Analysis Run

Traceback (most recent call last):
  File "/var/www/tripwire/worker/worker.py", line 198, in main
    payload = dispatch_job(job_type, job_id, job_meta, run_data, config, laravel_client)
  File "/var/www/tripwire/worker/worker.py", line 114, in dispatch_job
    return slither_run.run(job_id, job_meta, run_data, config, log, laravel_client)
           ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/www/tripwire/worker/jobs/slither_run.py", line 1084, in run
    stdout_text, stderr_text, result_json = _run_slither(
                                            ~~~~~~~~~~~~^
        workspace,
        ^^^^^^^^^^
    ...<4 lines>...
        target_path=target_path,
        ^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/var/www/tripwire/worker/jobs/slither_run.py", line 958, in _run_slither
    raise RuntimeError(f"slither failed (exit {result.returncode}): {stderr_text or stdout_text}")
RuntimeError: slither failed (exit 1): 'forge clean' running (wd: /tmp/slither-8rv9ypar)
'forge config --json' running
'forge build --build-info --skip ./test/** ./script/** --force' running (wd: /tmp/slither-8rv9ypar)
'forge' returned non-zero exit code 1
Error: Encountered invalid solc version in src/L1/ResourceMetering.sol: No solc version exists that matches the version requirement: =0.8.15
stderr: Encountered invalid solc version in src/libraries/Arithmetic.sol: No solc version exists that matches the version requirement: =0.8.15
stderr: Encountered invalid solc version in src/libraries/Burn.sol: No solc version exists that matches the version requirement: =0.8.15
stderr: Encountered invalid solc version in src/L1/ResourceMetering.sol: No solc version exists that matches the version requirement: =0.8.15
stderr: Encountered invalid solc version in src/universal/Proxy.sol: No solc version exists that matches the version requirement: =0.8.15
Traceback (most recent call last):
  File "/var/www/tripwire/.venv/bin/slither", line 10, in <module>
    sys.exit(main())
             ~~~~^^
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/slither/__main__.py", line 776, in main
    main_impl(all_detector_classes=detectors, all_printer_classes=printers)
    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/slither/__main__.py", line 882, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
        ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/slither/__main__.py", line 96, in process_all
    compilations = compile_all(target, **vars(args))
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/crytic_compile.py", line 722, in compile_all
    compilations.append(CryticCompile(target, **kwargs))
                        ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/crytic_compile.py", line 211, in __init__
    self._compile(**kwargs)
    ~~~~~~~~~~~~~^^^^^^^^^^
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/crytic_compile.py", line 633, in _compile
    self._platform.compile(self, **kwargs)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/platform/foundry.py", line 102, in compile
    hardhat_like_parsing(
    ~~~~~~~~~~~~~~~~~~~~^
        crytic_compile, str(self._target), build_directory, str(self._project_root)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/var/www/tripwire/.venv/lib/python3.13/site-packages/crytic_compile/platform/hardhat.py", line 52, in hardhat_like_parsing
    raise InvalidCompilation(txt)
crytic_compile.platform.exceptions.InvalidCompilation: Compilation failed. Can you run build command?
/tmp/slither-8rv9ypar/out/build-info is not a directory.

{"no_findings":true,"summary":"No exploitable vulnerabilities identified in the first-party implementation code after reviewing AUDIT_BUNDLE.txt under the requested focus areas.","findings":[]}

OpenAI Codex v0.77.0 (research preview)
--------
workdir: /tmp/codex-2i6rln9d
model: gpt-5.2-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: auto
session id: 019be452-fbca-72d3-9892-228b6e27d371
--------
user
Context: The user requested the proxy at 0x4e259ee5f4136408908160dd32295a5031fa426f.
Audit the implementation at 0xbdd90485fcbcac869d5b5752179815a3103d8131.
Findings should refer to the implementation unless explicitly about proxy mechanics.

You are a security auditor. Audit this Solidity codebase for exploitable vulnerabilities.
Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation, oracle manipulation,
accounting/invariant breaks, external call patterns, unchecked return values, and dangerous delegatecall.

Scope rules:
- You MUST fully read `AUDIT_BUNDLE.txt` before concluding. It contains the complete contents of all first-party Solidity sources in this workspace.
- Treat `lib/` and `@openzeppelin/` as third-party dependencies; skip them unless there is a concrete misuse angle in first-party code.
- If there are only dependency files and no first-party sources, set no_findings=true and explain in summary.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title and file/line locations when possible.

Output constraints (IMPORTANT):
- severity MUST be exactly one of: info, low, medium, high, critical (lowercase).
- category MUST be exactly one of: access_control, reentrancy, math, oracle, upgradeability, auth, other.
Keep summary short and concrete.
mcp startup: no servers
exec
/bin/bash -lc ls in /tmp/codex-2i6rln9d succeeded in 7ms:
AUDIT_BUNDLE.txt
codex-output-schema.json
lib
src
exec
/bin/bash -lc 'rg --files' in /tmp/codex-2i6rln9d succeeded in 10ms:
AUDIT_BUNDLE.txt
codex-output-schema.json
src/universal/ISemver.sol
src/L2/L1Block.sol
src/libraries/GasPayingToken.sol
src/libraries/Types.sol
src/libraries/Predeploys.sol
src/libraries/Encoding.sol
src/libraries/PortalErrors.sol
src/libraries/SafeCall.sol
src/libraries/Storage.sol
src/libraries/L1BlockErrors.sol
src/libraries/Bytes.sol
src/libraries/Burn.sol
src/libraries/Constants.sol
src/libraries/rlp/RLPWriter.sol
src/libraries/rlp/RLPErrors.sol
src/libraries/rlp/RLPReader.sol
src/libraries/Hashing.sol
src/vendor/AddressAliasHelper.sol

thinking
**Noting dependency on AUDIT_BUNDLE**
exec
/bin/bash -lc 'cat AUDIT_BUNDLE.txt' in /tmp/codex-2i6rln9d succeeded in 11ms:
This file concatenates the full contents of first-party Solidity sources for auditing.
Do not treat dependency code under lib/ or @openzeppelin/ as first-party.

================================================================================
FILE: src/L1/L2OutputOracle.sol
================================================================================
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

import { Initializable } from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
import { ISemver } from "src/universal/ISemver.sol";
import { Types } from "src/libraries/Types.sol";
import { Constants } from "src/libraries/Constants.sol";

/// @custom:proxied
/// @title L2OutputOracle
/// @notice The L2OutputOracle contains an array of L2 state outputs, where each output is a
///         commitment to the state of the L2 chain. Other contracts like the OptimismPortal use
///         these outputs to verify information about the state of L2.
contract L2OutputOracle is Initializable, ISemver {

thinking
**Targeting key contracts for audit**

I'm focusing on reviewing primary contracts like OptimismPortal and related modules from the bundle to identify vulnerabilities, prioritizing read-only inspection of first-party code since the implementation address suggests this area.
exec
/bin/bash -lc "sed -n '1,240p' src/L1/OptimismPortal.sol" in /tmp/codex-2i6rln9d succeeded in 20ms:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

import { Initializable } from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
import { SafeCall } from "src/libraries/SafeCall.sol";
import { L2OutputOracle } from "src/L1/L2OutputOracle.sol";
import { SystemConfig } from "src/L1/SystemConfig.sol";
import { SuperchainConfig } from "src/L1/SuperchainConfig.sol";
import { Constants } from "src/libraries/Constants.sol";
import { Types } from "src/libraries/Types.sol";
import { Hashing } from "src/libraries/Hashing.sol";
import { SecureMerkleTrie } from "src/libraries/trie/SecureMerkleTrie.sol";
import { AddressAliasHelper } from "src/vendor/AddressAliasHelper.sol";
import { ResourceMetering } from "src/L1/ResourceMetering.sol";
import { ISemver } from "src/universal/ISemver.sol";
import { SafeERC20 } from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import { L1Block } from "src/L2/L1Block.sol";
import { Predeploys } from "src/libraries/Predeploys.sol";
import "src/libraries/PortalErrors.sol";
exec
/bin/bash -lc "sed -n '240,520p' src/L1/OptimismPortal.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
        external
        whenNotPaused
    {
        // Prevent users from creating a deposit transaction where this address is the message
        // sender on L2. Because this is checked here, we do not need to check again in
        // `finalizeWithdrawalTransaction`.
        if (_tx.target == address(this)) revert BadTarget();

        // Get the output root and load onto the stack to prevent multiple mloads. This will
        // revert if there is no output root for the given block number.
        bytes32 outputRoot = l2Oracle.getL2Output(_l2OutputIndex).outputRoot;

        // Verify that the output root can be generated with the elements in the proof.
        require(
            outputRoot == Hashing.hashOutputRootProof(_outputRootProof), "OptimismPortal: invalid output root proof"
        );

        // Load the ProvenWithdrawal into memory, using the withdrawal hash as a unique identifier.
        bytes32 withdrawalHash = Hashing.hashWithdrawal(_tx);
        ProvenWithdrawal memory provenWithdrawal = provenWithdrawals[withdrawalHash];
exec
/bin/bash -lc "sed -n '520,1040p' src/L1/OptimismPortal.sol" in /tmp/codex-2i6rln9d succeeded in 7ms:
    /// @param _data       Data to trigger the recipient with.
    function _depositTransaction(
        address _to,
        uint256 _mint,
        uint256 _value,
        uint64 _gasLimit,
        bool _isCreation,
        bytes memory _data
    )
        internal
    {
        // Just to be safe, make sure that people specify address(0) as the target when doing
        // contract creations.
        if (_isCreation && _to != address(0)) revert BadTarget();

        // Prevent depositing transactions that have too small of a gas limit. Users should pay
        // more for more resource usage.
        if (_gasLimit < minimumGasLimit(uint64(_data.length))) revert SmallGasLimit();

        // Prevent the creation of deposit transactions that have too much calldata. This gives an

thinking
**Inspecting configuration files**

I'm starting with SystemConfig to check for relevant logic or potential bugs affecting the behavior.
exec
/bin/bash -lc "sed -n '1,240p' src/L1/SystemConfig.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

import { OwnableUpgradeable } from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import { ISemver } from "src/universal/ISemver.sol";
import { ResourceMetering } from "src/L1/ResourceMetering.sol";
import { Storage } from "src/libraries/Storage.sol";
import { Constants } from "src/libraries/Constants.sol";
import { OptimismPortal } from "src/L1/OptimismPortal.sol";
import { GasPayingToken, IGasToken } from "src/libraries/GasPayingToken.sol";
import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

/// @title SystemConfig
/// @notice The SystemConfig contract is used to manage configuration of an Optimism network.
///         All configuration is stored on L1 and picked up by L2 as part of the derviation of
///         the L2 chain.
contract SystemConfig is OwnableUpgradeable, ISemver, IGasToken {
    /// @notice Enum representing different types of updates.
    /// @custom:value BATCHER              Represents an update to the batcher hash.
    /// @custom:value GAS_CONFIG           Represents an update to txn fee config on L2.
exec
/bin/bash -lc "sed -n '240,520p' src/L1/SystemConfig.sol" in /tmp/codex-2i6rln9d succeeded in 14ms:
        addr_ = Storage.getAddress(UNSAFE_BLOCK_SIGNER_SLOT);
    }

    /// @notice Getter for the L1CrossDomainMessenger address.
    function l1CrossDomainMessenger() external view returns (address addr_) {
        addr_ = Storage.getAddress(L1_CROSS_DOMAIN_MESSENGER_SLOT);
    }

    /// @notice Getter for the L1ERC721Bridge address.
    function l1ERC721Bridge() external view returns (address addr_) {
        addr_ = Storage.getAddress(L1_ERC_721_BRIDGE_SLOT);
    }

    /// @notice Getter for the L1StandardBridge address.
    function l1StandardBridge() external view returns (address addr_) {
        addr_ = Storage.getAddress(L1_STANDARD_BRIDGE_SLOT);
    }

    /// @notice Getter for the DisputeGameFactory address.
    function disputeGameFactory() external view returns (address addr_) {

thinking
**Considering ownership model**

I'm noting that SystemConfig is mostly owner-controlled and now evaluating whether SuperchainConfig should follow the same pattern or differ.
exec
/bin/bash -lc "sed -n '1,200p' src/L1/SuperchainConfig.sol" in /tmp/codex-2i6rln9d succeeded in 8ms:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

import { Initializable } from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
import { ISemver } from "src/universal/ISemver.sol";
import { Storage } from "src/libraries/Storage.sol";

/// @custom:audit none This contracts is not yet audited.
/// @title SuperchainConfig
/// @notice The SuperchainConfig contract is used to manage configuration of global superchain values.
contract SuperchainConfig is Initializable, ISemver {
    /// @notice Enum representing different types of updates.
    /// @custom:value GUARDIAN            Represents an update to the guardian.
    enum UpdateType {
        GUARDIAN
    }

    /// @notice Whether or not the Superchain is paused.
    bytes32 public constant PAUSED_SLOT = bytes32(uint256(keccak256("superchainConfig.paused")) - 1);


thinking
**Noting SuperchainConfig access control**

SuperchainConfig's internal _setGuardian can only be changed via upgrade, ensuring access control; considering if L1Block plays a role here.
exec
/bin/bash -lc "sed -n '1,200p' src/L2/L1Block.sol" in /tmp/codex-2i6rln9d succeeded in 7ms:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

import { ISemver } from "src/universal/ISemver.sol";
import { Constants } from "src/libraries/Constants.sol";
import { GasPayingToken, IGasToken } from "src/libraries/GasPayingToken.sol";
import "src/libraries/L1BlockErrors.sol";

/// @custom:proxied
/// @custom:predeploy 0x4200000000000000000000000000000000000015
/// @title L1Block
/// @notice The L1Block predeploy gives users access to information about the last known L1 block.
///         Values within this contract are updated once per epoch (every L1 block) and can only be
///         set by the "depositor" account, a special system address. Depositor account transactions
///         are created by the protocol whenever we move to a new epoch.
contract L1Block is ISemver, IGasToken {
    /// @notice Event emitted when the gas paying token is set.
    event GasPayingTokenSet(address indexed token, uint8 indexed decimals, bytes32 name, bytes32 symbol);

    /// @notice Address of the special depositor account.

thinking
**Questioning resource metering**
exec
/bin/bash -lc "sed -n '1,240p' src/L1/ResourceMetering.sol" in /tmp/codex-2i6rln9d succeeded in 8ms:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

import { Initializable } from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
import { Math } from "@openzeppelin/contracts/utils/math/Math.sol";
import { Burn } from "src/libraries/Burn.sol";
import { Arithmetic } from "src/libraries/Arithmetic.sol";

/// @custom:upgradeable
/// @title ResourceMetering
/// @notice ResourceMetering implements an EIP-1559 style resource metering system where pricing
///         updates automatically based on current demand.
abstract contract ResourceMetering is Initializable {
    /// @notice Error returned when too much gas resource is consumed.
    error OutOfGas();

    /// @notice Represents the various parameters that control the way in which resources are
    ///         metered. Corresponds to the EIP-1559 resource metering system.
    /// @custom:field prevBaseFee   Base fee from the previous block(s).
    /// @custom:field prevBoughtGas Amount of gas bought so far in the current block.

thinking
**Reviewing overflow and safety checks**

Noticed ResourceMetering uses arithmetic with potential overflow risks, though base fee is clamped to prevent this; underflow seems unlikely. Planning to inspect SafeCall in OptimismPortal next for its safety measures.
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/SafeCall.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

/// @title SafeCall
/// @notice Perform low level safe calls
library SafeCall {
    /// @notice Performs a low level call without copying any returndata.
    /// @dev Passes no calldata to the call context.
    /// @param _target   Address to call
    /// @param _gas      Amount of gas to pass to the call
    /// @param _value    Amount of value to pass to the call
    function send(address _target, uint256 _gas, uint256 _value) internal returns (bool success_) {
        assembly {
            success_ :=
                call(
                    _gas, // gas
                    _target, // recipient
                    _value, // ether value
                    0, // inloc
                    0, // inlen

thinking
**Inspecting hashing for vulnerabilities**

I'm shifting focus to the hashing library to check for potential bugs or security issues that might complement the SafeCall review findings.
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/Hashing.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import { Types } from "src/libraries/Types.sol";
import { Encoding } from "src/libraries/Encoding.sol";

/// @title Hashing
/// @notice Hashing handles Optimism's various different hashing schemes.
library Hashing {
    /// @notice Computes the hash of the RLP encoded L2 transaction that would be generated when a
    ///         given deposit is sent to the L2 system. Useful for searching for a deposit in the L2
    ///         system.
    /// @param _tx User deposit transaction to hash.
    /// @return Hash of the RLP encoded L2 deposit transaction.
    function hashDepositTransaction(Types.UserDepositTransaction memory _tx) internal pure returns (bytes32) {
        return keccak256(Encoding.encodeDepositTransaction(_tx));
    }

    /// @notice Computes the deposit transaction's "source hash", a value that guarantees the hash
    ///         of the L2 transaction that corresponds to a deposit is unique and is


thinking
**Assessing token balance underflow and L2OutputOracle edge cases**

Noted the _balance arithmetic in deposits/withdrawals prevents fund loss due to Solidity 0.8 underflow checks, but could cause DoS if L2 produces invalid withdrawals. Also flagged a potential risk if finalizationPeriodSeconds is zero in L2OutputOracle deletion logic, which might affect timing checks or index correctness. Next, deeper review of these assumptions and safeguards is needed.
thinking
**Analyzing zero finalization period and reentrancy via token calls**

Confirmed finalizationPeriodSeconds set to zero disables deletion as intended, avoiding a bug. Identified a low-risk reentrancy vector during internal gas-paying token setup, where malicious token contracts could invoke callbacks during .decimals() calls, but owner-only functions block harmful effects. Also noted finalizeWithdrawalTransaction’s reentrancy guard protects against loops, while depositTransaction remains open but safe. Highlighted balance tracking discrepancies from direct token transfers to the portal, acknowledged as design, not vulnerability. Next step is inspecting related libraries for misuse.
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/GasPayingToken.sol" in /tmp/codex-2i6rln9d succeeded in 5ms:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import { Storage } from "src/libraries/Storage.sol";
import { Constants } from "src/libraries/Constants.sol";
import { LibString } from "@solady/utils/LibString.sol";

/// @title IGasToken
/// @notice Implemented by contracts that are aware of the custom gas token used
///         by the L2 network.
interface IGasToken {
    /// @notice Getter for the ERC20 token address that is used to pay for gas and its decimals.
    function gasPayingToken() external view returns (address, uint8);
    /// @notice Returns the gas token name.
    function gasPayingTokenName() external view returns (string memory);
    /// @notice Returns the gas token symbol.
    function gasPayingTokenSymbol() external view returns (string memory);
    /// @notice Returns true if the network uses a custom gas token.
    function isCustomGasToken() external view returns (bool);
}

thinking
**Checking Storage library for vulnerabilities**
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/Storage.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

/// @title Storage
/// @notice Storage handles reading and writing to arbitary storage locations
library Storage {
    /// @notice Returns an address stored in an arbitrary storage slot.
    ///         These storage slots decouple the storage layout from
    ///         solc's automation.
    /// @param _slot The storage slot to retrieve the address from.
    function getAddress(bytes32 _slot) internal view returns (address addr_) {
        assembly {
            addr_ := sload(_slot)
        }
    }

    /// @notice Stores an address in an arbitrary storage slot, `_slot`.
    /// @param _slot The storage slot to store the address in.
    /// @param _address The protocol version to store
    /// @dev WARNING! This function must be used cautiously, as it allows for overwriting addresses

thinking
**Checking external dependencies**

I'm confirming that the storage library is fine and now focusing on verifying the Burn and Arithmetic libraries, starting with Burn.
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/Burn.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

/// @title Burn
/// @notice Utilities for burning stuff.
library Burn {
    /// @notice Burns a given amount of ETH.
    /// @param _amount Amount of ETH to burn.
    function eth(uint256 _amount) internal {
        new Burner{ value: _amount }();
    }

    /// @notice Burns a given amount of gas.
    /// @param _amount Amount of gas to burn.
    function gas(uint256 _amount) internal view {
        uint256 i = 0;
        uint256 initialGas = gasleft();
        while (initialGas - gasleft() < _amount) {
            ++i;
        }

thinking
**Confirming use of loop and checking arithmetic**
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/Arithmetic.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import { SignedMath } from "@openzeppelin/contracts/utils/math/SignedMath.sol";
import { FixedPointMathLib } from "@rari-capital/solmate/src/utils/FixedPointMathLib.sol";

/// @title Arithmetic
/// @notice Even more math than before.
library Arithmetic {
    /// @notice Clamps a value between a minimum and maximum.
    /// @param _value The value to clamp.
    /// @param _min   The minimum value.
    /// @param _max   The maximum value.
    /// @return The clamped value.
    function clamp(int256 _value, int256 _min, int256 _max) internal pure returns (int256) {
        return SignedMath.min(SignedMath.max(_value, _min), _max);
    }

    /// @notice (c)oefficient (d)enominator (exp)onentiation function.
    ///         Returns the result of: c * (1 - 1/d)^exp.

thinking
**Checking for portal errors**
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/PortalErrors.sol" in /tmp/codex-2i6rln9d succeeded in 10ms:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

/// @notice Error for when a deposit or withdrawal is to a bad target.
error BadTarget();
/// @notice Error for when a deposit has too much calldata.
error LargeCalldata();
/// @notice Error for when a deposit has too small of a gas limit.
error SmallGasLimit();
/// @notice Error for when a withdrawal transfer fails.
error TransferFailed();
/// @notice Error for when a method is called that only works when using a custom gas token.
error OnlyCustomGasToken();
/// @notice Error for when a method cannot be called with non zero CALLVALUE.
error NoValue();
/// @notice Error for an unauthorized CALLER.
error Unauthorized();
/// @notice Error for when a method cannot be called when paused. This could be renamed
///         to `Paused` in the future, but it collides with the `Paused` event.
error CallPaused();
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/Types.sol" in /tmp/codex-2i6rln9d succeeded in 6ms:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

/// @title Types
/// @notice Contains various types used throughout the Optimism contract system.
library Types {
    /// @notice OutputProposal represents a commitment to the L2 state. The timestamp is the L1
    ///         timestamp that the output root is posted. This timestamp is used to verify that the
    ///         finalization period has passed since the output root was submitted.
    /// @custom:field outputRoot    Hash of the L2 output.
    /// @custom:field timestamp     Timestamp of the L1 block that the output root was submitted in.
    /// @custom:field l2BlockNumber L2 block number that the output corresponds to.
    struct OutputProposal {
        bytes32 outputRoot;
        uint128 timestamp;
        uint128 l2BlockNumber;
    }

    /// @notice Struct representing the elements that are hashed together to generate an output root
    ///         which itself represents a snapshot of the L2 state.

thinking
**Checking other library presence**
exec
/bin/bash -lc "sed -n '1,200p' src/libraries/Encoding.sol" in /tmp/codex-2i6rln9d succeeded in 17ms:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import { Types } from "src/libraries/Types.sol";
import { Hashing } from "src/libraries/Hashing.sol";
import { RLPWriter } from "src/libraries/rlp/RLPWriter.sol";

/// @title Encoding
/// @notice Encoding handles Optimism's various different encoding schemes.
library Encoding {
    /// @notice RLP encodes the L2 transaction that would be generated when a given deposit is sent
    ///         to the L2 system. Useful for searching for a deposit in the L2 system. The
    ///         transaction is prefixed with 0x7e to identify its EIP-2718 type.
    /// @param _tx User deposit transaction to encode.
    /// @return RLP encoded L2 deposit transaction.
    function encodeDepositTransaction(Types.UserDepositTransaction memory _tx) internal pure returns (bytes memory) {
        bytes32 source = Hashing.hashDepositSource(_tx.l1BlockHash, _tx.logIndex);
        bytes[] memory raw = new bytes[](8);
        raw[0] = RLPWriter.writeBytes(abi.encodePacked(source));
        raw[1] = RLPWriter.writeAddress(_tx.from);
exec
/bin/bash -lc "sed -n '200,400p' src/libraries/Encoding.sol" in /tmp/codex-2i6rln9d succeeded in 8ms:
        internal
        pure
        returns (bytes memory)
    {
        require(_dependencySet.length <= type(uint8).max, "Encoding: dependency set length is too large");
        // Check that the batcher hash is just the address with 0 padding to the left for version 0.
        require(uint160(uint256(_batcherHash)) == uint256(_batcherHash), "Encoding: invalid batcher hash");

        bytes4 functionSignature = bytes4(keccak256("setL1BlockValuesInterop()"));
        return abi.encodePacked(
            functionSignature,
            _baseFeeScalar,
            _blobBaseFeeScalar,
            _sequenceNumber,
            _timestamp,
            _number,
            _baseFee,
            _blobBaseFee,
            _hash,
            _batcherHash,


thinking
**Identifying potential call reentrancy risk**

Noted that the l2Sender assignment in finalizeWithdrawalTransaction resets if the external call reverts, which may undermine reentrancy protection by unwinding state changes on revert.
thinking
**Confirming no exploitable vulnerabilities**

After thorough review of first-party contracts and upgradeable patterns, no exploitable vulnerabilities or unchecked critical issues were found; only standard design tradeoffs exist around finalizeWithdrawalTransaction behavior.
codex
{"no_findings":true,"summary":"No exploitable vulnerabilities identified in the first-party implementation code after reviewing AUDIT_BUNDLE.txt under the requested focus areas.","findings":[]}
tokens used
55,234

{
    "codex": {
        "ran_at": "2026-01-22T06:12:57.925939+00:00",
        "returncode": 0
    },
    "project": {
        "mode": "source",
        "file_count": 42,
        "import_count": 45,
        "first_party_contracts_count": 26
    },
    "summary": "No exploitable vulnerabilities identified in the first-party implementation code after reviewing AUDIT_BUNDLE.txt under the requested focus areas.",
    "raw_final": {
        "summary": "No exploitable vulnerabilities identified in the first-party implementation code after reviewing AUDIT_BUNDLE.txt under the requested focus areas.",
        "findings": [],
        "no_findings": true
    },
    "no_findings": true,
    "proxy_context": {
        "proxy_run_id": "019be3d6-837d-7028-982c-5e30893a8e0d",
        "proxy_address": "0x4e259ee5f4136408908160dd32295a5031fa426f",
        "implementation_run_id": "019be3d8-3ae4-7210-9784-c559a0c79016",
        "implementation_address": "0xbdd90485fcbcac869d5b5752179815a3103d8131"
    },
    "schema_version": 1
}

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x005e
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x5c60da1b
00000019: GT
0000001a: PUSH2 0x0043
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0x5c60da1b
00000024: EQ
00000025: PUSH2 0x00be
00000028: JUMPI
00000029: DUP1
0000002a: PUSH4 0x8f283970
0000002f: EQ
00000030: PUSH2 0x00f8
00000033: JUMPI
00000034: DUP1
00000035: PUSH4 0xf851a440
0000003a: EQ
0000003b: PUSH2 0x0118
0000003e: JUMPI
0000003f: PUSH2 0x006d
00000042: JUMP
00000043: JUMPDEST
00000044: DUP1
00000045: PUSH4 0x3659cfe6
0000004a: EQ
0000004b: PUSH2 0x0075
0000004e: JUMPI
0000004f: DUP1
00000050: PUSH4 0x4f1ef286
00000055: EQ
00000056: PUSH2 0x0095
00000059: JUMPI
0000005a: PUSH2 0x006d
0000005d: JUMP
0000005e: JUMPDEST
0000005f: CALLDATASIZE
00000060: PUSH2 0x006d
00000063: JUMPI
00000064: PUSH2 0x006b
00000067: PUSH2 0x012d
0000006a: JUMP
0000006b: JUMPDEST
0000006c: STOP
0000006d: JUMPDEST
0000006e: PUSH2 0x006b
00000071: PUSH2 0x012d
00000074: JUMP
00000075: JUMPDEST
00000076: CALLVALUE
00000077: DUP1
00000078: ISZERO
00000079: PUSH2 0x0081
0000007c: JUMPI
0000007d: PUSH1 0x00
0000007f: DUP1
00000080: REVERT
00000081: JUMPDEST
00000082: POP
00000083: PUSH2 0x006b
00000086: PUSH2 0x0090
00000089: CALLDATASIZE
0000008a: PUSH1 0x04
0000008c: PUSH2 0x06dd
0000008f: JUMP
00000090: JUMPDEST
00000091: PUSH2 0x0224
00000094: JUMP
00000095: JUMPDEST
00000096: PUSH2 0x00a8
00000099: PUSH2 0x00a3
0000009c: CALLDATASIZE
0000009d: PUSH1 0x04
0000009f: PUSH2 0x06f8
000000a2: JUMP
000000a3: JUMPDEST
000000a4: PUSH2 0x0296
000000a7: JUMP
000000a8: JUMPDEST
000000a9: PUSH1 0x40
000000ab: MLOAD
000000ac: PUSH2 0x00b5
000000af: SWAP2
000000b0: SWAP1
000000b1: PUSH2 0x077b
000000b4: JUMP
000000b5: JUMPDEST
000000b6: PUSH1 0x40
000000b8: MLOAD
000000b9: DUP1
000000ba: SWAP2
000000bb: SUB
000000bc: SWAP1
000000bd: RETURN
000000be: JUMPDEST
000000bf: CALLVALUE
000000c0: DUP1
000000c1: ISZERO
000000c2: PUSH2 0x00ca
000000c5: JUMPI
000000c6: PUSH1 0x00
000000c8: DUP1
000000c9: REVERT
000000ca: JUMPDEST
000000cb: POP
000000cc: PUSH2 0x00d3
000000cf: PUSH2 0x0419
000000d2: JUMP
000000d3: JUMPDEST
000000d4: PUSH1 0x40
000000d6: MLOAD
000000d7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000ec: SWAP1
000000ed: SWAP2
000000ee: AND
000000ef: DUP2
000000f0: MSTORE
000000f1: PUSH1 0x20
000000f3: ADD
000000f4: PUSH2 0x00b5
000000f7: JUMP
000000f8: JUMPDEST
000000f9: CALLVALUE
000000fa: DUP1
000000fb: ISZERO
000000fc: PUSH2 0x0104
000000ff: JUMPI
00000100: PUSH1 0x00
00000102: DUP1
00000103: REVERT
00000104: JUMPDEST
00000105: POP
00000106: PUSH2 0x006b
00000109: PUSH2 0x0113
0000010c: CALLDATASIZE
0000010d: PUSH1 0x04
0000010f: PUSH2 0x06dd
00000112: JUMP
00000113: JUMPDEST
00000114: PUSH2 0x04b0
00000117: JUMP
00000118: JUMPDEST
00000119: CALLVALUE
0000011a: DUP1
0000011b: ISZERO
0000011c: PUSH2 0x0124
0000011f: JUMPI
00000120: PUSH1 0x00
00000122: DUP1
00000123: REVERT
00000124: JUMPDEST
00000125: POP
00000126: PUSH2 0x00d3
00000129: PUSH2 0x0517
0000012c: JUMP
0000012d: JUMPDEST
0000012e: PUSH1 0x00
00000130: PUSH2 0x0157
00000133: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
00000154: SLOAD
00000155: SWAP1
00000156: JUMP
00000157: JUMPDEST
00000158: SWAP1
00000159: POP
0000015a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000016f: DUP2
00000170: AND
00000171: PUSH2 0x0201
00000174: JUMPI
00000175: PUSH1 0x40
00000177: MLOAD
00000178: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000199: DUP2
0000019a: MSTORE
0000019b: PUSH1 0x20
0000019d: PUSH1 0x04
0000019f: DUP3
000001a0: ADD
000001a1: MSTORE
000001a2: PUSH1 0x25
000001a4: PUSH1 0x24
000001a6: DUP3
000001a7: ADD
000001a8: MSTORE
000001a9: PUSH32 0x50726f78793a20696d706c656d656e746174696f6e206e6f7420696e69746961
000001ca: PUSH1 0x44
000001cc: DUP3
000001cd: ADD
000001ce: MSTORE
000001cf: PUSH32 0x6c697a6564000000000000000000000000000000000000000000000000000000
000001f0: PUSH1 0x64
000001f2: DUP3
000001f3: ADD
000001f4: MSTORE
000001f5: PUSH1 0x84
000001f7: ADD
000001f8: JUMPDEST
000001f9: PUSH1 0x40
000001fb: MLOAD
000001fc: DUP1
000001fd: SWAP2
000001fe: SUB
000001ff: SWAP1
00000200: REVERT
00000201: JUMPDEST
00000202: CALLDATASIZE
00000203: PUSH1 0x00
00000205: DUP1
00000206: CALLDATACOPY
00000207: PUSH1 0x00
00000209: DUP1
0000020a: CALLDATASIZE
0000020b: PUSH1 0x00
0000020d: DUP5
0000020e: GAS
0000020f: DELEGATECALL
00000210: RETURNDATASIZE
00000211: PUSH1 0x00
00000213: DUP1
00000214: RETURNDATACOPY
00000215: DUP1
00000216: PUSH2 0x021e
00000219: JUMPI
0000021a: RETURNDATASIZE
0000021b: PUSH1 0x00
0000021d: REVERT
0000021e: JUMPDEST
0000021f: POP
00000220: RETURNDATASIZE
00000221: PUSH1 0x00
00000223: RETURN
00000224: JUMPDEST
00000225: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
00000246: SLOAD
00000247: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000025c: AND
0000025d: CALLER
0000025e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000273: AND
00000274: EQ
00000275: DUP1
00000276: PUSH2 0x027d
00000279: JUMPI
0000027a: POP
0000027b: CALLER
0000027c: ISZERO
0000027d: JUMPDEST
0000027e: ISZERO
0000027f: PUSH2 0x028e
00000282: JUMPI
00000283: PUSH2 0x028b
00000286: DUP2
00000287: PUSH2 0x05a3
0000028a: JUMP
0000028b: JUMPDEST
0000028c: POP
0000028d: JUMP
0000028e: JUMPDEST
0000028f: PUSH2 0x028b
00000292: PUSH2 0x012d
00000295: JUMP
00000296: JUMPDEST
00000297: PUSH1 0x60
00000299: PUSH2 0x02c0
0000029c: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
000002bd: SLOAD
000002be: SWAP1
000002bf: JUMP
000002c0: JUMPDEST
000002c1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002d6: AND
000002d7: CALLER
000002d8: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002ed: AND
000002ee: EQ
000002ef: DUP1
000002f0: PUSH2 0x02f7
000002f3: JUMPI
000002f4: POP
000002f5: CALLER
000002f6: ISZERO
000002f7: JUMPDEST
000002f8: ISZERO
000002f9: PUSH2 0x040a
000002fc: JUMPI
000002fd: PUSH2 0x0305
00000300: DUP5
00000301: PUSH2 0x05a3
00000304: JUMP
00000305: JUMPDEST
00000306: PUSH1 0x00
00000308: DUP1
00000309: DUP6
0000030a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000031f: AND
00000320: DUP6
00000321: DUP6
00000322: PUSH1 0x40
00000324: MLOAD
00000325: PUSH2 0x032f
00000328: SWAP3
00000329: SWAP2
0000032a: SWAP1
0000032b: PUSH2 0x07ee
0000032e: JUMP
0000032f: JUMPDEST
00000330: PUSH1 0x00
00000332: PUSH1 0x40
00000334: MLOAD
00000335: DUP1
00000336: DUP4
00000337: SUB
00000338: DUP2
00000339: DUP6
0000033a: GAS
0000033b: DELEGATECALL
0000033c: SWAP2
0000033d: POP
0000033e: POP
0000033f: RETURNDATASIZE
00000340: DUP1
00000341: PUSH1 0x00
00000343: DUP2
00000344: EQ
00000345: PUSH2 0x036a
00000348: JUMPI
00000349: PUSH1 0x40
0000034b: MLOAD
0000034c: SWAP2
0000034d: POP
0000034e: PUSH1 0x1f
00000350: NOT
00000351: PUSH1 0x3f
00000353: RETURNDATASIZE
00000354: ADD
00000355: AND
00000356: DUP3
00000357: ADD
00000358: PUSH1 0x40
0000035a: MSTORE
0000035b: RETURNDATASIZE
0000035c: DUP3
0000035d: MSTORE
0000035e: RETURNDATASIZE
0000035f: PUSH1 0x00
00000361: PUSH1 0x20
00000363: DUP5
00000364: ADD
00000365: RETURNDATACOPY
00000366: PUSH2 0x036f
00000369: JUMP
0000036a: JUMPDEST
0000036b: PUSH1 0x60
0000036d: SWAP2
0000036e: POP
0000036f: JUMPDEST
00000370: POP
00000371: SWAP2
00000372: POP
00000373: SWAP2
00000374: POP
00000375: DUP2
00000376: PUSH2 0x0401
00000379: JUMPI
0000037a: PUSH1 0x40
0000037c: MLOAD
0000037d: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
0000039e: DUP2
0000039f: MSTORE
000003a0: PUSH1 0x20
000003a2: PUSH1 0x04
000003a4: DUP3
000003a5: ADD
000003a6: MSTORE
000003a7: PUSH1 0x39
000003a9: PUSH1 0x24
000003ab: DUP3
000003ac: ADD
000003ad: MSTORE
000003ae: PUSH32 0x50726f78793a2064656c656761746563616c6c20746f206e657720696d706c65
000003cf: PUSH1 0x44
000003d1: DUP3
000003d2: ADD
000003d3: MSTORE
000003d4: PUSH32 0x6d656e746174696f6e20636f6e7472616374206661696c656400000000000000
000003f5: PUSH1 0x64
000003f7: DUP3
000003f8: ADD
000003f9: MSTORE
000003fa: PUSH1 0x84
000003fc: ADD
000003fd: PUSH2 0x01f8
00000400: JUMP
00000401: JUMPDEST
00000402: SWAP2
00000403: POP
00000404: PUSH2 0x0412
00000407: SWAP1
00000408: POP
00000409: JUMP
0000040a: JUMPDEST
0000040b: PUSH2 0x0412
0000040e: PUSH2 0x012d
00000411: JUMP
00000412: JUMPDEST
00000413: SWAP4
00000414: SWAP3
00000415: POP
00000416: POP
00000417: POP
00000418: JUMP
00000419: JUMPDEST
0000041a: PUSH1 0x00
0000041c: PUSH2 0x0443
0000041f: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
00000440: SLOAD
00000441: SWAP1
00000442: JUMP
00000443: JUMPDEST
00000444: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000459: AND
0000045a: CALLER
0000045b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000470: AND
00000471: EQ
00000472: DUP1
00000473: PUSH2 0x047a
00000476: JUMPI
00000477: POP
00000478: CALLER
00000479: ISZERO
0000047a: JUMPDEST
0000047b: ISZERO
0000047c: PUSH2 0x04a5
0000047f: JUMPI
00000480: POP
00000481: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
000004a2: SLOAD
000004a3: SWAP1
000004a4: JUMP
000004a5: JUMPDEST
000004a6: PUSH2 0x04ad
000004a9: PUSH2 0x012d
000004ac: JUMP
000004ad: JUMPDEST
000004ae: SWAP1
000004af: JUMP
000004b0: JUMPDEST
000004b1: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
000004d2: SLOAD
000004d3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000004e8: AND
000004e9: CALLER
000004ea: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000004ff: AND
00000500: EQ
00000501: DUP1
00000502: PUSH2 0x0509
00000505: JUMPI
00000506: POP
00000507: CALLER
00000508: ISZERO
00000509: JUMPDEST
0000050a: ISZERO
0000050b: PUSH2 0x028e
0000050e: JUMPI
0000050f: PUSH2 0x028b
00000512: DUP2
00000513: PUSH2 0x060c
00000516: JUMP
00000517: JUMPDEST
00000518: PUSH1 0x00
0000051a: PUSH2 0x0541
0000051d: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
0000053e: SLOAD
0000053f: SWAP1
00000540: JUMP
00000541: JUMPDEST
00000542: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000557: AND
00000558: CALLER
00000559: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000056e: AND
0000056f: EQ
00000570: DUP1
00000571: PUSH2 0x0578
00000574: JUMPI
00000575: POP
00000576: CALLER
00000577: ISZERO
00000578: JUMPDEST
00000579: ISZERO
0000057a: PUSH2 0x04a5
0000057d: JUMPI
0000057e: POP
0000057f: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
000005a0: SLOAD
000005a1: SWAP1
000005a2: JUMP
000005a3: JUMPDEST
000005a4: PUSH32 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc
000005c5: DUP2
000005c6: DUP2
000005c7: SSTORE
000005c8: PUSH1 0x40
000005ca: MLOAD
000005cb: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000005e0: DUP4
000005e1: AND
000005e2: SWAP1
000005e3: PUSH32 0xbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b
00000604: SWAP1
00000605: PUSH1 0x00
00000607: SWAP1
00000608: LOG2
00000609: POP
0000060a: POP
0000060b: JUMP
0000060c: JUMPDEST
0000060d: PUSH1 0x00
0000060f: PUSH2 0x0636
00000612: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
00000633: SLOAD
00000634: SWAP1
00000635: JUMP
00000636: JUMPDEST
00000637: PUSH32 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103
00000658: DUP4
00000659: DUP2
0000065a: SSTORE
0000065b: PUSH1 0x40
0000065d: DUP1
0000065e: MLOAD
0000065f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000674: DUP1
00000675: DUP6
00000676: AND
00000677: DUP3
00000678: MSTORE
00000679: DUP7
0000067a: AND
0000067b: PUSH1 0x20
0000067d: DUP3
0000067e: ADD
0000067f: MSTORE
00000680: SWAP3
00000681: SWAP4
00000682: POP
00000683: SWAP1
00000684: SWAP2
00000685: PUSH32 0x7e644d79422f17c01e4894b5f4f588d331ebfa28653d42ae832dc59e38c9798f
000006a6: SWAP2
000006a7: ADD
000006a8: PUSH1 0x40
000006aa: MLOAD
000006ab: DUP1
000006ac: SWAP2
000006ad: SUB
000006ae: SWAP1
000006af: LOG1
000006b0: POP
000006b1: POP
000006b2: POP
000006b3: JUMP
000006b4: JUMPDEST
000006b5: DUP1
000006b6: CALLDATALOAD
000006b7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000006cc: DUP2
000006cd: AND
000006ce: DUP2
000006cf: EQ
000006d0: PUSH2 0x06d8
000006d3: JUMPI
000006d4: PUSH1 0x00
000006d6: DUP1
000006d7: REVERT
000006d8: JUMPDEST
000006d9: SWAP2
000006da: SWAP1
000006db: POP
000006dc: JUMP
000006dd: JUMPDEST
000006de: PUSH1 0x00
000006e0: PUSH1 0x20
000006e2: DUP3
000006e3: DUP5
000006e4: SUB
000006e5: SLT
000006e6: ISZERO
000006e7: PUSH2 0x06ef
000006ea: JUMPI
000006eb: PUSH1 0x00
000006ed: DUP1
000006ee: REVERT
000006ef: JUMPDEST
000006f0: PUSH2 0x0412
000006f3: DUP3
000006f4: PUSH2 0x06b4
000006f7: JUMP
000006f8: JUMPDEST
000006f9: PUSH1 0x00
000006fb: DUP1
000006fc: PUSH1 0x00
000006fe: PUSH1 0x40
00000700: DUP5
00000701: DUP7
00000702: SUB
00000703: SLT
00000704: ISZERO
00000705: PUSH2 0x070d
00000708: JUMPI
00000709: PUSH1 0x00
0000070b: DUP1
0000070c: REVERT
0000070d: JUMPDEST
0000070e: PUSH2 0x0716
00000711: DUP5
00000712: PUSH2 0x06b4
00000715: JUMP
00000716: JUMPDEST
00000717: SWAP3
00000718: POP
00000719: PUSH1 0x20
0000071b: DUP5
0000071c: ADD
0000071d: CALLDATALOAD
0000071e: PUSH8 0xffffffffffffffff
00000727: DUP1
00000728: DUP3
00000729: GT
0000072a: ISZERO
0000072b: PUSH2 0x0733
0000072e: JUMPI
0000072f: PUSH1 0x00
00000731: DUP1
00000732: REVERT
00000733: JUMPDEST
00000734: DUP2
00000735: DUP7
00000736: ADD
00000737: SWAP2
00000738: POP
00000739: DUP7
0000073a: PUSH1 0x1f
0000073c: DUP4
0000073d: ADD
0000073e: SLT
0000073f: PUSH2 0x0747
00000742: JUMPI
00000743: PUSH1 0x00
00000745: DUP1
00000746: REVERT
00000747: JUMPDEST
00000748: DUP2
00000749: CALLDATALOAD
0000074a: DUP2
0000074b: DUP2
0000074c: GT
0000074d: ISZERO
0000074e: PUSH2 0x0756
00000751: JUMPI
00000752: PUSH1 0x00
00000754: DUP1
00000755: REVERT
00000756: JUMPDEST
00000757: DUP8
00000758: PUSH1 0x20
0000075a: DUP3
0000075b: DUP6
0000075c: ADD
0000075d: ADD
0000075e: GT
0000075f: ISZERO
00000760: PUSH2 0x0768
00000763: JUMPI
00000764: PUSH1 0x00
00000766: DUP1
00000767: REVERT
00000768: JUMPDEST
00000769: PUSH1 0x20
0000076b: DUP4
0000076c: ADD
0000076d: SWAP5
0000076e: POP
0000076f: DUP1
00000770: SWAP4
00000771: POP
00000772: POP
00000773: POP
00000774: POP
00000775: SWAP3
00000776: POP
00000777: SWAP3
00000778: POP
00000779: SWAP3
0000077a: JUMP
0000077b: JUMPDEST
0000077c: PUSH1 0x00
0000077e: PUSH1 0x20
00000780: DUP1
00000781: DUP4
00000782: MSTORE
00000783: DUP4
00000784: MLOAD
00000785: DUP1
00000786: DUP3
00000787: DUP6
00000788: ADD
00000789: MSTORE
0000078a: PUSH1 0x00
0000078c: JUMPDEST
0000078d: DUP2
0000078e: DUP2
0000078f: LT
00000790: ISZERO
00000791: PUSH2 0x07a8
00000794: JUMPI
00000795: DUP6
00000796: DUP2
00000797: ADD
00000798: DUP4
00000799: ADD
0000079a: MLOAD
0000079b: DUP6
0000079c: DUP3
0000079d: ADD
0000079e: PUSH1 0x40
000007a0: ADD
000007a1: MSTORE
000007a2: DUP3
000007a3: ADD
000007a4: PUSH2 0x078c
000007a7: JUMP
000007a8: JUMPDEST
000007a9: DUP2
000007aa: DUP2
000007ab: GT
000007ac: ISZERO
000007ad: PUSH2 0x07ba
000007b0: JUMPI
000007b1: PUSH1 0x00
000007b3: PUSH1 0x40
000007b5: DUP4
000007b6: DUP8
000007b7: ADD
000007b8: ADD
000007b9: MSTORE
000007ba: JUMPDEST
000007bb: POP
000007bc: PUSH1 0x1f
000007be: ADD
000007bf: PUSH32 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0
000007e0: AND
000007e1: SWAP3
000007e2: SWAP1
000007e3: SWAP3
000007e4: ADD
000007e5: PUSH1 0x40
000007e7: ADD
000007e8: SWAP4
000007e9: SWAP3
000007ea: POP
000007eb: POP
000007ec: POP
000007ed: JUMP
000007ee: JUMPDEST
000007ef: DUP2
000007f0: DUP4
000007f1: DUP3
000007f2: CALLDATACOPY
000007f3: PUSH1 0x00
000007f5: SWAP2
000007f6: ADD
000007f7: SWAP1
000007f8: DUP2
000007f9: MSTORE
000007fa: SWAP2
000007fb: SWAP1
000007fc: POP
000007fd: JUMP
000007fe: INVALID
000007ff: LOG1
00000800: PUSH5 0x736f6c6343
00000806: STOP
00000807: ADDMOD
00000808: UNKNOWN(0x0F)
00000809: STOP
0000080a: EXP