD 00000324: MSTORE 00000325: PUSH1 0xa4 00000327: ADD 00000328: JUMPDEST 00000329: PUSH1 0x40 0000032b: MLOAD 0000032c: DUP1 0000032d: SWAP2 0000032e: SUB 0000032f: SWAP1 00000330: REVERT 00000331: JUMPDEST 00000332: PUSH1 0x00 00000334: PUSH2 0x01fb 00000337: PUSH2 0x0519 0000033a: JUMP 0000033b: JUMPDEST 0000033c: CALLDATASIZE 0000033d: PUSH1 0x00 0000033f: DUP1 00000340: CALLDATACOPY 00000341: PUSH1 0x00 00000343: DUP1 00000344: CALLDATASIZE 00000345: PUSH1 0x00 00000347: DUP5 00000348: GAS 00000349: DELEGATECALL 0000034a: RETURNDATASIZE 0000034b: PUSH1 0x00 0000034d: DUP1 0000034e: RETURNDATACOPY 0000034f: DUP1 00000350: DUP1 00000351: ISZERO 00000352: PUSH2 0x035a 00000355: JUMPI 00000356: RETURNDATASIZE 00000357: PUSH1 0x00 00000359: RETURN 0000035a: JUMPDEST 0000035b: RETURNDATASIZE 0000035c: PUSH1 0x00 0000035e: REVERT 0000035f: JUMPDEST 00000360: PUSH1 0x00 00000362: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 00000383: JUMPDEST 00000384: SLOAD 00000385: PUSH1 0x01 00000387: PUSH1 0x01 00000389: PUSH1 0xa0 0000038b: SHL 0000038c: SUB 0000038d: AND 0000038e: SWAP2 0000038f: SWAP1 00000390: POP 00000391: JUMP 00000392: JUMPDEST 00000393: PUSH2 0x039b 00000396: DUP4 00000397: PUSH2 0x0541 0000039a: JUMP 0000039b: JUMPDEST 0000039c: PUSH1 0x40 0000039e: MLOAD 0000039f: PUSH1 0x01 000003a1: PUSH1 0x01 000003a3: PUSH1 0xa0 000003a5: SHL 000003a6: SUB 000003a7: DUP5 000003a8: AND 000003a9: SWAP1 000003aa: PUSH32 0xbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b 000003cb: SWAP1 000003cc: PUSH1 0x00 000003ce: SWAP1 000003cf: LOG2 000003d0: PUSH1 0x00 000003d2: DUP3 000003d3: MLOAD 000003d4: GT 000003d5: DUP1 000003d6: PUSH2 0x03dc 000003d9: JUMPI 000003da: POP 000003db: DUP1 000003dc: JUMPDEST 000003dd: ISZERO 000003de: PUSH2 0x01c3 000003e1: JUMPI 000003e2: PUSH2 0x03eb 000003e5: DUP4 000003e6: DUP4 000003e7: PUSH2 0x0260 000003ea: JUMP 000003eb: JUMPDEST 000003ec: POP 000003ed: POP 000003ee: POP 000003ef: POP 000003f0: JUMP 000003f1: JUMPDEST 000003f2: PUSH32 0x7e644d79422f17c01e4894b5f4f588d331ebfa28653d42ae832dc59e38c9798f 00000413: PUSH2 0x041a 00000416: PUSH2 0x035f 00000419: JUMP 0000041a: JUMPDEST 0000041b: PUSH1 0x40 0000041d: DUP1 0000041e: MLOAD 0000041f: PUSH1 0x01 00000421: PUSH1 0x01 00000423: PUSH1 0xa0 00000425: SHL 00000426: SUB 00000427: SWAP3 00000428: DUP4 00000429: AND 0000042a: DUP2 0000042b: MSTORE 0000042c: SWAP2 0000042d: DUP5 0000042e: AND 0000042f: PUSH1 0x20 00000431: DUP4 00000432: ADD 00000433: MSTORE 00000434: ADD 00000435: PUSH1 0x40 00000437: MLOAD 00000438: DUP1 00000439: SWAP2 0000043a: SUB 0000043b: SWAP1 0000043c: LOG1 0000043d: PUSH2 0x0154 00000440: DUP2 00000441: PUSH2 0x05e9 00000444: JUMP 00000445: JUMPDEST 00000446: PUSH1 0x60 00000448: DUP4 00000449: EXTCODESIZE 0000044a: PUSH2 0x04a4 0000044d: JUMPI 0000044e: PUSH1 0x40 00000450: MLOAD 00000451: PUSH3 0x461bcd 00000455: PUSH1 0xe5 00000457: SHL 00000458: DUP2 00000459: MSTORE 0000045a: PUSH1 0x20 0000045c: PUSH1 0x04 0000045e: DUP3 0000045f: ADD 00000460: MSTORE 00000461: PUSH1 0x26 00000463: PUSH1 0x24 00000465: DUP3 00000466: ADD 00000467: MSTORE 00000468: PUSH32 0x416464726573733a2064656c65676174652063616c6c20746f206e6f6e2d636f 00000489: PUSH1 0x44 0000048b: DUP3 0000048c: ADD 0000048d: MSTORE 0000048e: PUSH6 0x1b9d1c9858dd 00000495: PUSH1 0xd2 00000497: SHL 00000498: PUSH1 0x64 0000049a: DUP3 0000049b: ADD 0000049c: MSTORE 0000049d: PUSH1 0x84 0000049f: ADD 000004a0: PUSH2 0x0328 000004a3: JUMP 000004a4: JUMPDEST 000004a5: PUSH1 0x00 000004a7: DUP1 000004a8: DUP6 000004a9: PUSH1 0x01 000004ab: PUSH1 0x01 000004ad: PUSH1 0xa0 000004af: SHL 000004b0: SUB 000004b1: AND 000004b2: DUP6 000004b3: PUSH1 0x40 000004b5: MLOAD 000004b6: PUSH2 0x04bf 000004b9: SWAP2 000004ba: SWAP1 000004bb: PUSH2 0x0794 000004be: JUMP 000004bf: JUMPDEST 000004c0: PUSH1 0x00 000004c2: PUSH1 0x40 000004c4: MLOAD 000004c5: DUP1 000004c6: DUP4 000004c7: SUB 000004c8: DUP2 000004c9: DUP6 000004ca: GAS 000004cb: DELEGATECALL 000004cc: SWAP2 000004cd: POP 000004ce: POP 000004cf: RETURNDATASIZE 000004d0: DUP1 000004d1: PUSH1 0x00 000004d3: DUP2 000004d4: EQ 000004d5: PUSH2 0x04fa 000004d8: JUMPI 000004d9: PUSH1 0x40 000004db: MLOAD 000004dc: SWAP2 000004dd: POP 000004de: PUSH1 0x1f 000004e0: NOT 000004e1: PUSH1 0x3f 000004e3: RETURNDATASIZE 000004e4: ADD 000004e5: AND 000004e6: DUP3 000004e7: ADD 000004e8: PUSH1 0x40 000004ea: MSTORE 000004eb: RETURNDATASIZE 000004ec: DUP3 000004ed: MSTORE 000004ee: RETURNDATASIZE 000004ef: PUSH1 0x00 000004f1: PUSH1 0x20 000004f3: DUP5 000004f4: ADD 000004f5: RETURNDATACOPY 000004f6: PUSH2 0x04ff 000004f9: JUMP 000004fa: JUMPDEST 000004fb: PUSH1 0x60 000004fd: SWAP2 000004fe: POP 000004ff: JUMPDEST 00000500: POP 00000501: SWAP2 00000502: POP 00000503: SWAP2 00000504: POP 00000505: PUSH2 0x050f 00000508: DUP3 00000509: DUP3 0000050a: DUP7 0000050b: PUSH2 0x0675 0000050e: JUMP 0000050f: JUMPDEST 00000510: SWAP7 00000511: SWAP6 00000512: POP 00000513: POP 00000514: POP 00000515: POP 00000516: POP 00000517: POP 00000518: JUMP 00000519: JUMPDEST 0000051a: PUSH1 0x00 0000051c: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc 0000053d: PUSH2 0x0383 00000540: JUMP 00000541: JUMPDEST 00000542: DUP1 00000543: EXTCODESIZE 00000544: PUSH2 0x05a5 00000547: JUMPI 00000548: PUSH1 0x40 0000054a: MLOAD 0000054b: PUSH3 0x461bcd 0000054f: PUSH1 0xe5 00000551: SHL 00000552: DUP2 00000553: MSTORE 00000554: PUSH1 0x20 00000556: PUSH1 0x04 00000558: DUP3 00000559: ADD 0000055a: MSTORE 0000055b: PUSH1 0x2d 0000055d: PUSH1 0x24 0000055f: DUP3 00000560: ADD 00000561: MSTORE 00000562: PUSH32 0x455243313936373a206e657720696d706c656d656e746174696f6e206973206e 00000583: PUSH1 0x44 00000585: DUP3 00000586: ADD 00000587: MSTORE 00000588: PUSH13 0x1bdd08184818dbdb9d1c9858dd 00000596: PUSH1 0x9a 00000598: SHL 00000599: PUSH1 0x64 0000059b: DUP3 0000059c: ADD 0000059d: MSTORE 0000059e: PUSH1 0x84 000005a0: ADD 000005a1: PUSH2 0x0328 000005a4: JUMP 000005a5: JUMPDEST 000005a6: DUP1 000005a7: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc 000005c8: JUMPDEST 000005c9: DUP1 000005ca: SLOAD 000005cb: PUSH1 0x01 000005cd: PUSH1 0x01 000005cf: PUSH1 0xa0 000005d1: SHL 000005d2: SUB 000005d3: NOT 000005d4: AND 000005d5: PUSH1 0x01 000005d7: PUSH1 0x01 000005d9: PUSH1 0xa0 000005db: SHL 000005dc: SUB 000005dd: SWAP3 000005de: SWAP1 000005df: SWAP3 000005e0: AND 000005e1: SWAP2 000005e2: SWAP1 000005e3: SWAP2 000005e4: OR 000005e5: SWAP1 000005e6: SSTORE 000005e7: POP 000005e8: JUMP 000005e9: JUMPDEST 000005ea: PUSH1 0x01 000005ec: PUSH1 0x01 000005ee: PUSH1 0xa0 000005f0: SHL 000005f1: SUB 000005f2: DUP2 000005f3: AND 000005f4: PUSH2 0x064e 000005f7: JUMPI 000005f8: PUSH1 0x40 000005fa: MLOAD 000005fb: PUSH3 0x461bcd 000005ff: PUSH1 0xe5 00000601: SHL 00000602: DUP2 00000603: MSTORE 00000604: PUSH1 0x20 00000606: PUSH1 0x04 00000608: DUP3 00000609: ADD 0000060a: MSTORE 0000060b: PUSH1 0x26 0000060d: PUSH1 0x24 0000060f: DUP3 00000610: ADD 00000611: MSTORE 00000612: PUSH32 0x455243313936373a206e65772061646d696e20697320746865207a65726f2061 00000633: PUSH1 0x44 00000635: DUP3 00000636: ADD 00000637: MSTORE 00000638: PUSH6 0x646472657373 0000063f: PUSH1 0xd0 00000641: SHL 00000642: PUSH1 0x64 00000644: DUP3 00000645: ADD 00000646: MSTORE 00000647: PUSH1 0x84 00000649: ADD 0000064a: PUSH2 0x0328 0000064d: JUMP 0000064e: JUMPDEST 0000064f: DUP1 00000650: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 00000671: PUSH2 0x05c8 00000674: JUMP 00000675: JUMPDEST 00000676: PUSH1 0x60 00000678: DUP4 00000679: ISZERO 0000067a: PUSH2 0x0684 0000067d: JUMPI 0000067e: POP 0000067f: DUP2 00000680: PUSH2 0x0285 00000683: JUMP 00000684: JUMPDEST 00000685: DUP3 00000686: MLOAD 00000687: ISZERO 00000688: PUSH2 0x0694 0000068b: JUMPI 0000068c: DUP3 0000068d: MLOAD 0000068e: DUP1 0000068f: DUP5 00000690: PUSH1 0x20 00000692: ADD 00000693: REVERT 00000694: JUMPDEST 00000695: DUP2 00000696: PUSH1 0x40 00000698: MLOAD 00000699: PUSH3 0x461bcd 0000069d: PUSH1 0xe5 0000069f: SHL 000006a0: DUP2 000006a1: MSTORE 000006a2: PUSH1 0x04 000006a4: ADD 000006a5: PUSH2 0x0328 000006a8: SWAP2 000006a9: SWAP1 000006aa: PUSH2 0x07b0 000006ad: JUMP 000006ae: JUMPDEST 000006af: DUP1 000006b0: CALLDATALOAD 000006b1: PUSH1 0x01 000006b3: PUSH1 0x01 000006b5: PUSH1 0xa0 000006b7: SHL 000006b8: SUB 000006b9: DUP2 000006ba: AND 000006bb: DUP2 000006bc: EQ 000006bd: PUSH2 0x06c5 000006c0: JUMPI 000006c1: PUSH1 0x00 000006c3: DUP1 000006c4: REVERT 000006c5: JUMPDEST 000006c6: SWAP2 000006c7: SWAP1 000006c8: POP 000006c9: JUMP 000006ca: JUMPDEST 000006cb: PUSH1 0x00 000006cd: PUSH1 0x20 000006cf: DUP3 000006d0: DUP5 000006d1: SUB 000006d2: SLT 000006d3: ISZERO 000006d4: PUSH2 0x06dc 000006d7: JUMPI 000006d8: PUSH1 0x00 000006da: DUP1 000006db: REVERT 000006dc: JUMPDEST 000006dd: PUSH2 0x0285 000006e0: DUP3 000006e1: PUSH2 0x06ae 000006e4: JUMP 000006e5: JUMPDEST 000006e6: PUSH1 0x00 000006e8: DUP1 000006e9: PUSH1 0x00 000006eb: PUSH1 0x40 000006ed: DUP5 000006ee: DUP7 000006ef: SUB 000006f0: SLT 000006f1: ISZERO 000006f2: PUSH2 0x06fa 000006f5: JUMPI 000006f6: PUSH1 0x00 000006f8: DUP1 000006f9: REVERT 000006fa: JUMPDEST 000006fb: PUSH2 0x0703 000006fe: DUP5 000006ff: PUSH2 0x06ae 00000702: JUMP 00000703: JUMPDEST 00000704: SWAP3 00000705: POP 00000706: PUSH1 0x20 00000708: DUP5 00000709: ADD 0000070a: CALLDATALOAD 0000070b: PUSH8 0xffffffffffffffff 00000714: DUP1 00000715: DUP3 00000716: GT 00000717: ISZERO 00000718: PUSH2 0x0720 0000071b: JUMPI 0000071c: PUSH1 0x00 0000071e: DUP1 0000071f: REVERT 00000720: JUMPDEST 00000721: DUP2 00000722: DUP7 00000723: ADD 00000724: SWAP2 00000725: POP 00000726: DUP7 00000727: PUSH1 0x1f 00000729: DUP4 0000072a: ADD 0000072b: SLT 0000072c: PUSH2 0x0734 0000072f: JUMPI 00000730: PUSH1 0x00 00000732: DUP1 00000733: REVERT 00000734: JUMPDEST 00000735: DUP2 00000736: CALLDATALOAD 00000737: DUP2 00000738: DUP2 00000739: GT 0000073a: ISZERO 0000073b: PUSH2 0x0743 0000073e: JUMPI 0000073f: PUSH1 0x00 00000741: DUP1 00000742: REVERT 00000743: JUMPDEST 00000744: DUP8 00000745: PUSH1 0x20 00000747: DUP3 00000748: DUP6 00000749: ADD 0000074a: ADD 0000074b: GT 0000074c: ISZERO 0000074d: PUSH2 0x0755 00000750: JUMPI 00000751: PUSH1 0x00 00000753: DUP1 00000754: REVERT 00000755: JUMPDEST 00000756: PUSH1 0x20 00000758: DUP4 00000759: ADD 0000075a: SWAP5 0000075b: POP 0000075c: DUP1 0000075d: SWAP4 0000075e: POP 0000075f: POP 00000760: POP 00000761: POP 00000762: SWAP3 00000763: POP 00000764: SWAP3 00000765: POP 00000766: SWAP3 00000767: JUMP 00000768: JUMPDEST 00000769: PUSH1 0x00 0000076b: JUMPDEST 0000076c: DUP4 0000076d: DUP2 0000076e: LT 0000076f: ISZERO 00000770: PUSH2 0x0783 00000773: JUMPI 00000774: DUP2 00000775: DUP2 00000776: ADD 00000777: MLOAD 00000778: DUP4 00000779: DUP3 0000077a: ADD 0000077b: MSTORE 0000077c: PUSH1 0x20 0000077e: ADD 0000077f: PUSH2 0x076b 00000782: JUMP 00000783: JUMPDEST 00000784: DUP4 00000785: DUP2 00000786: GT 00000787: ISZERO 00000788: PUSH2 0x03eb 0000078b: JUMPI 0000078c: POP 0000078d: POP 0000078e: PUSH1 0x00 00000790: SWAP2 00000791: ADD 00000792: MSTORE 00000793: JUMP 00000794: JUMPDEST 00000795: PUSH1 0x00 00000797: DUP3 00000798: MLOAD 00000799: PUSH2 0x07a6 0000079c: DUP2 0000079d: DUP5 0000079e: PUSH1 0x20 000007a0: DUP8 000007a1: ADD 000007a2: PUSH2 0x0768 000007a5: JUMP 000007a6: JUMPDEST 000007a7: SWAP2 000007a8: SWAP1 000007a9: SWAP2 000007aa: ADD 000007ab: SWAP3 000007ac: SWAP2 000007ad: POP 000007ae: POP 000007af: JUMP 000007b0: JUMPDEST 000007b1: PUSH1 0x20 000007b3: DUP2 000007b4: MSTORE 000007b5: PUSH1 0x00 000007b7: DUP3 000007b8: MLOAD 000007b9: DUP1 000007ba: PUSH1 0x20 000007bc: DUP5 000007bd: ADD 000007be: MSTORE 000007bf: PUSH2 0x07cf 000007c2: DUP2 000007c3: PUSH1 0x40 000007c5: DUP6 000007c6: ADD 000007c7: PUSH1 0x20 000007c9: DUP8 000007ca: ADD 000007cb: PUSH2 0x0768 000007ce: JUMP 000007cf: JUMPDEST 000007d0: PUSH1 0x1f 000007d2: ADD 000007d3: PUSH1 0x1f 000007d5: NOT 000007d6: AND 000007d7: SWAP2 000007d8: SWAP1 000007d9: SWAP2 000007da: ADD 000007db: PUSH1 0x40 000007dd: ADD 000007de: SWAP3 000007df: SWAP2 000007e0: POP 000007e1: POP 000007e2: JUMP 000007e3: INVALID 000007e4: COINBASE 000007e5: PUSH5 0x6472657373 000007eb: GASPRICE 000007ec: KECCAK256 000007ed: PUSH13 0x6f772d6c6576656c2064656c65 000007fb: PUSH8 0x6174652063616c6c 00000804: KECCAK256 00000805: PUSH7 0x61696c6564a264 0000080d: PUSH10 0x70667358221220467518 00000818: PUSH29 0xaf3a43285d9a2c1844a981e977bd52a85ff073e7fc649f73847d70a464 00000836: PUSH20
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | upgradeability | detector | Untrusted DELEGATECALL target reachable | 70 | no | no |
viewtrace_id: 0xe05cef2d304d05d5ffefd64088cdf81a94684aed0b95bc910991058a26683bed
call_targets:
0x5d7b782ec34cae8b38a56c1a3487337583178466
target_varies:
no
classification:
constant_target
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "sink_reached",
"attempts": 2,
"trace_id": "0xe05cef2d304d05d5ffefd64088cdf81a94684aed0b95bc910991058a26683bed",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x5d7b782ec34cae8b38a56c1a3487337583178466"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x3659cfe6",
"selector": "0x3659cfe6",
"calldata_variants": [
"0x3659cfe6",
"0x3659cfe60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4f1ef286",
"selector": "0x4f1ef286",
"calldata_variants": [
"0x4f1ef286",
"0x4f1ef2860000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5c60da1b",
"selector": "0x5c60da1b",
"calldata_variants": [
"0x5c60da1b",
"0x5c60da1b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8f283970",
"selector": "0x8f283970",
"calldata_variants": [
"0x8f283970",
"0x8f2839700000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf851a440",
"selector": "0xf851a440",
"calldata_variants": [
"0xf851a440",
"0xf851a4400000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 841,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
},
{
"pc": 1227,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [],
"delegatecall_count": 2,
"untrusted_delegatecall_count": 2
}
|
| medium | upgradeability | cast | DELEGATECALL present | 80 | no | — |
viewevidence_json{
"notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
"delegatecall_count": 2
}
|
| medium | math | codex | Incorrect withdrawal accounting enables repeated sales withdrawals after parameter changes | 75 | no | — |
viewevidence_json{
"evidence": "`withdrawed` is set to `available` instead of incrementing by `available`, so the tracked withdrawn total can decrease or remain stale when sales change.",
"locations": [
"contracts/BlindAuction.sol:268",
"contracts/BlindAuction.sol:270"
],
"recommendation": "Track withdrawals cumulatively (e.g., `withdrawed += available` or set `withdrawed = sales` after withdrawal) and consider freezing `wonBiddedItems`/`finalPrice` after the first withdrawal or adding an invariant check that total withdrawals never exceed `sales`.",
"exploit_scenario": "The owner calls `withdrawSales()` once, then later increases `wonBiddedItems` or `finalPrice` and calls `withdrawSales()` again. Because `withdrawed` is overwritten with `available` instead of accumulated, the remaining sales balance is miscomputed and can be withdrawn multiple times, draining funds needed for refunds."
}
|