Analysis Run

{"no_findings":false,"summary":"Bytecode shows three CALL sites with computed target/value and ownership-related selectors writing slot 0, but no explicit guard patterns were detected; findings below are conservative and highlight areas that require source/intent verification.","findings":[{"severity":"medium","category":"reentrancy","title":"External CALL with value to computed target (untrusted) and no guard detected","exploit_scenario":"If any of the public entrypoints allow user-controlled target/value, an attacker could trigger a value-bearing CALL to an arbitrary contract, potentially reentering or draining ETH. Validation data suggests the target may be constant/self, so this could be a false positive; confirm call targets and access control in source or via dynamic traces.","recommendation":"Restrict any arbitrary-call functionality to authorized users, validate target/value, and apply checks-effects-interactions or a reentrancy guard around value transfers.","evidence":"Detector reports 3 CALL sites with computed target/value, no guards detected, and returndata_checked=null; callsites at pc 669, 758, 2329.","locations":["pc:0x29d","pc:0x2f6","pc:0x919"]},{"severity":"medium","category":"access_control","title":"Ownership slot update appears without detected authorization checks","exploit_scenario":"If `transferOwnership`/`renounceOwnership` are callable by anyone (no onlyOwner guard), an attacker could write slot 0 and seize ownership, then control privileged actions. Guard detection is heuristic and may miss custom patterns; verify explicitly.","recommendation":"Ensure ownership-changing functions enforce `msg.sender == owner` (or equivalent) and that only authorized callers can reach the SSTORE path.","evidence":"Selectors include `0xf2fde38b` and `0x715018a6`; storage slot 0 is written at pc 1057; `auth.guards` is empty for all functions.","locations":["selector:0xf2fde38b","selector:0x715018a6","pc:0x421"]}]}

OpenAI Codex v0.77.0 (research preview)
--------
workdir: /tmp/codex-ducqj2w_
model: gpt-5.2-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: auto
session id: 019be48f-88e0-72a1-8a75-dbd9b6e2b07b
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.

Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.

Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".

Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
mcp startup: no servers

thinking
**Reading bytecode bundle file**
exec
/bin/bash -lc ls in /tmp/codex-ducqj2w_ succeeded in 7ms:
BYTECODE_BUNDLE.json
codex-output-schema.json
exec
/bin/bash -lc 'cat BYTECODE_BUNDLE.json' in /tmp/codex-ducqj2w_ succeeded in 6ms:
{
  "analysis_artifact": {
    "address": "0x3011e9752e6fe7031cefcc9d424ebabacb28c1ce",
    "artifact_hash": "0xcfb2262877650d099257437ce16d4b9d55e6cfaf14045b75e1fd26e66184814f",
    "artifact_json": {
      "auth": {
        "guards": []
      },
      "basic_blocks": [
        {
          "end_pc": 12,
          "hash": "0x704e5bf4572ea6e0c1eb6f381c306f5d855cb78f4ae6559eee088bf877239498",
          "opcodes": [
            "PUSH1",
            "PUSH1",
            "MSTORE",
            "PUSH1",
            "CALLDATASIZE",
            "LT",
            "PUSH2",

thinking
**Identifying key function selectors**

I'm mapping selectors to known Ownable functions and planning to locate their callsites by searching large JSON artifacts for opcode positions to confirm function behaviors like withdraw.
exec
/bin/bash -lc "rg -n \"pc\":\\ 669 -n BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ exited 1 in 15ms:


thinking
**Adjusting search strategy**

I'm refining the search pattern to use "call:669" instead of just "pc" to better locate relevant callsites.
exec
/bin/bash -lc 'rg -n "call:669|pc": 669 BYTECODE_BUNDLE.json' in /tmp/codex-ducqj2w_ exited 2 in 9ms:
rg: 669: No such file or directory (os error 2)
BYTECODE_BUNDLE.json:3722:          "to": "call:669",
BYTECODE_BUNDLE.json:3726:          "from": "call:669",
BYTECODE_BUNDLE.json:4824:          "id": "call:669",

thinking
**Refining search query**

Adjusting ripgrep search to include escaped quotes around the key for accurate matching of `"pc": 669` due to prior misinterpretation from spaces.
exec
/bin/bash -lc "rg -n '\"pc\": 669' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
2275:          "pc": 669,
4826:          "pc": 669,
4884:            "pc": 669,
4936:            "pc": 669,

thinking
**Planning contextual section extraction**
exec
/bin/bash -lc "sed -n '2250,2305p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 8ms:
          ],
          "start_pc": 2295
        },
        {
          "end_pc": 2346,
          "hash": "0x0480d134ac5b3ef7a960ee7284df69c56260a2de018afafb5f0685e9456ccc2d",
          "opcodes": [
            "ADDMOD",
            "AND",
            "STOP"
          ],
          "start_pc": 2344
        },
        {
          "end_pc": 2347,
          "hash": "0x5032e4bb7b2c125ce2c619278521dfcc273871bebb5b3b423075c66582b63e77",
          "opcodes": [
            "CALLER"
          ],
          "start_pc": 2347

thinking
**Locating opcodes near key PC values**

I'm targeting around PC 621 and 669 to find opcode details for the CALL instruction and surrounding blocks, aiming to clarify the call path by searching for "start_pc": 621 in the code or data.
exec
/bin/bash -lc "rg -n '\"start_pc\": 621' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 7ms:
719:          "start_pc": 621
4106:          "start_pc": 621,
exec
/bin/bash -lc "sed -n '680,740p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 27ms:
        {
          "end_pc": 681,
          "hash": "0x9a7731eff37e0587bf15bb68ad6f7500018e7dba5cc7e9226a36c029046b6fe2",
          "opcodes": [
            "JUMPDEST",
            "OP_84",
            "PUSH20",
            "AND",
            "PUSH2",
            "OP_83",
            "OP_90",
            "OP_81",
            "ISZERO",
            "MUL",
            "OP_90",
            "PUSH1",
            "MLOAD",
            "PUSH1",
            "PUSH1",
            "MLOAD",

thinking
**Inspecting call instructions near block boundaries**
exec
/bin/bash -lc "sed -n '740,820p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 7ms:
            "POP",
            "PUSH18",
            "PUSH20",
            "AND",
            "PUSH2",
            "OP_82",
            "OP_90",
            "OP_81",
            "ISZERO",
            "MUL",
            "OP_90",
            "PUSH1",
            "MLOAD",
            "PUSH1",
            "PUSH1",
            "MLOAD",
            "OP_80",
            "OP_83",
            "SUB",
            "OP_81",

thinking
**Identifying call locations for inspection**
exec
/bin/bash -lc "sed -n '2260,2335p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
          ],
          "start_pc": 2344
        },
        {
          "end_pc": 2347,
          "hash": "0x5032e4bb7b2c125ce2c619278521dfcc273871bebb5b3b423075c66582b63e77",
          "opcodes": [
            "CALLER"
          ],
          "start_pc": 2347
        }
      ],
      "callsites": [
        {
          "opcode": "CALL",
          "pc": 669,
          "returndata_checked": null,
          "target_expression_category": "computed",
          "value_expression_category": "computed"
        },

thinking
**Searching call location near 2329**

I'm targeting the call at position 2329 and will look around start_pc values near 2286 and 2295 to locate the corresponding block in the list.
exec
/bin/bash -lc "rg -n '\"start_pc\": 2286|\"start_pc\": 2295|\"start_pc\": 2320|\"start_pc\": 2325' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
2251:          "start_pc": 2295
4806:          "start_pc": 2295,

thinking
**Inspecting opcode block around 2295**

I'm focusing on the opcode block starting at 2295, which likely includes a CALL operation, by examining code lines roughly between 2235 to 2265 to confirm its contents and boundaries.
exec
/bin/bash -lc "sed -n '2235,2265p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 5ms:
            "PUSH11",
            "OP_8B",
            "OP_8B",
            "OP_8E",
            "OP_A6",
            "OP_4A",
            "OP_2A",
            "OP_2E",
            "OP_5C",
            "PUSH0",
            "CALL",
            "OR",
            "OP_3A",
            "PUSH10",
            "STOP"
          ],
          "start_pc": 2295
        },
        {
          "end_pc": 2346,

thinking
**Noticing unusual opcodes and suspecting disassembly noise**

This block shows irregular opcodes including CALL and PUSH0, suggesting possible data confusion in disassembly. Function selectors for ownership and control are identified, but entry points have suspicious huge values likely unrelated to actual PCs. Next, I'll analyze storage mappings and callsites in the artifact JSON to clarify access control and storage slot roles.
exec
/bin/bash -lc "rg -n 'storage' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
2920:          "storage": {
2949:          "storage": {
2978:          "storage": {
3007:          "storage": {
3040:      "storage": {
exec
/bin/bash -lc "sed -n '2910,2955p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 13ms:
            "guards": []
          },
          "entry_pc": 2376452955,
          "selector": "0x715018a6",
          "sinks": {
            "call": 3,
            "delegatecall": 0,
            "selfdestruct": 0,
            "staticcall": 0
          },
          "storage": {
            "reads": 4,
            "slots": [
              {
                "op": "SLOAD",
                "pc": 254,
                "slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              {
                "op": "SLOAD",
exec
/bin/bash -lc "sed -n '2955,3005p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 8ms:
                "slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              {
                "op": "SLOAD",
                "pc": 1064,
                "slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
              }
            ],
            "writes": 1
          }
        },
        {
          "auth": {
            "guards": []
          },
          "entry_pc": 4076725131,
          "selector": "0xb5c5f672",
          "sinks": {
            "call": 3,
            "delegatecall": 0,
exec
/bin/bash -lc "sed -n '3005,3065p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 13ms:
            "staticcall": 0
          },
          "storage": {
            "reads": 4,
            "slots": [
              {
                "op": "SLOAD",
                "pc": 254,
                "slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              {
                "op": "SLOAD",
                "pc": 1064,
                "slot": "0x0000000000000000000000000000000000000000000000000000000000000000"
              }
            ],
            "writes": 1
          }
        }
      ],

thinking
**Analyzing access control and callsites**

No explicit guards detected and storage slot 0 suggests an owner variable without obvious access control. Multiple callsites appear reachable from all functions, so next I'll inspect the call graph edges to clarify call flows and potential access restrictions.
exec
/bin/bash -lc 'rg -n "call_graph|call_edges|callgraph|function_edges|calls" BYTECODE_BUNDLE.json' in /tmp/codex-ducqj2w_ succeeded in 17ms:
2272:      "callsites": [
4827:          "type": "callsite"
4833:          "type": "callsite"
4839:          "type": "callsite"
4932:        "eth_value_calls": 3,


thinking
**Analyzing callsite vulnerabilities**

The call appears to be a self-call with computed value transfer, likely internal and not external, reducing reentrancy risk despite nonzero value; untrusted call detection seems like a false positive here.
thinking
**Assessing function selectors and storage writes**

No proxies or upgrade mechanisms detected, but some functions (not clearly identified) show storage writes including slot 0, possibly owner-related; selector 0xb5c5f672 is uncertain but tied to storage activity worth noting for further review.
exec
/bin/bash -lc "rg -n 'SSTORE' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 9ms:
1020:            "SSTORE",
exec
/bin/bash -lc "sed -n '1000,1035p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 26ms:
            "POP",
            "OP_81",
            "PUSH1",
            "OP_80",
            "PUSH2",
            "EXP",
            "OP_81",
            "SLOAD",
            "OP_81",
            "PUSH20",
            "MUL",
            "NOT",
            "AND",
            "OP_90",
            "OP_83",
            "PUSH20",
            "AND",
            "MUL",
            "OR",
            "OP_90",

thinking
**Locating basic block with SSTORE**

I'm focusing on finding the basic block around the program counter where SSTORE occurs, targeting start_pc near 981–1020 to identify the exact block and confirm its position.
exec
/bin/bash -lc 'rg -n "SSTORE" -n BYTECODE_BUNDLE.json -n -C 3' in /tmp/codex-ducqj2w_ succeeded in 9ms:
1017-            "MUL",
1018-            "OR",
1019-            "OP_90",
1020:            "SSTORE",
1021-            "POP",
1022-            "OP_81",
1023-            "PUSH20",

thinking
**Checking context for block start**

I'm looking at lines around 970 to find the start_pc value needed for the current block.
exec
/bin/bash -lc "sed -n '980,1015p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
          "start_pc": 1055
        },
        {
          "end_pc": 1252,
          "hash": "0xf7e50ad16ac833c6fca88bc9f5e2c7e5eeeb24e359add3dfd7a8c45a5e5bed27",
          "opcodes": [
            "JUMPDEST",
            "PUSH1",
            "OP_80",
            "PUSH1",
            "OP_90",
            "SLOAD",
            "OP_90",
            "PUSH2",
            "EXP",
            "OP_90",
            "DIV",
            "PUSH20",
            "AND",
            "OP_90",


thinking
**Clarifying SSTORE location formatting**

I'm weighing options to report the SSTORE instruction's program counter, deciding between exact numeric offsets versus referencing the block start address, leaning toward using the block start PC in hex (e.g., "pc:0x41f") for accuracy and clarity.
thinking
**Checking ownership guard presence**

No explicit onlyOwner pattern was found, so I'm verifying if CALLER is compared to SLOAD for ownership guards by searching all CALLER opcode occurrences to detect potential access control.
exec
/bin/bash -lc "rg -n 'CALLER' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
1050:            "CALLER",
2267:            "CALLER"

thinking
**Inspecting CALLER instructions around key blocks**
exec
/bin/bash -lc "sed -n '1035,1065p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 5ms:
            "SUB",
            "OP_90",
            "OP_A3",
            "POP",
            "POP",
            "JUMP"
          ],
          "start_pc": 1057
        },
        {
          "end_pc": 1260,
          "hash": "0x93ae16e4e899a95f4cf076ae247e04c087039cc8882a957b75f32924c9151376",
          "opcodes": [
            "JUMPDEST",
            "PUSH1",
            "CALLER",
            "OP_90",
            "POP",
            "OP_90",
            "JUMP"


thinking
**Analyzing caller versus storage checks**

Identified a block pushing CALLER seemingly returning msg.sender; this likely supports authorization but doesn't itself guard. Next, I'll hunt for patterns comparing CALLER to SLOAD with EQ and conditional REVERT nearby to find actual access control checks.
thinking
**Assessing call patterns and access control absence**

No explicit require-style auth guards found around CALLER usage; calls appear internal and possibly self-calls forwarding via call. No delegatecall or upgrade proxy signs detected. Functions generally enforce non-payable via CALLVALUE checks, but some calls pass value, indicating possible withdrawal or transfer logic needing scrutiny for access control.
exec
/bin/bash -lc 'rg -n "call:2329" BYTECODE_BUNDLE.json' in /tmp/codex-ducqj2w_ succeeded in 7ms:
3742:          "to": "call:2329",
3746:          "from": "call:2329",
4836:          "id": "call:2329",

thinking
**Reviewing edge lines for context**
exec
/bin/bash -lc "sed -n '3710,3755p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 7ms:
        {
          "from": "fn:0x8da5cb5b",
          "to": "bb:3049649778",
          "type": "entry"
        },
        {
          "from": "fn:0xb5c5f672",
          "to": "bb:4076725131",
          "type": "entry"
        },
        {
          "from": "bb:621",
          "to": "call:669",
          "type": "contains"
        },
        {
          "from": "call:669",
          "to": "sink:call",
          "type": "capability"
        },


thinking
**Assessing callsite reachability and validation**

The edge list shows callsites but not clear reachability from entry, with unusual large basic block IDs likely representing functions outside the list. Given this ambiguity, I'll focus on conservative issues: untrusted CALL targets from calldata without return or reentrancy checks, noting callsite PCs and lack of guards. Also, storage slot 0 appears used for ownership with relevant selectors but no detected access control, needing verification.
thinking
**Analyzing access control and potential reentrancy risks**

No ownership guards are detected on key functions, so I'll flag low-severity missing access control with a caution that standard patterns might differ. The function matching selector 0xb5c5f672 likely sends ETH out (a withdraw-like payout) using msg.sender as target without storage updates after the call, reducing reentrancy risk but still requiring scrutiny. Next, I'll examine opcode blocks around start_pc 296 to confirm state update order and validation behavior.
exec
/bin/bash -lc "sed -n '280,360p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 7ms:
        {
          "end_pc": 185,
          "hash": "0x08121358f86f9bbc415401c0ab783e4ac0e125ba072ad68fb525223b8eafa42f",
          "opcodes": [
            "JUMPDEST",
            "STOP"
          ],
          "start_pc": 184
        },
        {
          "end_pc": 193,
          "hash": "0x6d6dcddefe2c17958bc80a76fd9afd8b1f785e22d13114302ee945200215039b",
          "opcodes": [
            "JUMPDEST",
            "CALLVALUE",
            "OP_80",
            "ISZERO",
            "PUSH2",
            "JUMPI"
          ],

thinking
**Continuing search for start_pc block**
exec
/bin/bash -lc "sed -n '296,340p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
            "ISZERO",
            "PUSH2",
            "JUMPI"
          ],
          "start_pc": 186
        },
        {
          "end_pc": 197,
          "hash": "0xab6cc651d136de57d3f8a5872e8d47e1d5e5df414b2c1967fc6fcd5e4e94a57e",
          "opcodes": [
            "PUSH1",
            "OP_80",
            "REVERT"
          ],
          "start_pc": 194
        },
        {
          "end_pc": 219,
          "hash": "0x63be8f07f583476300f27f4d43b3b5882ce10065025478b9437fe36ca0beb03d",
          "opcodes": [

thinking
**Planning focused search for start_pc 296**
exec
/bin/bash -lc "rg -n '\"start_pc\": 296' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 10ms:
432:          "start_pc": 296
3987:          "start_pc": 296,
exec
/bin/bash -lc "sed -n '420,460p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
        {
          "end_pc": 304,
          "hash": "0x6c021bb6eeba9df77419f78cd7f415603d1ac76a8101990d307efa69412d505e",
          "opcodes": [
            "JUMPDEST",
            "OP_80",
            "SELFBALANCE",
            "LT",
            "ISZERO",
            "PUSH2",
            "JUMPI"
          ],
          "start_pc": 296
        },
        {
          "end_pc": 353,
          "hash": "0x2c0cb3d1a77301a45b63a09b5fd9743f72b7a95e268c4f5ef4d574b8da4c9556",
          "opcodes": [
            "PUSH1",
            "MLOAD",

thinking
**Tracing multiple balance checks**

There are two functions enforcing selfbalance checks that possibly converge on calls at blocks 621 or 691; next, I'll locate and inspect block 552 for its role in the flow.
exec
/bin/bash -lc "sed -n '520,570p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 7ms:
          "start_pc": 385
        },
        {
          "end_pc": 442,
          "hash": "0xfb9076548a3d730123676230bd61137daa7610b464d03d2e6e289913e285c716",
          "opcodes": [
            "JUMPDEST",
            "PUSH1",
            "MLOAD",
            "OP_80",
            "OP_91",
            "SUB",
            "OP_90",
            "REVERT"
          ],
          "start_pc": 434
        },
        {
          "end_pc": 451,
          "hash": "0xdd4f4e81dded80c354f287d94738fe497adc05b7021eaf8a71f90826ae7c1581",
exec
/bin/bash -lc "sed -n '540,620p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
          "opcodes": [
            "JUMPDEST",
            "PUSH1",
            "OP_81",
            "GT",
            "PUSH2",
            "JUMPI"
          ],
          "start_pc": 443
        },
        {
          "end_pc": 500,
          "hash": "0x1e450435c0f148e291c85996cde059196bef33e67a6e5248aefe87e1b1df76f9",
          "opcodes": [
            "PUSH1",
            "MLOAD",
            "PUSH32",
            "OP_81",
            "MSTORE",
            "PUSH1",

thinking
**Continuing processing block 552**
exec
/bin/bash -lc "sed -n '550,610p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 7ms:
        {
          "end_pc": 500,
          "hash": "0x1e450435c0f148e291c85996cde059196bef33e67a6e5248aefe87e1b1df76f9",
          "opcodes": [
            "PUSH1",
            "MLOAD",
            "PUSH32",
            "OP_81",
            "MSTORE",
            "PUSH1",
            "ADD",
            "PUSH2",
            "OP_90",
            "PUSH2",
            "JUMP"
          ],
          "start_pc": 452
        },
        {
          "end_pc": 509,

thinking
**Identifying sed usage for block 552**
exec
/bin/bash -lc "sed -n '560,640p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
            "ADD",
            "PUSH2",
            "OP_90",
            "PUSH2",
            "JUMP"
          ],
          "start_pc": 452
        },
        {
          "end_pc": 509,
          "hash": "0x124f5ede34d39da1c91054d99b1d02206b1b2581eeb75151cb711a9945424a7d",
          "opcodes": [
            "JUMPDEST",
            "PUSH1",
            "MLOAD",
            "OP_80",
            "OP_91",
            "SUB",
            "OP_90",
            "REVERT"


thinking
**Identifying critical access control and call issues**

The contract makes external calls with ETH value to computed targets without checking return data and lacks reentrancy guards. Although ownership-related selectors appear, no access control guards seem implemented, risking unauthorized use of transferOwnership and critical state writes.
thinking
**Analyzing absence of caller checks near storage writes**

Initial inspection near the storage update lacks direct CALLER comparisons, suggesting no inline require for access control there. I'll investigate preceding blocks to find any CALLER-based check that might guard these writes.
exec
/bin/bash -lc "rg -n '\"start_pc\": 103|\"start_pc\": 104|\"start_pc\": 105' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 7ms:
971:          "start_pc": 1046
980:          "start_pc": 1055
1042:          "start_pc": 1057
4218:          "start_pc": 1046,
4225:          "start_pc": 1055,
4232:          "start_pc": 1057,
exec
/bin/bash -lc "sed -n '950,990p' BYTECODE_BUNDLE.json" in /tmp/codex-ducqj2w_ succeeded in 6ms:
            "PUSH2",
            "OP_91",
            "OP_90",
            "PUSH2",
            "JUMP"
          ],
          "start_pc": 995
        },
        {
          "end_pc": 1054,
          "hash": "0x73722c5867dfca572d7d7cdea5f895bdf3a243232e6bbf1324883ed80d4df057",
          "opcodes": [
            "JUMPDEST",
            "PUSH1",
            "MLOAD",
            "OP_80",
            "OP_91",
            "SUB",
            "OP_90",
            "REVERT"


thinking
**Clarifying block start addresses**

There appears to be confusion with two code blocks both labeled with start_pc 1055 but containing different opcodes; this likely means the SSTORE block actually starts at 1057, not 1055.
thinking
**Verifying code snippet consistency**

I'm rechecking lines 970 to 1030 to clarify the apparent duplication or mislabeling of blocks around start_pc 1055.
exec
/bin/bash -lc "nl -ba BYTECODE_BUNDLE.json | sed -n '960,1035p'" in /tmp/codex-ducqj2w_ succeeded in 9ms:
   960	          "hash": "0x73722c5867dfca572d7d7cdea5f895bdf3a243232e6bbf1324883ed80d4df057",
   961	          "opcodes": [
   962	            "JUMPDEST",
   963	            "PUSH1",
   964	            "MLOAD",
   965	            "OP_80",
   966	            "OP_91",
   967	            "SUB",
   968	            "OP_90",
   969	            "REVERT"
   970	          ],
   971	          "start_pc": 1046
   972	        },
   973	        {
   974	          "end_pc": 1056,
   975	          "hash": "0xf4ea4f3c2bde7fbd40db23cc94322068865de4ed7ba712928f25c23989c43b33",
   976	          "opcodes": [
   977	            "JUMPDEST",
   978	            "JUMP"
   979	          ],

thinking
**Continuing to clarify block boundaries**

I'm verifying start and end program counters for SSTORE blocks and will review additional lines beyond 1035 to confirm exact start_pc values.
exec
/bin/bash -lc "nl -ba BYTECODE_BUNDLE.json | sed -n '1032,1045p'" in /tmp/codex-ducqj2w_ succeeded in 7ms:
  1032	            "MLOAD",
  1033	            "OP_80",
  1034	            "OP_91",
  1035	            "SUB",
  1036	            "OP_90",
  1037	            "OP_A3",
  1038	            "POP",
  1039	            "POP",
  1040	            "JUMP"
  1041	          ],
  1042	          "start_pc": 1057
  1043	        },
  1044	        {
  1045	          "end_pc": 1260,


thinking
**Verifying access control before storage update**

The SSTORE at PC 0x421 lacks an in-block CALLER check, suggesting access control likely occurs in preceding blocks. Next, I'll inspect predecessor blocks or call graph edges to confirm ownership checks before this storage write.
thinking
**Summarizing potential access control and untrusted call risks**

I'm consolidating findings about possible missing authorization on ownership updates and untrusted external calls with ETH value and no guards detected, outlining evidence, severity, and recommendations for both issues to produce a final JSON report.
codex
{"no_findings":false,"summary":"Bytecode shows three CALL sites with computed target/value and ownership-related selectors writing slot 0, but no explicit guard patterns were detected; findings below are conservative and highlight areas that require source/intent verification.","findings":[{"severity":"medium","category":"reentrancy","title":"External CALL with value to computed target (untrusted) and no guard detected","exploit_scenario":"If any of the public entrypoints allow user-controlled target/value, an attacker could trigger a value-bearing CALL to an arbitrary contract, potentially reentering or draining ETH. Validation data suggests the target may be constant/self, so this could be a false positive; confirm call targets and access control in source or via dynamic traces.","recommendation":"Restrict any arbitrary-call functionality to authorized users, validate target/value, and apply checks-effects-interactions or a reentrancy guard around value transfers.","evidence":"Detector reports 3 CALL sites with computed target/value, no guards detected, and returndata_checked=null; callsites at pc 669, 758, 2329.","locations":["pc:0x29d","pc:0x2f6","pc:0x919"]},{"severity":"medium","category":"access_control","title":"Ownership slot update appears without detected authorization checks","exploit_scenario":"If `transferOwnership`/`renounceOwnership` are callable by anyone (no onlyOwner guard), an attacker could write slot 0 and seize ownership, then control privileged actions. Guard detection is heuristic and may miss custom patterns; verify explicitly.","recommendation":"Ensure ownership-changing functions enforce `msg.sender == owner` (or equivalent) and that only authorized callers can reach the SSTORE path.","evidence":"Selectors include `0xf2fde38b` and `0x715018a6`; storage slot 0 is written at pc 1057; `auth.guards` is empty for all functions.","locations":["selector:0xf2fde38b","selector:0x715018a6","pc:0x421"]}]}
tokens used
75,811

{
    "codex": {
        "ran_at": "2026-01-22T07:20:56.207687+00:00",
        "returncode": 0
    },
    "project": {
        "mode": "bytecode",
        "bytecode_length": 4698,
        "bytecode_truncated": false,
        "capability_graph_present": true,
        "analysis_artifact_present": true
    },
    "summary": "Bytecode shows three CALL sites with computed target/value and ownership-related selectors writing slot 0, but no explicit guard patterns were detected; findings below are conservative and highlight areas that require source/intent verification.",
    "raw_final": {
        "summary": "Bytecode shows three CALL sites with computed target/value and ownership-related selectors writing slot 0, but no explicit guard patterns were detected; findings below are conservative and highlight areas that require source/intent verification.",
        "findings": [
            {
                "title": "External CALL with value to computed target (untrusted) and no guard detected",
                "category": "reentrancy",
                "evidence": "Detector reports 3 CALL sites with computed target/value, no guards detected, and returndata_checked=null; callsites at pc 669, 758, 2329.",
                "severity": "medium",
                "locations": [
                    "pc:0x29d",
                    "pc:0x2f6",
                    "pc:0x919"
                ],
                "recommendation": "Restrict any arbitrary-call functionality to authorized users, validate target/value, and apply checks-effects-interactions or a reentrancy guard around value transfers.",
                "exploit_scenario": "If any of the public entrypoints allow user-controlled target/value, an attacker could trigger a value-bearing CALL to an arbitrary contract, potentially reentering or draining ETH. Validation data suggests the target may be constant/self, so this could be a false positive; confirm call targets and access control in source or via dynamic traces."
            },
            {
                "title": "Ownership slot update appears without detected authorization checks",
                "category": "access_control",
                "evidence": "Selectors include `0xf2fde38b` and `0x715018a6`; storage slot 0 is written at pc 1057; `auth.guards` is empty for all functions.",
                "severity": "medium",
                "locations": [
                    "selector:0xf2fde38b",
                    "selector:0x715018a6",
                    "pc:0x421"
                ],
                "recommendation": "Ensure ownership-changing functions enforce `msg.sender == owner` (or equivalent) and that only authorized callers can reach the SSTORE path.",
                "exploit_scenario": "If `transferOwnership`/`renounceOwnership` are callable by anyone (no onlyOwner guard), an attacker could write slot 0 and seize ownership, then control privileged actions. Guard detection is heuristic and may miss custom patterns; verify explicitly."
            }
        ],
        "no_findings": false
    },
    "no_findings": false,
    "schema_version": 1
}

00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x0043
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x715018a6
00000019: EQ
0000001a: PUSH2 0x004f
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0x8da5cb5b
00000024: EQ
00000025: PUSH2 0x0066
00000028: JUMPI
00000029: DUP1
0000002a: PUSH4 0xb5c5f672
0000002f: EQ
00000030: PUSH2 0x0091
00000033: JUMPI
00000034: DUP1
00000035: PUSH4 0xf2fde38b
0000003a: EQ
0000003b: PUSH2 0x00ba
0000003e: JUMPI
0000003f: PUSH2 0x004a
00000042: JUMP
00000043: JUMPDEST
00000044: CALLDATASIZE
00000045: PUSH2 0x004a
00000048: JUMPI
00000049: STOP
0000004a: JUMPDEST
0000004b: PUSH1 0x00
0000004d: DUP1
0000004e: REVERT
0000004f: JUMPDEST
00000050: CALLVALUE
00000051: DUP1
00000052: ISZERO
00000053: PUSH2 0x005b
00000056: JUMPI
00000057: PUSH1 0x00
00000059: DUP1
0000005a: REVERT
0000005b: JUMPDEST
0000005c: POP
0000005d: PUSH2 0x0064
00000060: PUSH2 0x00e3
00000063: JUMP
00000064: JUMPDEST
00000065: STOP
00000066: JUMPDEST
00000067: CALLVALUE
00000068: DUP1
00000069: ISZERO
0000006a: PUSH2 0x0072
0000006d: JUMPI
0000006e: PUSH1 0x00
00000070: DUP1
00000071: REVERT
00000072: JUMPDEST
00000073: POP
00000074: PUSH2 0x007b
00000077: PUSH2 0x00f7
0000007a: JUMP
0000007b: JUMPDEST
0000007c: PUSH1 0x40
0000007e: MLOAD
0000007f: PUSH2 0x0088
00000082: SWAP2
00000083: SWAP1
00000084: PUSH2 0x052e
00000087: JUMP
00000088: JUMPDEST
00000089: PUSH1 0x40
0000008b: MLOAD
0000008c: DUP1
0000008d: SWAP2
0000008e: SUB
0000008f: SWAP1
00000090: RETURN
00000091: JUMPDEST
00000092: CALLVALUE
00000093: DUP1
00000094: ISZERO
00000095: PUSH2 0x009d
00000098: JUMPI
00000099: PUSH1 0x00
0000009b: DUP1
0000009c: REVERT
0000009d: JUMPDEST
0000009e: POP
0000009f: PUSH2 0x00b8
000000a2: PUSH1 0x04
000000a4: DUP1
000000a5: CALLDATASIZE
000000a6: SUB
000000a7: DUP2
000000a8: ADD
000000a9: SWAP1
000000aa: PUSH2 0x00b3
000000ad: SWAP2
000000ae: SWAP1
000000af: PUSH2 0x05b0
000000b2: JUMP
000000b3: JUMPDEST
000000b4: PUSH2 0x0120
000000b7: JUMP
000000b8: JUMPDEST
000000b9: STOP
000000ba: JUMPDEST
000000bb: CALLVALUE
000000bc: DUP1
000000bd: ISZERO
000000be: PUSH2 0x00c6
000000c1: JUMPI
000000c2: PUSH1 0x00
000000c4: DUP1
000000c5: REVERT
000000c6: JUMPDEST
000000c7: POP
000000c8: PUSH2 0x00e1
000000cb: PUSH1 0x04
000000cd: DUP1
000000ce: CALLDATASIZE
000000cf: SUB
000000d0: DUP2
000000d1: ADD
000000d2: SWAP1
000000d3: PUSH2 0x00dc
000000d6: SWAP2
000000d7: SWAP1
000000d8: PUSH2 0x0603
000000db: JUMP
000000dc: JUMPDEST
000000dd: PUSH2 0x0314
000000e0: JUMP
000000e1: JUMPDEST
000000e2: STOP
000000e3: JUMPDEST
000000e4: PUSH2 0x00eb
000000e7: PUSH2 0x039a
000000ea: JUMP
000000eb: JUMPDEST
000000ec: PUSH2 0x00f5
000000ef: PUSH1 0x00
000000f1: PUSH2 0x0421
000000f4: JUMP
000000f5: JUMPDEST
000000f6: JUMP
000000f7: JUMPDEST
000000f8: PUSH1 0x00
000000fa: DUP1
000000fb: PUSH1 0x00
000000fd: SWAP1
000000fe: SLOAD
000000ff: SWAP1
00000100: PUSH2 0x0100
00000103: EXP
00000104: SWAP1
00000105: DIV
00000106: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000011b: AND
0000011c: SWAP1
0000011d: POP
0000011e: SWAP1
0000011f: JUMP
00000120: JUMPDEST
00000121: PUSH2 0x0128
00000124: PUSH2 0x039a
00000127: JUMP
00000128: JUMPDEST
00000129: DUP1
0000012a: SELFBALANCE
0000012b: LT
0000012c: ISZERO
0000012d: PUSH2 0x016b
00000130: JUMPI
00000131: PUSH1 0x40
00000133: MLOAD
00000134: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000155: DUP2
00000156: MSTORE
00000157: PUSH1 0x04
00000159: ADD
0000015a: PUSH2 0x0162
0000015d: SWAP1
0000015e: PUSH2 0x068d
00000161: JUMP
00000162: JUMPDEST
00000163: PUSH1 0x40
00000165: MLOAD
00000166: DUP1
00000167: SWAP2
00000168: SUB
00000169: SWAP1
0000016a: REVERT
0000016b: JUMPDEST
0000016c: PUSH1 0x00
0000016e: DUP3
0000016f: GT
00000170: DUP1
00000171: ISZERO
00000172: PUSH2 0x017c
00000175: JUMPI
00000176: POP
00000177: PUSH1 0x64
00000179: DUP3
0000017a: GT
0000017b: ISZERO
0000017c: JUMPDEST
0000017d: PUSH2 0x01bb
00000180: JUMPI
00000181: PUSH1 0x40
00000183: MLOAD
00000184: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
000001a5: DUP2
000001a6: MSTORE
000001a7: PUSH1 0x04
000001a9: ADD
000001aa: PUSH2 0x01b2
000001ad: SWAP1
000001ae: PUSH2 0x06f9
000001b1: JUMP
000001b2: JUMPDEST
000001b3: PUSH1 0x40
000001b5: MLOAD
000001b6: DUP1
000001b7: SWAP2
000001b8: SUB
000001b9: SWAP1
000001ba: REVERT
000001bb: JUMPDEST
000001bc: PUSH1 0x00
000001be: DUP2
000001bf: GT
000001c0: PUSH2 0x01fe
000001c3: JUMPI
000001c4: PUSH1 0x40
000001c6: MLOAD
000001c7: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
000001e8: DUP2
000001e9: MSTORE
000001ea: PUSH1 0x04
000001ec: ADD
000001ed: PUSH2 0x01f5
000001f0: SWAP1
000001f1: PUSH2 0x0765
000001f4: JUMP
000001f5: JUMPDEST
000001f6: PUSH1 0x40
000001f8: MLOAD
000001f9: DUP1
000001fa: SWAP2
000001fb: SUB
000001fc: SWAP1
000001fd: REVERT
000001fe: JUMPDEST
000001ff: PUSH1 0x00
00000201: PUSH1 0x64
00000203: DUP4
00000204: DUP4
00000205: PUSH2 0x020e
00000208: SWAP2
00000209: SWAP1
0000020a: PUSH2 0x07b4
0000020d: JUMP
0000020e: JUMPDEST
0000020f: PUSH2 0x0218
00000212: SWAP2
00000213: SWAP1
00000214: PUSH2 0x0825
00000217: JUMP
00000218: JUMPDEST
00000219: SWAP1
0000021a: POP
0000021b: PUSH1 0x00
0000021d: DUP2
0000021e: DUP4
0000021f: PUSH2 0x0228
00000222: SWAP2
00000223: SWAP1
00000224: PUSH2 0x0856
00000227: JUMP
00000228: JUMPDEST
00000229: SWAP1
0000022a: POP
0000022b: DUP1
0000022c: SELFBALANCE
0000022d: LT
0000022e: ISZERO
0000022f: PUSH2 0x026d
00000232: JUMPI
00000233: PUSH1 0x40
00000235: MLOAD
00000236: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000
00000257: DUP2
00000258: MSTORE
00000259: PUSH1 0x04
0000025b: ADD
0000025c: PUSH2 0x0264
0000025f: SWAP1
00000260: PUSH2 0x08d6
00000263: JUMP
00000264: JUMPDEST
00000265: PUSH1 0x40
00000267: MLOAD
00000268: DUP1
00000269: SWAP2
0000026a: SUB
0000026b: SWAP1
0000026c: REVERT
0000026d: JUMPDEST
0000026e: DUP5
0000026f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000284: AND
00000285: PUSH2 0x08fc
00000288: DUP4
00000289: SWAP1
0000028a: DUP2
0000028b: ISZERO
0000028c: MUL
0000028d: SWAP1
0000028e: PUSH1 0x40
00000290: MLOAD
00000291: PUSH1 0x00
00000293: PUSH1 0x40
00000295: MLOAD
00000296: DUP1
00000297: DUP4
00000298: SUB
00000299: DUP2
0000029a: DUP6
0000029b: DUP9
0000029c: DUP9
0000029d: CALL
0000029e: SWAP4
0000029f: POP
000002a0: POP
000002a1: POP
000002a2: POP
000002a3: ISZERO
000002a4: DUP1
000002a5: ISZERO
000002a6: PUSH2 0x02b3
000002a9: JUMPI
000002aa: RETURNDATASIZE
000002ab: PUSH1 0x00
000002ad: DUP1
000002ae: RETURNDATACOPY
000002af: RETURNDATASIZE
000002b0: PUSH1 0x00
000002b2: REVERT
000002b3: JUMPDEST
000002b4: POP
000002b5: PUSH18 0x6bbe73c2c7878dc9dc19e0d947e4c4270000
000002c8: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000002dd: AND
000002de: PUSH2 0x08fc
000002e1: DUP3
000002e2: SWAP1
000002e3: DUP2
000002e4: ISZERO
000002e5: MUL
000002e6: SWAP1
000002e7: PUSH1 0x40
000002e9: MLOAD
000002ea: PUSH1 0x00
000002ec: PUSH1 0x40
000002ee: MLOAD
000002ef: DUP1
000002f0: DUP4
000002f1: SUB
000002f2: DUP2
000002f3: DUP6
000002f4: DUP9
000002f5: DUP9
000002f6: CALL
000002f7: SWAP4
000002f8: POP
000002f9: POP
000002fa: POP
000002fb: POP
000002fc: ISZERO
000002fd: DUP1
000002fe: ISZERO
000002ff: PUSH2 0x030c
00000302: JUMPI
00000303: RETURNDATASIZE
00000304: PUSH1 0x00
00000306: DUP1
00000307: RETURNDATACOPY
00000308: RETURNDATASIZE
00000309: PUSH1 0x00
0000030b: REVERT
0000030c: JUMPDEST
0000030d: POP
0000030e: POP
0000030f: POP
00000310: POP
00000311: POP
00000312: POP
00000313: JUMP
00000314: JUMPDEST
00000315: PUSH2 0x031c
00000318: PUSH2 0x039a
0000031b: JUMP
0000031c: JUMPDEST
0000031d: PUSH1 0x00
0000031f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000334: AND
00000335: DUP2
00000336: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000034b: AND
0000034c: SUB
0000034d: PUSH2 0x038e
00000350: JUMPI
00000351: PUSH1 0x00
00000353: PUSH1 0x40
00000355: MLOAD
00000356: PUSH32 0x1e4fbdf700000000000000000000000000000000000000000000000000000000
00000377: DUP2
00000378: MSTORE
00000379: PUSH1 0x04
0000037b: ADD
0000037c: PUSH2 0x0385
0000037f: SWAP2
00000380: SWAP1
00000381: PUSH2 0x052e
00000384: JUMP
00000385: JUMPDEST
00000386: PUSH1 0x40
00000388: MLOAD
00000389: DUP1
0000038a: SWAP2
0000038b: SUB
0000038c: SWAP1
0000038d: REVERT
0000038e: JUMPDEST
0000038f: PUSH2 0x0397
00000392: DUP2
00000393: PUSH2 0x0421
00000396: JUMP
00000397: JUMPDEST
00000398: POP
00000399: JUMP
0000039a: JUMPDEST
0000039b: PUSH2 0x03a2
0000039e: PUSH2 0x04e5
000003a1: JUMP
000003a2: JUMPDEST
000003a3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003b8: AND
000003b9: PUSH2 0x03c0
000003bc: PUSH2 0x00f7
000003bf: JUMP
000003c0: JUMPDEST
000003c1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000003d6: AND
000003d7: EQ
000003d8: PUSH2 0x041f
000003db: JUMPI
000003dc: PUSH2 0x03e3
000003df: PUSH2 0x04e5
000003e2: JUMP
000003e3: JUMPDEST
000003e4: PUSH1 0x40
000003e6: MLOAD
000003e7: PUSH32 0x118cdaa700000000000000000000000000000000000000000000000000000000
00000408: DUP2
00000409: MSTORE
0000040a: PUSH1 0x04
0000040c: ADD
0000040d: PUSH2 0x0416
00000410: SWAP2
00000411: SWAP1
00000412: PUSH2 0x052e
00000415: JUMP
00000416: JUMPDEST
00000417: PUSH1 0x40
00000419: MLOAD
0000041a: DUP1
0000041b: SWAP2
0000041c: SUB
0000041d: SWAP1
0000041e: REVERT
0000041f: JUMPDEST
00000420: JUMP
00000421: JUMPDEST
00000422: PUSH1 0x00
00000424: DUP1
00000425: PUSH1 0x00
00000427: SWAP1
00000428: SLOAD
00000429: SWAP1
0000042a: PUSH2 0x0100
0000042d: EXP
0000042e: SWAP1
0000042f: DIV
00000430: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000445: AND
00000446: SWAP1
00000447: POP
00000448: DUP2
00000449: PUSH1 0x00
0000044b: DUP1
0000044c: PUSH2 0x0100
0000044f: EXP
00000450: DUP2
00000451: SLOAD
00000452: DUP2
00000453: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000468: MUL
00000469: NOT
0000046a: AND
0000046b: SWAP1
0000046c: DUP4
0000046d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000482: AND
00000483: MUL
00000484: OR
00000485: SWAP1
00000486: SSTORE
00000487: POP
00000488: DUP2
00000489: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000049e: AND
0000049f: DUP2
000004a0: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000004b5: AND
000004b6: PUSH32 0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0
000004d7: PUSH1 0x40
000004d9: MLOAD
000004da: PUSH1 0x40
000004dc: MLOAD
000004dd: DUP1
000004de: SWAP2
000004df: SUB
000004e0: SWAP1
000004e1: LOG3
000004e2: POP
000004e3: POP
000004e4: JUMP
000004e5: JUMPDEST
000004e6: PUSH1 0x00
000004e8: CALLER
000004e9: SWAP1
000004ea: POP
000004eb: SWAP1
000004ec: JUMP
000004ed: JUMPDEST
000004ee: PUSH1 0x00
000004f0: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000505: DUP3
00000506: AND
00000507: SWAP1
00000508: POP
00000509: SWAP2
0000050a: SWAP1
0000050b: POP
0000050c: JUMP
0000050d: JUMPDEST
0000050e: PUSH1 0x00
00000510: PUSH2 0x0518
00000513: DUP3
00000514: PUSH2 0x04ed
00000517: JUMP
00000518: JUMPDEST
00000519: SWAP1
0000051a: POP
0000051b: SWAP2
0000051c: SWAP1
0000051d: POP
0000051e: JUMP
0000051f: JUMPDEST
00000520: PUSH2 0x0528
00000523: DUP2
00000524: PUSH2 0x050d
00000527: JUMP
00000528: JUMPDEST
00000529: DUP3
0000052a: MSTORE
0000052b: POP
0000052c: POP
0000052d: JUMP
0000052e: JUMPDEST
0000052f: PUSH1 0x00
00000531: PUSH1 0x20
00000533: DUP3
00000534: ADD
00000535: SWAP1
00000536: POP
00000537: PUSH2 0x0543
0000053a: PUSH1 0x00
0000053c: DUP4
0000053d: ADD
0000053e: DUP5
0000053f: PUSH2 0x051f
00000542: JUMP
00000543: JUMPDEST
00000544: SWAP3
00000545: SWAP2
00000546: POP
00000547: POP
00000548: JUMP
00000549: JUMPDEST
0000054a: PUSH1 0x00
0000054c: DUP1
0000054d: REVERT
0000054e: JUMPDEST
0000054f: PUSH2 0x0557
00000552: DUP2
00000553: PUSH2 0x050d
00000556: JUMP
00000557: JUMPDEST
00000558: DUP2
00000559: EQ
0000055a: PUSH2 0x0562
0000055d: JUMPI
0000055e: PUSH1 0x00
00000560: DUP1
00000561: REVERT
00000562: JUMPDEST
00000563: POP
00000564: JUMP
00000565: JUMPDEST
00000566: PUSH1 0x00
00000568: DUP2
00000569: CALLDATALOAD
0000056a: SWAP1
0000056b: POP
0000056c: PUSH2 0x0574
0000056f: DUP2
00000570: PUSH2 0x054e
00000573: JUMP
00000574: JUMPDEST
00000575: SWAP3
00000576: SWAP2
00000577: POP
00000578: POP
00000579: JUMP
0000057a: JUMPDEST
0000057b: PUSH1 0x00
0000057d: DUP2
0000057e: SWAP1
0000057f: POP
00000580: SWAP2
00000581: SWAP1
00000582: POP
00000583: JUMP
00000584: JUMPDEST
00000585: PUSH2 0x058d
00000588: DUP2
00000589: PUSH2 0x057a
0000058c: JUMP
0000058d: JUMPDEST
0000058e: DUP2
0000058f: EQ
00000590: PUSH2 0x0598
00000593: JUMPI
00000594: PUSH1 0x00
00000596: DUP1
00000597: REVERT
00000598: JUMPDEST
00000599: POP
0000059a: JUMP
0000059b: JUMPDEST
0000059c: PUSH1 0x00
0000059e: DUP2
0000059f: CALLDATALOAD
000005a0: SWAP1
000005a1: POP
000005a2: PUSH2 0x05aa
000005a5: DUP2
000005a6: PUSH2 0x0584
000005a9: JUMP
000005aa: JUMPDEST
000005ab: SWAP3
000005ac: SWAP2
000005ad: POP
000005ae: POP
000005af: JUMP
000005b0: JUMPDEST
000005b1: PUSH1 0x00
000005b3: DUP1
000005b4: PUSH1 0x00
000005b6: PUSH1 0x60
000005b8: DUP5
000005b9: DUP7
000005ba: SUB
000005bb: SLT
000005bc: ISZERO
000005bd: PUSH2 0x05c9
000005c0: JUMPI
000005c1: PUSH2 0x05c8
000005c4: PUSH2 0x0549
000005c7: JUMP
000005c8: JUMPDEST
000005c9: JUMPDEST
000005ca: PUSH1 0x00
000005cc: PUSH2 0x05d7
000005cf: DUP7
000005d0: DUP3
000005d1: DUP8
000005d2: ADD
000005d3: PUSH2 0x0565
000005d6: JUMP
000005d7: JUMPDEST
000005d8: SWAP4
000005d9: POP
000005da: POP
000005db: PUSH1 0x20
000005dd: PUSH2 0x05e8
000005e0: DUP7
000005e1: DUP3
000005e2: DUP8
000005e3: ADD
000005e4: PUSH2 0x059b
000005e7: JUMP
000005e8: JUMPDEST
000005e9: SWAP3
000005ea: POP
000005eb: POP
000005ec: PUSH1 0x40
000005ee: PUSH2 0x05f9
000005f1: DUP7
000005f2: DUP3
000005f3: DUP8
000005f4: ADD
000005f5: PUSH2 0x059b
000005f8: JUMP
000005f9: JUMPDEST
000005fa: SWAP2
000005fb: POP
000005fc: POP
000005fd: SWAP3
000005fe: POP
000005ff: SWAP3
00000600: POP
00000601: SWAP3
00000602: JUMP
00000603: JUMPDEST
00000604: PUSH1 0x00
00000606: PUSH1 0x20
00000608: DUP3
00000609: DUP5
0000060a: SUB
0000060b: SLT
0000060c: ISZERO
0000060d: PUSH2 0x0619
00000610: JUMPI
00000611: PUSH2 0x0618
00000614: PUSH2 0x0549
00000617: JUMP
00000618: JUMPDEST
00000619: JUMPDEST
0000061a: PUSH1 0x00
0000061c: PUSH2 0x0627
0000061f: DUP5
00000620: DUP3
00000621: DUP6
00000622: ADD
00000623: PUSH2 0x0565
00000626: JUMP
00000627: JUMPDEST
00000628: SWAP2
00000629: POP
0000062a: POP
0000062b: SWAP3
0000062c: SWAP2
0000062d: POP
0000062e: POP
0000062f: JUMP
00000630: JUMPDEST
00000631: PUSH1 0x00
00000633: DUP3
00000634: DUP3
00000635: MSTORE
00000636: PUSH1 0x20
00000638: DUP3
00000639: ADD
0000063a: SWAP1
0000063b: POP
0000063c: SWAP3
0000063d: SWAP2
0000063e: POP
0000063f: POP
00000640: JUMP
00000641: JUMPDEST
00000642: PUSH32 0x496e73756666696369656e742062616c616e6365000000000000000000000000
00000663: PUSH1 0x00
00000665: DUP3
00000666: ADD
00000667: MSTORE
00000668: POP
00000669: JUMP
0000066a: JUMPDEST
0000066b: PUSH1 0x00
0000066d: PUSH2 0x0677
00000670: PUSH1 0x14
00000672: DUP4
00000673: PUSH2 0x0630
00000676: JUMP
00000677: JUMPDEST
00000678: SWAP2
00000679: POP
0000067a: PUSH2 0x0682
0000067d: DUP3
0000067e: PUSH2 0x0641
00000681: JUMP
00000682: JUMPDEST
00000683: PUSH1 0x20
00000685: DUP3
00000686: ADD
00000687: SWAP1
00000688: POP
00000689: SWAP2
0000068a: SWAP1
0000068b: POP
0000068c: JUMP
0000068d: JUMPDEST
0000068e: PUSH1 0x00
00000690: PUSH1 0x20
00000692: DUP3
00000693: ADD
00000694: SWAP1
00000695: POP
00000696: DUP2
00000697: DUP2
00000698: SUB
00000699: PUSH1 0x00
0000069b: DUP4
0000069c: ADD
0000069d: MSTORE
0000069e: PUSH2 0x06a6
000006a1: DUP2
000006a2: PUSH2 0x066a
000006a5: JUMP
000006a6: JUMPDEST
000006a7: SWAP1
000006a8: POP
000006a9: SWAP2
000006aa: SWAP1
000006ab: POP
000006ac: JUMP
000006ad: JUMPDEST
000006ae: PUSH32 0x496e76616c69642070657263656e746167650000000000000000000000000000
000006cf: PUSH1 0x00
000006d1: DUP3
000006d2: ADD
000006d3: MSTORE
000006d4: POP
000006d5: JUMP
000006d6: JUMPDEST
000006d7: PUSH1 0x00
000006d9: PUSH2 0x06e3
000006dc: PUSH1 0x12
000006de: DUP4
000006df: PUSH2 0x0630
000006e2: JUMP
000006e3: JUMPDEST
000006e4: SWAP2
000006e5: POP
000006e6: PUSH2 0x06ee
000006e9: DUP3
000006ea: PUSH2 0x06ad
000006ed: JUMP
000006ee: JUMPDEST
000006ef: PUSH1 0x20
000006f1: DUP3
000006f2: ADD
000006f3: SWAP1
000006f4: POP
000006f5: SWAP2
000006f6: SWAP1
000006f7: POP
000006f8: JUMP
000006f9: JUMPDEST
000006fa: PUSH1 0x00
000006fc: PUSH1 0x20
000006fe: DUP3
000006ff: ADD
00000700: SWAP1
00000701: POP
00000702: DUP2
00000703: DUP2
00000704: SUB
00000705: PUSH1 0x00
00000707: DUP4
00000708: ADD
00000709: MSTORE
0000070a: PUSH2 0x0712
0000070d: DUP2
0000070e: PUSH2 0x06d6
00000711: JUMP
00000712: JUMPDEST
00000713: SWAP1
00000714: POP
00000715: SWAP2
00000716: SWAP1
00000717: POP
00000718: JUMP
00000719: JUMPDEST
0000071a: PUSH32 0x496e76616c696420746f74616c20616d6f756e74000000000000000000000000
0000073b: PUSH1 0x00
0000073d: DUP3
0000073e: ADD
0000073f: MSTORE
00000740: POP
00000741: JUMP
00000742: JUMPDEST
00000743: PUSH1 0x00
00000745: PUSH2 0x074f
00000748: PUSH1 0x14
0000074a: DUP4
0000074b: PUSH2 0x0630
0000074e: JUMP
0000074f: JUMPDEST
00000750: SWAP2
00000751: POP
00000752: PUSH2 0x075a
00000755: DUP3
00000756: PUSH2 0x0719
00000759: JUMP
0000075a: JUMPDEST
0000075b: PUSH1 0x20
0000075d: DUP3
0000075e: ADD
0000075f: SWAP1
00000760: POP
00000761: SWAP2
00000762: SWAP1
00000763: POP
00000764: JUMP
00000765: JUMPDEST
00000766: PUSH1 0x00
00000768: PUSH1 0x20
0000076a: DUP3
0000076b: ADD
0000076c: SWAP1
0000076d: POP
0000076e: DUP2
0000076f: DUP2
00000770: SUB
00000771: PUSH1 0x00
00000773: DUP4
00000774: ADD
00000775: MSTORE
00000776: PUSH2 0x077e
00000779: DUP2
0000077a: PUSH2 0x0742
0000077d: JUMP
0000077e: JUMPDEST
0000077f: SWAP1
00000780: POP
00000781: SWAP2
00000782: SWAP1
00000783: POP
00000784: JUMP
00000785: JUMPDEST
00000786: PUSH32 0x4e487b7100000000000000000000000000000000000000000000000000000000
000007a7: PUSH1 0x00
000007a9: MSTORE
000007aa: PUSH1 0x11
000007ac: PUSH1 0x04
000007ae: MSTORE
000007af: PUSH1 0x24
000007b1: PUSH1 0x00
000007b3: REVERT
000007b4: JUMPDEST
000007b5: PUSH1 0x00
000007b7: PUSH2 0x07bf
000007ba: DUP3
000007bb: PUSH2 0x057a
000007be: JUMP
000007bf: JUMPDEST
000007c0: SWAP2
000007c1: POP
000007c2: PUSH2 0x07ca
000007c5: DUP4
000007c6: PUSH2 0x057a
000007c9: JUMP
000007ca: JUMPDEST
000007cb: SWAP3
000007cc: POP
000007cd: DUP3
000007ce: DUP3
000007cf: MUL
000007d0: PUSH2 0x07d8
000007d3: DUP2
000007d4: PUSH2 0x057a
000007d7: JUMP
000007d8: JUMPDEST
000007d9: SWAP2
000007da: POP
000007db: DUP3
000007dc: DUP3
000007dd: DIV
000007de: DUP5
000007df: EQ
000007e0: DUP4
000007e1: ISZERO
000007e2: OR
000007e3: PUSH2 0x07ef
000007e6: JUMPI
000007e7: PUSH2 0x07ee
000007ea: PUSH2 0x0785
000007ed: JUMP
000007ee: JUMPDEST
000007ef: JUMPDEST
000007f0: POP
000007f1: SWAP3
000007f2: SWAP2
000007f3: POP
000007f4: POP
000007f5: JUMP
000007f6: JUMPDEST
000007f7: PUSH32 0x4e487b7100000000000000000000000000000000000000000000000000000000
00000818: PUSH1 0x00
0000081a: MSTORE
0000081b: PUSH1 0x12
0000081d: PUSH1 0x04
0000081f: MSTORE
00000820: PUSH1 0x24
00000822: PUSH1 0x00
00000824: REVERT
00000825: JUMPDEST
00000826: PUSH1 0x00
00000828: PUSH2 0x0830
0000082b: DUP3
0000082c: PUSH2 0x057a
0000082f: JUMP
00000830: JUMPDEST
00000831: SWAP2
00000832: POP
00000833: PUSH2 0x083b
00000836: DUP4
00000837: PUSH2 0x057a
0000083a: JUMP
0000083b: JUMPDEST
0000083c: SWAP3
0000083d: POP
0000083e: DUP3
0000083f: PUSH2 0x084b
00000842: JUMPI
00000843: PUSH2 0x084a
00000846: PUSH2 0x07f6
00000849: JUMP
0000084a: JUMPDEST
0000084b: JUMPDEST
0000084c: DUP3
0000084d: DUP3
0000084e: DIV
0000084f: SWAP1
00000850: POP
00000851: SWAP3
00000852: SWAP2
00000853: POP
00000854: POP
00000855: JUMP
00000856: JUMPDEST
00000857: PUSH1 0x00
00000859: PUSH2 0x0861
0000085c: DUP3
0000085d: PUSH2 0x057a
00000860: JUMP
00000861: JUMPDEST
00000862: SWAP2
00000863: POP
00000864: PUSH2 0x086c
00000867: DUP4
00000868: PUSH2 0x057a
0000086b: JUMP
0000086c: JUMPDEST
0000086d: SWAP3
0000086e: POP
0000086f: DUP3
00000870: DUP3
00000871: SUB
00000872: SWAP1
00000873: POP
00000874: DUP2
00000875: DUP2
00000876: GT
00000877: ISZERO
00000878: PUSH2 0x0884
0000087b: JUMPI
0000087c: PUSH2 0x0883
0000087f: PUSH2 0x0785
00000882: JUMP
00000883: JUMPDEST
00000884: JUMPDEST
00000885: SWAP3
00000886: SWAP2
00000887: POP
00000888: POP
00000889: JUMP
0000088a: JUMPDEST
0000088b: PUSH32 0x496e73756666696369656e742062616c616e636520666f72206f776e65720000
000008ac: PUSH1 0x00
000008ae: DUP3
000008af: ADD
000008b0: MSTORE
000008b1: POP
000008b2: JUMP
000008b3: JUMPDEST
000008b4: PUSH1 0x00
000008b6: PUSH2 0x08c0
000008b9: PUSH1 0x1e
000008bb: DUP4
000008bc: PUSH2 0x0630
000008bf: JUMP
000008c0: JUMPDEST
000008c1: SWAP2
000008c2: POP
000008c3: PUSH2 0x08cb
000008c6: DUP3
000008c7: PUSH2 0x088a
000008ca: JUMP
000008cb: JUMPDEST
000008cc: PUSH1 0x20
000008ce: DUP3
000008cf: ADD
000008d0: SWAP1
000008d1: POP
000008d2: SWAP2
000008d3: SWAP1
000008d4: POP
000008d5: JUMP
000008d6: JUMPDEST
000008d7: PUSH1 0x00
000008d9: PUSH1 0x20
000008db: DUP3
000008dc: ADD
000008dd: SWAP1
000008de: POP
000008df: DUP2
000008e0: DUP2
000008e1: SUB
000008e2: PUSH1 0x00
000008e4: DUP4
000008e5: ADD
000008e6: MSTORE
000008e7: PUSH2 0x08ef
000008ea: DUP2
000008eb: PUSH2 0x08b3
000008ee: JUMP
000008ef: JUMPDEST
000008f0: SWAP1
000008f1: POP
000008f2: SWAP2
000008f3: SWAP1
000008f4: POP
000008f5: JUMP
000008f6: INVALID
000008f7: LOG2
000008f8: PUSH5 0x6970667358
000008fe: UNKNOWN(0x22)
000008ff: SLT
00000900: KECCAK256
00000901: SLOAD
00000902: UNKNOWN(0x0E)
00000903: UNKNOWN(0x2A)
00000904: PUSH11 0x468f783521727326c123a0
00000910: DUP12
00000911: DUP12
00000912: DUP15
00000913: UNKNOWN(0xA6)
00000914: BLOBBASEFEE
00000915: UNKNOWN(0x2A)
00000916: UNKNOWN(0x2E)
00000917: TLOAD
00000918: PUSH0
00000919: CALL
0000091a: OR
0000091b: GASPRICE
0000091c: PUSH10 0xee4ee98564736f6c6343
00000927: STOP
00000928: ADDMOD
00000929: AND
0000092a: STOP
0000092b: CALLER