019c0ea9-0846-7236-8cf2-88fd1bc70685
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 41788 | artifact.fetch | complete | 1 / 3 | 2 months ago |
| 41789 | proxy.resolve | complete | 1 / 3 | 2 months ago |
| 41790 | tool.cast_disasm | complete | 1 / 3 | 2 months ago |
| 41791 | analysis.bundle | complete | 1 / 3 | 2 months ago |
| 41792 | capability.graph | complete | 1 / 3 | 2 months ago |
| 41793 | detector.run | complete | 1 / 3 | 2 months ago |
| 41794 | validation.fork | complete | 1 / 3 | 2 months ago |
| 42329 | report.consolidate | complete | 1 / 6 | 2 months ago |
{
"status": "not_proxy"
}
No slither job recorded yet.
{"no_findings":false,"summary":"Bytecode-only review found potential tx.origin-based authorization and external CALLs with value; evidence is heuristic and selector/guard inference is uncertain.","findings":[{"severity":"medium","category":"access_control","title":"Authorization appears to rely on tx.origin","exploit_scenario":"If a privileged path gates access using tx.origin, an attacker can trick the authorized EOA into calling a malicious contract that then calls this contract, passing the tx.origin check and executing privileged actions.","recommendation":"Avoid tx.origin for authorization. Use msg.sender-based role/owner checks or signed approvals (e.g., EIP-712), and ensure any auth checks reference msg.sender only.","evidence":"Detector flagged tx.origin usage as a guard at pc 2366, but no sink mapping is available, so linkage to a privileged action is uncertain.","locations":["pc:0x93e"]},{"severity":"low","category":"other","title":"External CALLs with value and computed target; return handling unknown","exploit_scenario":"If any path allows the CALL target/value to be influenced by user input and state changes occur before the call, a malicious target could reenter or cause ETH to be sent unexpectedly. The dynamic trace suggests the target may be constant to this contract (lowering risk), but this is not guaranteed from bytecode alone.","recommendation":"Constrain call targets/values, add reentrancy guards around state-changing paths that precede CALLs, and explicitly check CALL return values where failures matter.","evidence":"Two CALL sites detected (pc 989 and pc 2223). Evidence shows potentially nonzero value transfers and computed targets; returndata checking is unknown. Validation trace classified the target as constant to the contract address (not definitive for all paths).","locations":["pc:0x3dd","pc:0x8af"]}]}
OpenAI Codex v0.77.0 (research preview)
--------
workdir: /tmp/codex-fd085bp4
model: gpt-5.2-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: high
reasoning summaries: auto
session id: 019c0f22-0068-7461-ad6b-ee5efe1ece20
--------
user
You are a security auditor. You ONLY have runtime bytecode + analysis artifacts.
You MUST read `BYTECODE_BUNDLE.json` before concluding; it contains the bytecode summary,
evidence bundle, callsites, storage slots, and detector findings.
Special cases when reasoning from bytecode (be explicit about uncertainty):
- Selector inference is best-effort; missing selectors are common.
- Fallback/receive paths may be the only entrypoints.
- CALL vs DELEGATECALL semantics differ; DELEGATECALL executes in caller storage.
- Proxy patterns (EIP-1967, minimal proxies, beacon) change which storage is authoritative.
- Storage slots are raw; mappings/arrays appear via keccak patterns, names are unknown.
- Guard detection is heuristic; absence of guards does NOT mean unguarded.
- Returndata checking is unknown unless explicitly shown in evidence.
- Precompiles (0x1..0x9) and common ERC20 transfer selectors may appear; do not over-claim.
Output MUST be valid JSON matching the provided schema.
- If you find nothing meaningful: set no_findings=true and findings=[].
- Otherwise: set no_findings=false and include findings with severity/category/title.
- Locations can be pc references like "pc:0x123" or selectors like "selector:0xa9059cbb".
Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation,
accounting/invariant breaks, dangerous delegatecall, and untrusted external calls.
Be conservative: if evidence is weak, mark severity low/medium and explain why.
mcp startup: no servers
exec
/bin/bash -lc ls in /tmp/codex-fd085bp4 succeeded in 6ms:
BYTECODE_BUNDLE.json
codex-output-schema.json
exec
/bin/bash -lc 'cat BYTECODE_BUNDLE.json' in /tmp/codex-fd085bp4 succeeded in 6ms:
{
"analysis_artifact": {
"address": "0x7553e4dd8c0fb7b2332316860279d476fc2fdff2",
"artifact_hash": "0xdebf7aaf4bef61da676327b5fd93210040a0bb91c0e5c0bf5afda0d5d550cdb7",
"artifact_json": {
"auth": {
"guards": [
{
"pc": 719,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1102,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1407,
"type": "msg_sender_eq_const",
exec
/bin/bash -lc 'cat codex-output-schema.json' in /tmp/codex-fd085bp4 succeeded in 5ms:
{"type": "object", "additionalProperties": false, "required": ["no_findings", "summary", "findings"], "properties": {"no_findings": {"type": "boolean"}, "summary": {"type": "string"}, "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["severity", "category", "title", "evidence", "locations", "exploit_scenario", "recommendation"], "properties": {"severity": {"type": "string", "enum": ["info", "low", "medium", "high", "critical"]}, "category": {"type": "string", "enum": ["access_control", "reentrancy", "math", "oracle", "upgradeability", "auth", "other"]}, "title": {"type": "string"}, "exploit_scenario": {"type": "string"}, "recommendation": {"type": "string"}, "evidence": {"type": "string"}, "locations": {"type": "array", "items": {"type": "string"}}}}}}}
exec
/bin/bash -lc 'rg -n "1967|proxy|beacon" BYTECODE_BUNDLE.json' in /tmp/codex-fd085bp4 succeeded in 9ms:
3578: "proxy": "0",
3583: "proxy_evidence": {
3584: "status": "not_proxy"
3588: "is_proxy": false,
exec
/bin/bash -lc "sed -n '3560,3605p' BYTECODE_BUNDLE.json" in /tmp/codex-fd085bp4 succeeded in 6ms:
"address": "0x7553e4dd8c0fb7b2332316860279d476fc2fdff2",
"block_number": null,
"chain_id": 1,
"child_links": [],
"created_at": "2026-01-30T11:28:04.000000Z",
"id": "019c0ea9-0846-7236-8cf2-88fd1bc70685",
"parent_links": [],
"status": "running",
"updated_at": "2026-01-30T11:29:34.000000Z"
},
"artifact": {
"codehash": "0xfe0f7484ba92e111c23849095b132fedb21ec3c943f9865595f25de867fc3120",
"compiler_json": {
"compiler_version": null,
"etherscan": {
"contract_name": null,
"implementation": null,
"license": "Unknown",
"proxy": "0",
"swarm_source": null
codex
{"no_findings":false,"summary":"Bytecode-only review found potential tx.origin-based authorization and external CALLs with value; evidence is heuristic and selector/guard inference is uncertain.","findings":[{"severity":"medium","category":"access_control","title":"Authorization appears to rely on tx.origin","exploit_scenario":"If a privileged path gates access using tx.origin, an attacker can trick the authorized EOA into calling a malicious contract that then calls this contract, passing the tx.origin check and executing privileged actions.","recommendation":"Avoid tx.origin for authorization. Use msg.sender-based role/owner checks or signed approvals (e.g., EIP-712), and ensure any auth checks reference msg.sender only.","evidence":"Detector flagged tx.origin usage as a guard at pc 2366, but no sink mapping is available, so linkage to a privileged action is uncertain.","locations":["pc:0x93e"]},{"severity":"low","category":"other","title":"External CALLs with value and computed target; return handling unknown","exploit_scenario":"If any path allows the CALL target/value to be influenced by user input and state changes occur before the call, a malicious target could reenter or cause ETH to be sent unexpectedly. The dynamic trace suggests the target may be constant to this contract (lowering risk), but this is not guaranteed from bytecode alone.","recommendation":"Constrain call targets/values, add reentrancy guards around state-changing paths that precede CALLs, and explicitly check CALL return values where failures matter.","evidence":"Two CALL sites detected (pc 989 and pc 2223). Evidence shows potentially nonzero value transfers and computed targets; returndata checking is unknown. Validation trace classified the target as constant to the contract address (not definitive for all paths).","locations":["pc:0x3dd","pc:0x8af"]}]}
tokens used
42,886
{
"codex": {
"ran_at": "2026-01-30T13:42:04.145201+00:00",
"returncode": 0
},
"project": {
"mode": "bytecode",
"bytecode_length": 4792,
"bytecode_truncated": false,
"capability_graph_present": true,
"analysis_artifact_present": true
},
"summary": "Bytecode-only review found potential tx.origin-based authorization and external CALLs with value; evidence is heuristic and selector/guard inference is uncertain.",
"raw_final": {
"summary": "Bytecode-only review found potential tx.origin-based authorization and external CALLs with value; evidence is heuristic and selector/guard inference is uncertain.",
"findings": [
{
"title": "Authorization appears to rely on tx.origin",
"category": "access_control",
"evidence": "Detector flagged tx.origin usage as a guard at pc 2366, but no sink mapping is available, so linkage to a privileged action is uncertain.",
"severity": "medium",
"locations": [
"pc:0x93e"
],
"recommendation": "Avoid tx.origin for authorization. Use msg.sender-based role/owner checks or signed approvals (e.g., EIP-712), and ensure any auth checks reference msg.sender only.",
"exploit_scenario": "If a privileged path gates access using tx.origin, an attacker can trick the authorized EOA into calling a malicious contract that then calls this contract, passing the tx.origin check and executing privileged actions."
},
{
"title": "External CALLs with value and computed target; return handling unknown",
"category": "other",
"evidence": "Two CALL sites detected (pc 989 and pc 2223). Evidence shows potentially nonzero value transfers and computed targets; returndata checking is unknown. Validation trace classified the target as constant to the contract address (not definitive for all paths).",
"severity": "low",
"locations": [
"pc:0x3dd",
"pc:0x8af"
],
"recommendation": "Constrain call targets/values, add reentrancy guards around state-changing paths that precede CALLs, and explicitly check CALL return values where failures matter.",
"exploit_scenario": "If any path allows the CALL target/value to be influenced by user input and state changes occur before the call, a malicious target could reenter or cause ETH to be sent unexpectedly. The dynamic trace suggests the target may be constant to this contract (lowering risk), but this is not guaranteed from bytecode alone."
}
],
"no_findings": false
},
"no_findings": false,
"schema_version": 1
}
00000000: PUSH1 0x60 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x0099 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH29 0x0100000000000000000000000000000000000000000000000000000000 0000002e: SWAP1 0000002f: DIV 00000030: PUSH4 0xffffffff 00000035: AND 00000036: DUP1 00000037: PUSH4 0x43d726d6 0000003c: EQ 0000003d: PUSH2 0x009e 00000040: JUMPI 00000041: DUP1 00000042: PUSH4 0x521eb273 00000047: EQ 00000048: PUSH2 0x00b3 0000004b: JUMPI 0000004c: DUP1 0000004d: PUSH4 0x8c52dc41 00000052: EQ 00000053: PUSH2 0x0108 00000056: JUMPI 00000057: DUP1 00000058: PUSH4 0x8da5cb5b 0000005d: EQ 0000005e: PUSH2 0x011d 00000061: JUMPI 00000062: DUP1 00000063: PUSH4 0xc19d93fb 00000068: EQ 00000069: PUSH2 0x0172 0000006c: JUMPI 0000006d: DUP1 0000006e: PUSH4 0xcb13cddb 00000073: EQ 00000074: PUSH2 0x01a9 00000077: JUMPI 00000078: DUP1 00000079: PUSH4 0xf2fde38b 0000007e: EQ 0000007f: PUSH2 0x01f6 00000082: JUMPI 00000083: DUP1 00000084: PUSH4 0xf340fa01 00000089: EQ 0000008a: PUSH2 0x022f 0000008d: JUMPI 0000008e: DUP1 0000008f: PUSH4 0xfa89401a 00000094: EQ 00000095: PUSH2 0x025d 00000098: JUMPI 00000099: JUMPDEST 0000009a: PUSH1 0x00 0000009c: DUP1 0000009d: REVERT 0000009e: JUMPDEST 0000009f: CALLVALUE 000000a0: ISZERO 000000a1: PUSH2 0x00a9 000000a4: JUMPI 000000a5: PUSH1 0x00 000000a7: DUP1 000000a8: REVERT 000000a9: JUMPDEST 000000aa: PUSH2 0x00b1 000000ad: PUSH2 0x0296 000000b0: JUMP 000000b1: JUMPDEST 000000b2: STOP 000000b3: JUMPDEST 000000b4: CALLVALUE 000000b5: ISZERO 000000b6: PUSH2 0x00be 000000b9: JUMPI 000000ba: PUSH1 0x00 000000bc: DUP1 000000bd: REVERT 000000be: JUMPDEST 000000bf: PUSH2 0x00c6 000000c2: PUSH2 0x03ef 000000c5: JUMP 000000c6: JUMPDEST 000000c7: PUSH1 0x40 000000c9: MLOAD 000000ca: DUP1 000000cb: DUP3 000000cc: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000e1: AND 000000e2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000f7: AND 000000f8: DUP2 000000f9: MSTORE 000000fa: PUSH1 0x20 000000fc: ADD 000000fd: SWAP2 000000fe: POP 000000ff: POP 00000100: PUSH1 0x40 00000102: MLOAD 00000103: DUP1 00000104: SWAP2 00000105: SUB 00000106: SWAP1 00000107: RETURN 00000108: JUMPDEST 00000109: CALLVALUE 0000010a: ISZERO 0000010b: PUSH2 0x0113 0000010e: JUMPI 0000010f: PUSH1 0x00 00000111: DUP1 00000112: REVERT 00000113: JUMPDEST 00000114: PUSH2 0x011b 00000117: PUSH2 0x0415 0000011a: JUMP 0000011b: JUMPDEST 0000011c: STOP 0000011d: JUMPDEST 0000011e: CALLVALUE 0000011f: ISZERO 00000120: PUSH2 0x0128 00000123: JUMPI 00000124: PUSH1 0x00 00000126: DUP1 00000127: REVERT 00000128: JUMPDEST 00000129: PUSH2 0x0130 0000012c: PUSH2 0x04f6 0000012f: JUMP 00000130: JUMPDEST 00000131: PUSH1 0x40 00000133: MLOAD 00000134: DUP1 00000135: DUP3 00000136: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000014b: AND 0000014c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000161: AND 00000162: DUP2 00000163: MSTORE 00000164: PUSH1 0x20 00000166: ADD 00000167: SWAP2 00000168: POP 00000169: POP 0000016a: PUSH1 0x40 0000016c: MLOAD 0000016d: DUP1 0000016e: SWAP2 0000016f: SUB 00000170: SWAP1 00000171: RETURN 00000172: JUMPDEST 00000173: CALLVALUE 00000174: ISZERO 00000175: PUSH2 0x017d 00000178: JUMPI 00000179: PUSH1 0x00 0000017b: DUP1 0000017c: REVERT 0000017d: JUMPDEST 0000017e: PUSH2 0x0185 00000181: PUSH2 0x051b 00000184: JUMP 00000185: JUMPDEST 00000186: PUSH1 0x40 00000188: MLOAD 00000189: DUP1 0000018a: DUP3 0000018b: PUSH1 0x02 0000018d: DUP2 0000018e: GT 0000018f: ISZERO 00000190: PUSH2 0x0195 00000193: JUMPI 00000194: INVALID 00000195: JUMPDEST 00000196: PUSH1 0xff 00000198: AND 00000199: DUP2 0000019a: MSTORE 0000019b: PUSH1 0x20 0000019d: ADD 0000019e: SWAP2 0000019f: POP 000001a0: POP 000001a1: PUSH1 0x40 000001a3: MLOAD 000001a4: DUP1 000001a5: SWAP2 000001a6: SUB 000001a7: SWAP1 000001a8: RETURN 000001a9: JUMPDEST 000001aa: CALLVALUE 000001ab: ISZERO 000001ac: PUSH2 0x01b4 000001af: JUMPI 000001b0: PUSH1 0x00 000001b2: DUP1 000001b3: REVERT 000001b4: JUMPDEST 000001b5: PUSH2 0x01e0 000001b8: PUSH1 0x04 000001ba: DUP1 000001bb: DUP1 000001bc: CALLDATALOAD 000001bd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001d2: AND 000001d3: SWAP1 000001d4: PUSH1 0x20 000001d6: ADD 000001d7: SWAP1 000001d8: SWAP2 000001d9: SWAP1 000001da: POP 000001db: POP 000001dc: PUSH2 0x052e 000001df: JUMP 000001e0: JUMPDEST 000001e1: PUSH1 0x40 000001e3: MLOAD 000001e4: DUP1 000001e5: DUP3 000001e6: DUP2 000001e7: MSTORE 000001e8: PUSH1 0x20 000001ea: ADD 000001eb: SWAP2 000001ec: POP 000001ed: POP 000001ee: PUSH1 0x40 000001f0: MLOAD 000001f1: DUP1 000001f2: SWAP2 000001f3: SUB 000001f4: SWAP1 000001f5: RETURN 000001f6: JUMPDEST 000001f7: CALLVALUE 000001f8: ISZERO 000001f9: PUSH2 0x0201 000001fc: JUMPI 000001fd: PUSH1 0x00 000001ff: DUP1 00000200: REVERT 00000201: JUMPDEST 00000202: PUSH2 0x022d 00000205: PUSH1 0x04 00000207: DUP1 00000208: DUP1 00000209: CALLDATALOAD 0000020a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000021f: AND 00000220: SWAP1 00000221: PUSH1 0x20 00000223: ADD 00000224: SWAP1 00000225: SWAP2 00000226: SWAP1 00000227: POP 00000228: POP 00000229: PUSH2 0x0546 0000022c: JUMP 0000022d: JUMPDEST 0000022e: STOP 0000022f: JUMPDEST 00000230: PUSH2 0x025b 00000233: PUSH1 0x04 00000235: DUP1 00000236: DUP1 00000237: CALLDATALOAD 00000238: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000024d: AND 0000024e: SWAP1 0000024f: PUSH1 0x20 00000251: ADD 00000252: SWAP1 00000253: SWAP2 00000254: SWAP1 00000255: POP 00000256: POP 00000257: PUSH2 0x069b 0000025a: JUMP 0000025b: JUMPDEST 0000025c: STOP 0000025d: JUMPDEST 0000025e: CALLVALUE 0000025f: ISZERO 00000260: PUSH2 0x0268 00000263: JUMPI 00000264: PUSH1 0x00 00000266: DUP1 00000267: REVERT 00000268: JUMPDEST 00000269: PUSH2 0x0294 0000026c: PUSH1 0x04 0000026e: DUP1 0000026f: DUP1 00000270: CALLDATALOAD 00000271: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000286: AND 00000287: SWAP1 00000288: PUSH1 0x20 0000028a: ADD 0000028b: SWAP1 0000028c: SWAP2 0000028d: SWAP1 0000028e: POP 0000028f: POP 00000290: PUSH2 0x07c2 00000293: JUMP 00000294: JUMPDEST 00000295: STOP 00000296: JUMPDEST 00000297: PUSH1 0x00 00000299: DUP1 0000029a: SWAP1 0000029b: SLOAD 0000029c: SWAP1 0000029d: PUSH2 0x0100 000002a0: EXP 000002a1: SWAP1 000002a2: DIV 000002a3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002b8: AND 000002b9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002ce: AND 000002cf: CALLER 000002d0: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002e5: AND 000002e6: EQ 000002e7: ISZERO 000002e8: ISZERO 000002e9: PUSH2 0x02f1 000002ec: JUMPI 000002ed: PUSH1 0x00 000002ef: DUP1 000002f0: REVERT 000002f1: JUMPDEST 000002f2: PUSH1 0x00 000002f4: PUSH1 0x02 000002f6: DUP2 000002f7: GT 000002f8: ISZERO 000002f9: PUSH2 0x02fe 000002fc: JUMPI 000002fd: INVALID 000002fe: JUMPDEST 000002ff: PUSH1 0x02 00000301: PUSH1 0x14 00000303: SWAP1 00000304: SLOAD 00000305: SWAP1 00000306: PUSH2 0x0100 00000309: EXP 0000030a: SWAP1 0000030b: DIV 0000030c: PUSH1 0xff 0000030e: AND 0000030f: PUSH1 0x02 00000311: DUP2 00000312: GT 00000313: ISZERO 00000314: PUSH2 0x0319 00000317: JUMPI 00000318: INVALID 00000319: JUMPDEST 0000031a: EQ 0000031b: ISZERO 0000031c: ISZERO 0000031d: PUSH2 0x0325 00000320: JUMPI 00000321: PUSH1 0x00 00000323: DUP1 00000324: REVERT 00000325: JUMPDEST 00000326: PUSH1 0x02 00000328: DUP1 00000329: PUSH1 0x14 0000032b: PUSH2 0x0100 0000032e: EXP 0000032f: DUP2 00000330: SLOAD 00000331: DUP2 00000332: PUSH1 0xff 00000334: MUL 00000335: NOT 00000336: AND 00000337: SWAP1 00000338: DUP4 00000339: PUSH1 0x02 0000033b: DUP2 0000033c: GT 0000033d: ISZERO 0000033e: PUSH2 0x0343 00000341: JUMPI 00000342: INVALID 00000343: JUMPDEST 00000344: MUL 00000345: OR 00000346: SWAP1 00000347: SSTORE 00000348: POP 00000349: PUSH32 0x1cdde67b72a90f19919ac732a437ac2f7a10fc128d28c2a6e525d89ce5cd9d3a 0000036a: PUSH1 0x40 0000036c: MLOAD 0000036d: PUSH1 0x40 0000036f: MLOAD 00000370: DUP1 00000371: SWAP2 00000372: SUB 00000373: SWAP1 00000374: LOG1 00000375: PUSH1 0x02 00000377: PUSH1 0x00 00000379: SWAP1 0000037a: SLOAD 0000037b: SWAP1 0000037c: PUSH2 0x0100 0000037f: EXP 00000380: SWAP1 00000381: DIV 00000382: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000397: AND 00000398: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003ad: AND 000003ae: PUSH2 0x08fc 000003b1: ADDRESS 000003b2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003c7: AND 000003c8: BALANCE 000003c9: SWAP1 000003ca: DUP2 000003cb: ISZERO 000003cc: MUL 000003cd: SWAP1 000003ce: PUSH1 0x40 000003d0: MLOAD 000003d1: PUSH1 0x00 000003d3: PUSH1 0x40 000003d5: MLOAD 000003d6: DUP1 000003d7: DUP4 000003d8: SUB 000003d9: DUP2 000003da: DUP6 000003db: DUP9 000003dc: DUP9 000003dd: CALL 000003de: SWAP4 000003df: POP 000003e0: POP 000003e1: POP 000003e2: POP 000003e3: ISZERO 000003e4: ISZERO 000003e5: PUSH2 0x03ed 000003e8: JUMPI 000003e9: PUSH1 0x00 000003eb: DUP1 000003ec: REVERT 000003ed: JUMPDEST 000003ee: JUMP 000003ef: JUMPDEST 000003f0: PUSH1 0x02 000003f2: PUSH1 0x00 000003f4: SWAP1 000003f5: SLOAD 000003f6: SWAP1 000003f7: PUSH2 0x0100 000003fa: EXP 000003fb: SWAP1 000003fc: DIV 000003fd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000412: AND 00000413: DUP2 00000414: JUMP 00000415: JUMPDEST 00000416: PUSH1 0x00 00000418: DUP1 00000419: SWAP1 0000041a: SLOAD 0000041b: SWAP1 0000041c: PUSH2 0x0100 0000041f: EXP 00000420: SWAP1 00000421: DIV 00000422: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000437: AND 00000438: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000044d: AND 0000044e: CALLER 0000044f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000464: AND 00000465: EQ 00000466: ISZERO 00000467: ISZERO 00000468: PUSH2 0x0470 0000046b: JUMPI 0000046c: PUSH1 0x00 0000046e: DUP1 0000046f: REVERT 00000470: JUMPDEST 00000471: PUSH1 0x00 00000473: PUSH1 0x02 00000475: DUP2 00000476: GT 00000477: ISZERO 00000478: PUSH2 0x047d 0000047b: JUMPI 0000047c: INVALID 0000047d: JUMPDEST 0000047e: PUSH1 0x02 00000480: PUSH1 0x14 00000482: SWAP1 00000483: SLOAD 00000484: SWAP1 00000485: PUSH2 0x0100 00000488: EXP 00000489: SWAP1 0000048a: DIV 0000048b: PUSH1 0xff 0000048d: AND 0000048e: PUSH1 0x02 00000490: DUP2 00000491: GT 00000492: ISZERO 00000493: PUSH2 0x0498 00000496: JUMPI 00000497: INVALID 00000498: JUMPDEST 00000499: EQ 0000049a: ISZERO 0000049b: ISZERO 0000049c: PUSH2 0x04a4 0000049f: JUMPI 000004a0: PUSH1 0x00 000004a2: DUP1 000004a3: REVERT 000004a4: JUMPDEST 000004a5: PUSH1 0x01 000004a7: PUSH1 0x02 000004a9: PUSH1 0x14 000004ab: PUSH2 0x0100 000004ae: EXP 000004af: DUP2 000004b0: SLOAD 000004b1: DUP2 000004b2: PUSH1 0xff 000004b4: MUL 000004b5: NOT 000004b6: AND 000004b7: SWAP1 000004b8: DUP4 000004b9: PUSH1 0x02 000004bb: DUP2 000004bc: GT 000004bd: ISZERO 000004be: PUSH2 0x04c3 000004c1: JUMPI 000004c2: INVALID 000004c3: JUMPDEST 000004c4: MUL 000004c5: OR 000004c6: SWAP1 000004c7: SSTORE 000004c8: POP 000004c9: PUSH32 0x599d8e5a83cffb867d051598c4d70e805d59802d8081c1c7d6dffc5b6aca2b89 000004ea: PUSH1 0x40 000004ec: MLOAD 000004ed: PUSH1 0x40 000004ef: MLOAD 000004f0: DUP1 000004f1: SWAP2 000004f2: SUB 000004f3: SWAP1 000004f4: LOG1 000004f5: JUMP 000004f6: JUMPDEST 000004f7: PUSH1 0x00 000004f9: DUP1 000004fa: SWAP1 000004fb: SLOAD 000004fc: SWAP1 000004fd: PUSH2 0x0100 00000500: EXP 00000501: SWAP1 00000502: DIV 00000503: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000518: AND 00000519: DUP2 0000051a: JUMP 0000051b: JUMPDEST 0000051c: PUSH1 0x02 0000051e: PUSH1 0x14 00000520: SWAP1 00000521: SLOAD 00000522: SWAP1 00000523: PUSH2 0x0100 00000526: EXP 00000527: SWAP1 00000528: DIV 00000529: PUSH1 0xff 0000052b: AND 0000052c: DUP2 0000052d: JUMP 0000052e: JUMPDEST 0000052f: PUSH1 0x01 00000531: PUSH1 0x20 00000533: MSTORE 00000534: DUP1 00000535: PUSH1 0x00 00000537: MSTORE 00000538: PUSH1 0x40 0000053a: PUSH1 0x00 0000053c: KECCAK256 0000053d: PUSH1 0x00 0000053f: SWAP2 00000540: POP 00000541: SWAP1 00000542: POP 00000543: SLOAD 00000544: DUP2 00000545: JUMP 00000546: JUMPDEST 00000547: PUSH1 0x00 00000549: DUP1 0000054a: SWAP1 0000054b: SLOAD 0000054c: SWAP1 0000054d: PUSH2 0x0100 00000550: EXP 00000551: SWAP1 00000552: DIV 00000553: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000568: AND 00000569: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000057e: AND 0000057f: CALLER 00000580: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000595: AND 00000596: EQ 00000597: ISZERO 00000598: ISZERO 00000599: PUSH2 0x05a1 0000059c: JUMPI 0000059d: PUSH1 0x00 0000059f: DUP1 000005a0: REVERT 000005a1: JUMPDEST 000005a2: PUSH1 0x00 000005a4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005b9: AND 000005ba: DUP2 000005bb: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005d0: AND 000005d1: EQ 000005d2: ISZERO 000005d3: ISZERO 000005d4: ISZERO 000005d5: PUSH2 0x05dd 000005d8: JUMPI 000005d9: PUSH1 0x00 000005db: DUP1 000005dc: REVERT 000005dd: JUMPDEST 000005de: DUP1 000005df: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005f4: AND 000005f5: PUSH1 0x00 000005f7: DUP1 000005f8: SWAP1 000005f9: SLOAD 000005fa: SWAP1 000005fb: PUSH2 0x0100 000005fe: EXP 000005ff: SWAP1 00000600: DIV 00000601: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000616: AND 00000617: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000062c: AND 0000062d: PUSH32 0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0 0000064e: PUSH1 0x40 00000650: MLOAD 00000651: PUSH1 0x40 00000653: MLOAD 00000654: DUP1 00000655: SWAP2 00000656: SUB 00000657: SWAP1 00000658: LOG3 00000659: DUP1 0000065a: PUSH1 0x00 0000065c: DUP1 0000065d: PUSH2 0x0100 00000660: EXP 00000661: DUP2 00000662: SLOAD 00000663: DUP2 00000664: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000679: MUL 0000067a: NOT 0000067b: AND 0000067c: SWAP1 0000067d: DUP4 0000067e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000693: AND 00000694: MUL 00000695: OR 00000696: SWAP1 00000697: SSTORE 00000698: POP 00000699: POP 0000069a: JUMP 0000069b: JUMPDEST 0000069c: PUSH1 0x00 0000069e: DUP1 0000069f: SWAP1 000006a0: SLOAD 000006a1: SWAP1 000006a2: PUSH2 0x0100 000006a5: EXP 000006a6: SWAP1 000006a7: DIV 000006a8: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006bd: AND 000006be: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006d3: AND 000006d4: CALLER 000006d5: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006ea: AND 000006eb: EQ 000006ec: ISZERO 000006ed: ISZERO 000006ee: PUSH2 0x06f6 000006f1: JUMPI 000006f2: PUSH1 0x00 000006f4: DUP1 000006f5: REVERT 000006f6: JUMPDEST 000006f7: PUSH1 0x00 000006f9: PUSH1 0x02 000006fb: DUP2 000006fc: GT 000006fd: ISZERO 000006fe: PUSH2 0x0703 00000701: JUMPI 00000702: INVALID 00000703: JUMPDEST 00000704: PUSH1 0x02 00000706: PUSH1 0x14 00000708: SWAP1 00000709: SLOAD 0000070a: SWAP1 0000070b: PUSH2 0x0100 0000070e: EXP 0000070f: SWAP1 00000710: DIV 00000711: PUSH1 0xff 00000713: AND 00000714: PUSH1 0x02 00000716: DUP2 00000717: GT 00000718: ISZERO 00000719: PUSH2 0x071e 0000071c: JUMPI 0000071d: INVALID 0000071e: JUMPDEST 0000071f: EQ 00000720: ISZERO 00000721: ISZERO 00000722: PUSH2 0x072a 00000725: JUMPI 00000726: PUSH1 0x00 00000728: DUP1 00000729: REVERT 0000072a: JUMPDEST 0000072b: PUSH2 0x077c 0000072e: CALLVALUE 0000072f: PUSH1 0x01 00000731: PUSH1 0x00 00000733: DUP5 00000734: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000749: AND 0000074a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000075f: AND 00000760: DUP2 00000761: MSTORE 00000762: PUSH1 0x20 00000764: ADD 00000765: SWAP1 00000766: DUP2 00000767: MSTORE 00000768: PUSH1 0x20 0000076a: ADD 0000076b: PUSH1 0x00 0000076d: KECCAK256 0000076e: SLOAD 0000076f: PUSH2 0x0911 00000772: SWAP1 00000773: SWAP2 00000774: SWAP1 00000775: PUSH4 0xffffffff 0000077a: AND 0000077b: JUMP 0000077c: JUMPDEST 0000077d: PUSH1 0x01 0000077f: PUSH1 0x00 00000781: DUP4 00000782: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000797: AND 00000798: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007ad: AND 000007ae: DUP2 000007af: MSTORE 000007b0: PUSH1 0x20 000007b2: ADD 000007b3: SWAP1 000007b4: DUP2 000007b5: MSTORE 000007b6: PUSH1 0x20 000007b8: ADD 000007b9: PUSH1 0x00 000007bb: KECCAK256 000007bc: DUP2 000007bd: SWAP1 000007be: SSTORE 000007bf: POP 000007c0: POP 000007c1: JUMP 000007c2: JUMPDEST 000007c3: PUSH1 0x00 000007c5: PUSH1 0x01 000007c7: PUSH1 0x02 000007c9: DUP2 000007ca: GT 000007cb: ISZERO 000007cc: PUSH2 0x07d1 000007cf: JUMPI 000007d0: INVALID 000007d1: JUMPDEST 000007d2: PUSH1 0x02 000007d4: PUSH1 0x14 000007d6: SWAP1 000007d7: SLOAD 000007d8: SWAP1 000007d9: PUSH2 0x0100 000007dc: EXP 000007dd: SWAP1 000007de: DIV 000007df: PUSH1 0xff 000007e1: AND 000007e2: PUSH1 0x02 000007e4: DUP2 000007e5: GT 000007e6: ISZERO 000007e7: PUSH2 0x07ec 000007ea: JUMPI 000007eb: INVALID 000007ec: JUMPDEST 000007ed: EQ 000007ee: ISZERO 000007ef: ISZERO 000007f0: PUSH2 0x07f8 000007f3: JUMPI 000007f4: PUSH1 0x00 000007f6: DUP1 000007f7: REVERT 000007f8: JUMPDEST 000007f9: PUSH1 0x01 000007fb: PUSH1 0x00 000007fd: DUP4 000007fe: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000813: AND 00000814: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000829: AND 0000082a: DUP2 0000082b: MSTORE 0000082c: PUSH1 0x20 0000082e: ADD 0000082f: SWAP1 00000830: DUP2 00000831: MSTORE 00000832: PUSH1 0x20 00000834: ADD 00000835: PUSH1 0x00 00000837: KECCAK256 00000838: SLOAD 00000839: SWAP1 0000083a: POP 0000083b: PUSH1 0x00 0000083d: PUSH1 0x01 0000083f: PUSH1 0x00 00000841: DUP5 00000842: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000857: AND 00000858: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000086d: AND 0000086e: DUP2 0000086f: MSTORE 00000870: PUSH1 0x20 00000872: ADD 00000873: SWAP1 00000874: DUP2 00000875: MSTORE 00000876: PUSH1 0x20 00000878: ADD 00000879: PUSH1 0x00 0000087b: KECCAK256 0000087c: DUP2 0000087d: SWAP1 0000087e: SSTORE 0000087f: POP 00000880: DUP2 00000881: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000896: AND 00000897: PUSH2 0x08fc 0000089a: DUP3 0000089b: SWAP1 0000089c: DUP2 0000089d: ISZERO 0000089e: MUL 0000089f: SWAP1 000008a0: PUSH1 0x40 000008a2: MLOAD 000008a3: PUSH1 0x00 000008a5: PUSH1 0x40 000008a7: MLOAD 000008a8: DUP1 000008a9: DUP4 000008aa: SUB 000008ab: DUP2 000008ac: DUP6 000008ad: DUP9 000008ae: DUP9 000008af: CALL 000008b0: SWAP4 000008b1: POP 000008b2: POP 000008b3: POP 000008b4: POP 000008b5: ISZERO 000008b6: ISZERO 000008b7: PUSH2 0x08bf 000008ba: JUMPI 000008bb: PUSH1 0x00 000008bd: DUP1 000008be: REVERT 000008bf: JUMPDEST 000008c0: DUP2 000008c1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008d6: AND 000008d7: PUSH32 0xd7dee2702d63ad89917b6a4da9981c90c4d24f8c2bdfd64c604ecae57d8d0651 000008f8: DUP3 000008f9: PUSH1 0x40 000008fb: MLOAD 000008fc: DUP1 000008fd: DUP3 000008fe: DUP2 000008ff: MSTORE 00000900: PUSH1 0x20 00000902: ADD 00000903: SWAP2 00000904: POP 00000905: POP 00000906: PUSH1 0x40 00000908: MLOAD 00000909: DUP1 0000090a: SWAP2 0000090b: SUB 0000090c: SWAP1 0000090d: LOG2 0000090e: POP 0000090f: POP 00000910: JUMP 00000911: JUMPDEST 00000912: PUSH1 0x00 00000914: DUP1 00000915: DUP3 00000916: DUP5 00000917: ADD 00000918: SWAP1 00000919: POP 0000091a: DUP4 0000091b: DUP2 0000091c: LT 0000091d: ISZERO 0000091e: ISZERO 0000091f: ISZERO 00000920: PUSH2 0x0925 00000923: JUMPI 00000924: INVALID 00000925: JUMPDEST 00000926: DUP1 00000927: SWAP2 00000928: POP 00000929: POP 0000092a: SWAP3 0000092b: SWAP2 0000092c: POP 0000092d: POP 0000092e: JUMP 0000092f: STOP 00000930: LOG1 00000931: PUSH6 0x627a7a723058 00000938: KECCAK256 00000939: MSTORE8 0000093a: UNKNOWN(0xA7) 0000093b: BALANCE 0000093c: DUP14 0000093d: SWAP15 0000093e: ORIGIN 0000093f: PUSH12 0x855611999cc88be0b144062a 0000094c: UNKNOWN(0xD2) 0000094d: UNKNOWN(0xA9) 0000094e: PUSH31
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | auth | detector | Authorization based on tx.origin | 70 | no | — |
viewvalidation_json{
"reason": "missing sink mapping",
"status": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xffffffff",
"selector": "0xffffffff",
"calldata_variants": [
"0xffffffff",
"0xffffffff0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x43d726d6",
"selector": "0x43d726d6",
"calldata_variants": [
"0x43d726d6",
"0x43d726d60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x521eb273",
"selector": "0x521eb273",
"calldata_variants": [
"0x521eb273",
"0x521eb2730000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8c52dc41",
"selector": "0x8c52dc41",
"calldata_variants": [
"0x8c52dc41",
"0x8c52dc410000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc19d93fb",
"selector": "0xc19d93fb",
"calldata_variants": [
"0xc19d93fb",
"0xc19d93fb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xcb13cddb",
"selector": "0xcb13cddb",
"calldata_variants": [
"0xcb13cddb",
"0xcb13cddb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"guards_detected": [
{
"pc": 719,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1102,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1407,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1748,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 2366,
"type": "tx_origin_used"
}
]
}
|
| medium | access_control | codex | Authorization appears to rely on tx.origin | 75 | no | — |
viewevidence_json{
"evidence": "Detector flagged tx.origin usage as a guard at pc 2366, but no sink mapping is available, so linkage to a privileged action is uncertain.",
"locations": [
"pc:0x93e"
],
"recommendation": "Avoid tx.origin for authorization. Use msg.sender-based role/owner checks or signed approvals (e.g., EIP-712), and ensure any auth checks reference msg.sender only.",
"exploit_scenario": "If a privileged path gates access using tx.origin, an attacker can trick the authorized EOA into calling a malicious contract that then calls this contract, passing the tx.origin check and executing privileged actions."
}
|
| medium | other | detector | Untrusted CALL target/value reachable | 45 | no | no |
viewtrace_id: 0x57ebcef13a8a08cbd1a253635611c8b985c16085e2409d61c965204452340b2b
call_targets:
0x7553e4dd8c0fb7b2332316860279d476fc2fdff2
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x57ebcef13a8a08cbd1a253635611c8b985c16085e2409d61c965204452340b2b",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x7553e4dd8c0fb7b2332316860279d476fc2fdff2"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xffffffff",
"selector": "0xffffffff",
"calldata_variants": [
"0xffffffff",
"0xffffffff0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x43d726d6",
"selector": "0x43d726d6",
"calldata_variants": [
"0x43d726d6",
"0x43d726d60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x521eb273",
"selector": "0x521eb273",
"calldata_variants": [
"0x521eb273",
"0x521eb2730000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8c52dc41",
"selector": "0x8c52dc41",
"calldata_variants": [
"0x8c52dc41",
"0x8c52dc410000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc19d93fb",
"selector": "0xc19d93fb",
"calldata_variants": [
"0xc19d93fb",
"0xc19d93fb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xcb13cddb",
"selector": "0xcb13cddb",
"calldata_variants": [
"0xcb13cddb",
"0xcb13cddb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 989,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "constant",
"target_expression_category": "computed"
},
{
"pc": 2223,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 2,
"guards_detected": [
{
"pc": 719,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1102,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1407,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1748,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 2366,
"type": "tx_origin_used"
}
],
"untrusted_call_count": 2
}
|
| medium | other | detector | ETH value transfer possible | 40 | no | no |
viewtrace_id: 0x57ebcef13a8a08cbd1a253635611c8b985c16085e2409d61c965204452340b2b
call_targets:
0x7553e4dd8c0fb7b2332316860279d476fc2fdff2
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x57ebcef13a8a08cbd1a253635611c8b985c16085e2409d61c965204452340b2b",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x7553e4dd8c0fb7b2332316860279d476fc2fdff2"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xffffffff",
"selector": "0xffffffff",
"calldata_variants": [
"0xffffffff",
"0xffffffff0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x43d726d6",
"selector": "0x43d726d6",
"calldata_variants": [
"0x43d726d6",
"0x43d726d60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x521eb273",
"selector": "0x521eb273",
"calldata_variants": [
"0x521eb273",
"0x521eb2730000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8c52dc41",
"selector": "0x8c52dc41",
"calldata_variants": [
"0x8c52dc41",
"0x8c52dc410000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc19d93fb",
"selector": "0xc19d93fb",
"calldata_variants": [
"0xc19d93fb",
"0xc19d93fb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xcb13cddb",
"selector": "0xcb13cddb",
"calldata_variants": [
"0xcb13cddb",
"0xcb13cddb0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 989,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "constant",
"target_expression_category": "computed"
},
{
"pc": 2223,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 2,
"guards_detected": [
{
"pc": 719,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1102,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1407,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1748,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 2366,
"type": "tx_origin_used"
}
]
}
|
| low | other | codex | External CALLs with value and computed target; return handling unknown | 65 | no | — |
viewevidence_json{
"evidence": "Two CALL sites detected (pc 989 and pc 2223). Evidence shows potentially nonzero value transfers and computed targets; returndata checking is unknown. Validation trace classified the target as constant to the contract address (not definitive for all paths).",
"locations": [
"pc:0x3dd",
"pc:0x8af"
],
"recommendation": "Constrain call targets/values, add reentrancy guards around state-changing paths that precede CALLs, and explicitly check CALL return values where failures matter.",
"exploit_scenario": "If any path allows the CALL target/value to be influenced by user input and state changes occur before the call, a malicious target could reenter or cause ETH to be sent unexpectedly. The dynamic trace suggests the target may be constant to this contract (lowering risk), but this is not guaranteed from bytecode alone."
}
|