29027caf-72da-4190-933d-9b710f7d4b98
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 31220 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 95131 | artifact.fetch | complete | 1 / 3 | 1 week ago |
| 95132 | tool.cast_disasm | complete | 1 / 3 | 1 week ago |
| 95133 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 95134 | capability.graph | complete | 1 / 3 | 1 week ago |
| 95135 | detector.run | complete | 1 / 3 | 1 week ago |
| 95136 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
[codex:1519866] OpenAI Codex v0.77.0 (research preview)
[codex:1519866] --------
[codex:1519866] workdir: /tmp/codex-multi-4uplani4
[codex:1519866] model: gpt-5.2-codex
[codex:1519866] provider: openai
[codex:1519866] approval: never
[codex:1519866] sandbox: read-only
[codex:1519866] reasoning effort: xhigh
[codex:1519866] reasoning summaries: auto
[codex:1519866] session id: 019b7cfe-6ebf-7b72-8e92-849104d7c208
[codex:1519866] --------
[codex:1519866] user
[codex:1519866] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:1519866]
[codex:1519866] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:1519866]
[codex:1519866] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:1519866] - Gas inefficiency, code quality, or best practices
[codex:1519866] - Theoretical vulnerabilities without a clear extraction path
[codex:1519866] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:1519866] - Issues requiring social engineering or off-chain coordination
[codex:1519866]
[codex:1519866] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:1519866] - CALL/DELEGATECALL with controllable destination or calldata
[codex:1519866] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:1519866] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:1519866] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:1519866] - External calls before state updates (reentrancy)
[codex:1519866] - SELFDESTRUCT with controllable beneficiary
[codex:1519866] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:1519866]
[codex:1519866] For each finding, you MUST explain:
[codex:1519866] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:1519866] 2. The concrete sequence of transactions to extract value
[codex:1519866] 3. Why you believe this is exploitable (not just suspicious)
[codex:1519866]
[codex:1519866] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:1519866] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:1519866]
[codex:1519866] Output MUST be valid JSON matching the provided schema.
[codex:1519866] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:1519866] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:1519866] mcp startup: no servers
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Reading BYTECODE_BUNDLE.txt**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc ls in /tmp/codex-multi-4uplani4 succeeded in 6ms:
[codex:1519866] BYTECODE_BUNDLE.txt
[codex:1519866] codex-output-schema.json
[codex:1519866] exec
[codex:1519866] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-4uplani4 succeeded in 6ms:
[codex:1519866] Runtime bytecode bundle for best-effort auditing.
[codex:1519866] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:1519866]
[codex:1519866] FILE: runtime_bytecode.hex
[codex:1519866] 0x608060405260043610610168575f3560e01c80636fefbbc2116100ca578063c311d0491161007e578063eed2f25211610058578063eed2f25214610411578063f08a03231461043d578063fa461e331461045c5761016f565b8063c311d049146103b4578063d0ebdbe7146103d3578063d34628cc146103f25761016f565b80639e281a98116100af5780639e281a9814610338578063bdb25d0e14610357578063bfd79284146103765761016f565b80636fefbbc2146102fa5780637580a1bc146103195761016f565b806323a69e7511610121578063481c6a7511610106578063481c6a751461029057806351b9b0fa146102bc5780636c3bbfd7146102db5761016f565b806323a69e75146102525780632c8958f6146102715761016f565b80630b58f97d116101525780630b58f97d146101ba57806313af40351461020f5780631cfed8851461022e5761016f565b801561019157806307d47d971461019b5761016f565b3661016f57005b604051365f82375f5f36836002545af43d5f833e8061018c573d82fd5b503d81f35b61019961047b565b005b3480156101a6575f5ffd5b506101996101b536600461191f565b610578565b3480156101c5575f5ffd5b505f546101e59073ffffffffffffffffffffffffffffffffffffffff1681565b60405173ffffffffffffffffffffffffffffffffffffffff90911681526020015b60405180910390f35b34801561021a575f5ffd5b50610199610229366004611986565b61063d565b348015610239575f5ffd5b506101e56102483660046119b6565b63deadbeef015490565b34801561025d575f5ffd5b5061019961026c3660046119cf565b61070a565b34801561027c575f5ffd5b5061019961028b3660046119cf565b610760565b34801561029b575f5ffd5b506001546101e59073ffffffffffffffffffffffffffffffffffffffff1681565b3480156102c7575f5ffd5b506101996102d6366004611a5f565b61088b565b3480156102e6575f5ffd5b506101996102f5366004611abf565b610a22565b348015610305575f5ffd5b50610199610314366004611af2565b610b3d565b348015610324575f5ffd5b50610199610333366004611b09565b610c99565b348015610343575f5ffd5b50610199610352366004611b3a565b610d2b565b348015610362575f5ffd5b50610199610371366004611a5f565b610dd3565b348015610381575f5ffd5b506103a4610390366004611986565b60036020525f908152604090205460ff1681565b6040519015158152602001610206565b3480156103bf575f5ffd5b506101996103ce366004611af2565b610f55565b3480156103de575f5ffd5b506101996103ed366004611986565b610ffd565b3480156103fd575f5ffd5b5061019961040c366004611abf565b6110cb565b34801561041c575f5ffd5b506002546101e59073ffffffffffffffffffffffffffffffffffffffff1681565b348015610448575f5ffd5b50610199610457366004611986565b6111e2565b348015610467575f5ffd5b506101996104763660046119cf565b6112b0565b335f90815260036020908152604091829020548251808401909352600483527f4d303032000000000000000000000000000000000000000000000000000000009183019190915260ff16610505576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b60405180910390fd5b506040517ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc360160048237805160f81c63deadbeef01545f5f7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffb360160018501845af4610574573d5f833e3d82fd5b5050565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff1633146105fe576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b5061057482828080601f0160208091040260200160405190810160405280939291908181526020018383808284375f920191909152506113c692505050565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff1633146106c3576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f80547fffffffffffffffffffffffff00000000000000000000000000000000000000001673ffffffffffffffffffffffffffffffffffffffff92909216919091179055565b61075a848484847f6ce8eb472fa82df5469c6ab6d485f17c3ad13c8cd7af59b3d4a8026c5ce0f7e27f00000000000000000000000041ff9aa7e16b8b1a8a8dc4f0efacd93d02d071c96060611459565b50505050565b602b82013560f81c60028190036107c6576107c1858585857f00000000000000000000000000000000000000000000000000000000000000007f00000000000000000000000000000000000000000000000000000000000000006040611459565b610884565b8060ff16600503610821576107c1858585857f00000000000000000000000000000000000000000000000000000000000000007f00000000000000000000000000000000000000000000000000000000000000006040611459565b60408051808201825260048082527f4d30323200000000000000000000000000000000000000000000000000000000602083015291517f08c379a00000000000000000000000000000000000000000000000000000000081526104fc9201611b62565b5050505050565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314610911576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b5060408051808201909152600481527f4d303035000000000000000000000000000000000000000000000000000000006020820152838214610980576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f5b8381101561088457610a1a8383838181106109a0576109a0611bb5565b90506020020160208101906109b59190611986565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff8787858181106109e8576109e8611bb5565b90506020020160208101906109fd9190611986565b73ffffffffffffffffffffffffffffffffffffffff169190611671565b600101610983565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314610aa8576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f5b81811015610b38575f60035f858585818110610ac957610ac9611bb5565b9050602002016020810190610ade9190611986565b73ffffffffffffffffffffffffffffffffffffffff16815260208101919091526040015f2080547fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0016911515919091179055600101610aab565b505050565b60015460408051808201909152600481527f4d3030330000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314610bc4576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f805460405173ffffffffffffffffffffffffffffffffffffffff9091169083905b5f6040518083038185875af1925050503d805f8114610c21576040519150601f19603f3d011682016040523d82523d5f602084013e610c26565b606091505b50509050806040518060400160405280600481526020017f4d3030340000000000000000000000000000000000000000000000000000000081525090610b38576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314610d1f576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b5063deadbeef90910155565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314610db1576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b5061057473ffffffffffffffffffffffffffffffffffffffff8316338361178b565b60015460408051808201909152600481527f4d3030330000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314610e5a576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b5060408051808201909152600481527f4d303035000000000000000000000000000000000000000000000000000000006020820152838214610ec9576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f5b83811015610884575f54610f4d9073ffffffffffffffffffffffffffffffffffffffff16848484818110610f0257610f02611bb5565b90506020020135878785818110610f1b57610f1b611bb5565b9050602002016020810190610f309190611986565b73ffffffffffffffffffffffffffffffffffffffff16919061178b565b600101610ecc565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314610fdb576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f3373ffffffffffffffffffffffffffffffffffffffff1682604051610be7565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314611083576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b50600180547fffffffffffffffffffffffff00000000000000000000000000000000000000001673ffffffffffffffffffffffffffffffffffffffff92909216919091179055565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314611151576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f5b81811015610b3857600160035f85858581811061117357611173611bb5565b90506020020160208101906111889190611986565b73ffffffffffffffffffffffffffffffffffffffff16815260208101919091526040015f2080547fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0016911515919091179055600101611154565b5f5460408051808201909152600481527f4d3030310000000000000000000000000000000000000000000000000000000060208201529073ffffffffffffffffffffffffffffffffffffffff163314611268576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b50600280547fffffffffffffffffffffffff00000000000000000000000000000000000000001673ffffffffffffffffffffffffffffffffffffffff92909216919091179055565b602b82013560f81c5f819003611310576107c1858585857fe34f199b19b2b4f47f68442619d555527d244f78a3297ea89325f843f87b8b547f0000000000000000000000001f98431c8ad98523631ae4a59f267346ea31f9846060611459565b8060ff1660030361136b576107c1858585857f00000000000000000000000000000000000000000000000000000000000000007f00000000000000000000000000000000000000000000000000000000000000006060611459565b8060ff16600403610821576107c1858585857f00000000000000000000000000000000000000000000000000000000000000007f00000000000000000000000000000000000000000000000000000000000000006060611459565b5f5b8151811015610574575f6113dc83836117c9565b90505f6113f6846113ee856014611be2565b016020015190565b90505f611408856113ee866034611be2565b90505f6114218661141a876054611be2565b0160200190565b90505f5f838386886113885a03f180611438575f5ffd5b50611444826054611be2565b61144e9086611be2565b9450505050506113c8565b6040518535606090811c91601488013590911c90602888013560e81c90602c89013560f81c905f908486106001811461149a578582528660208301526114a4565b8682528560208301525b50606087036114b4578360408201525b8681207fff000000000000000000000000000000000000000000000000000000000000008252606089901b60018301526015820152603581018990526055902060408051808201909152600481527f4d30313100000000000000000000000000000000000000000000000000000000602082015273ffffffffffffffffffffffffffffffffffffffff909116915033821461157c576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016104fc9190611b62565b505f5f8d1361158b578b61158d565b8c5b9050821561161a5763deadbeef602d8c013560f81c01546040517f39f85306000000000000000000000000000000000000000000000000000000008152602e8d0191907fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd28d01808460048401375f5f6004830184865af46116155760405193503d5f853e3d84fd5b505050505b6040517fa9059cbb0000000000000000000000000000000000000000000000000000000081528260048201528160248201525f5f6044835f8b5af1611661573d5f823e3d81fd5b5050505050505050505050505050565b6040805173ffffffffffffffffffffffffffffffffffffffff8416602482015260448082018490528251808303909101815260649091019091526020810180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff167f095ea7b3000000000000000000000000000000000000000000000000000000001790526116fd84826117e3565b61075a5760405173ffffffffffffffffffffffffffffffffffffffff84811660248301525f604483015261178191869182169063095ea7b3906064015b604051602081830303815290604052915060e01b6020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff838183161783525050505061183b565b61075a848261183b565b60405173ffffffffffffffffffffffffffffffffffffffff838116602483015260448201839052610b3891859182169063a9059cbb9060640161173a565b5f5f6117d88484016020015190565b60601c949350505050565b5f5f5f5f60205f8651602088015f8a5af192503d91505f51905082801561182f57508115611814578060011461182f565b5f8673ffffffffffffffffffffffffffffffffffffffff163b115b93505050505b92915050565b5f5f60205f8451602086015f885af18061185a576040513d5f823e3d81fd5b50505f513d9150811561187157806001141561188b565b73ffffffffffffffffffffffffffffffffffffffff84163b155b1561075a576040517f5274afe700000000000000000000000000000000000000000000000000000000815273ffffffffffffffffffffffffffffffffffffffff851660048201526024016104fc565b5f5f83601f8401126118ea575f5ffd5b50813567ffffffffffffffff811115611901575f5ffd5b602083019150836020828501011115611918575f5ffd5b9250929050565b5f5f60208385031215611930575f5ffd5b823567ffffffffffffffff811115611946575f5ffd5b611952858286016118da565b90969095509350505050565b803573ffffffffffffffffffffffffffffffffffffffff81168114611981575f5ffd5b919050565b5f60208284031215611996575f5ffd5b61199f8261195e565b9392505050565b803560ff81168114611981575f5ffd5b5f602082840312156119c6575f5ffd5b61199f826119a6565b5f5f5f5f606085870312156119e2575f5ffd5b8435935060208501359250604085013567ffffffffffffffff811115611a06575f5ffd5b611a12878288016118da565b95989497509550505050565b5f5f83601f840112611a2e575f5ffd5b50813567ffffffffffffffff811115611a45575f5ffd5b6020830191508360208260051b8501011115611918575f5ffd5b5f5f5f5f60408587031215611a72575f5ffd5b843567ffffffffffffffff811115611a88575f5ffd5b611a9487828801611a1e565b909550935050602085013567ffffffffffffffff811115611ab3575f5ffd5b611a1287828801611a1e565b5f5f60208385031215611ad0575f5ffd5b823567ffffffffffffffff811115611ae6575f5ffd5b61195285828601611a1e565b5f60208284031215611b02575f5ffd5b5035919050565b5f5f60408385031215611b1a575f5ffd5b611b23836119a6565b9150611b316020840161195e565b90509250929050565b5f5f60408385031215611b4b575f5ffd5b611b548361195e565b946020939093013593505050565b602081525f82518060208401528060208501604085015e5f6040828501015260407fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f83011684010191505092915050565b7f4e487b71000000000000000000000000000000000000000000000000000000005f52603260045260245ffd5b80820180821115611835577f4e487b71000000000000000000000000000000000000000000000000000000005f52601160045260245ffd
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing Ethereum bytecode for vulnerabilities**
[codex:1519866]
[codex:1519866] I'm carefully interpreting the contract bytecode to detect exploitable paths like unprotected delegatecalls or storage upgrades, focusing on how the fallback delegates calls to a slot2 address and scrutinizing functions that might change that slot without authorization. I'll map opcodes around key instructions like SSTORE, delegatecall, and external calls to assess access control, aiming to only report concrete, provable exploits or otherwise confirm no findings.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] # extract hex after '0x'
[codex:1519866] m=re.search(r'0x([0-9a-fA-F]+)', hexdata)
[codex:1519866] code=m.group(1).lower()
[codex:1519866]
[codex:1519866] opnames = {i: f'OP{i:02x}' for i in range(256)}
[codex:1519866] # basic opcode names
[codex:1519866] names = {
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',
[codex:1519866] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1519866] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1519866] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:1519866] }
[codex:1519866]
[codex:1519866] # disassemble
[codex:1519866] pc=0
[codex:1519866] ops=[]
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op, opnames[op])
[codex:1519866] pc_next=pc+2
[codex:1519866] data=''
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2, name, data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] # find SSTORE, CALL, DELEGATECALL, SELFDESTRUCT
[codex:1519866] interesting={'SSTORE','CALL','DELEGATECALL','SELFDESTRUCT'}
[codex:1519866] for i,(pc,name,data) in enumerate(ops):
[codex:1519866] if name in interesting:
[codex:1519866] # print context
[codex:1519866] start=max(0,i-5); end=min(len(ops), i+6)
[codex:1519866] print('---',hex(pc))
[codex:1519866] for j in range(start,end):
[codex:1519866] p,n,d=ops[j]
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866]
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 32ms:
[codex:1519866] --- 0x17f
[codex:1519866] 0179: CALLDATASIZE
[codex:1519866] 017a: DUP4
[codex:1519866] 017b: PUSH1 0x02
[codex:1519866] 017d: SLOAD
[codex:1519866] 017e: GAS
[codex:1519866] 017f: DELEGATECALL
[codex:1519866] 0180: RETURNDATASIZE
[codex:1519866] 0181: OP5f
[codex:1519866] 0182: DUP4
[codex:1519866] 0183: RETURNDATACOPY
[codex:1519866] 0184: DUP1
[codex:1519866] --- 0x568
[codex:1519866] 0562: PUSH1 0x01
[codex:1519866] 0564: DUP6
[codex:1519866] 0565: ADD
[codex:1519866] 0566: DUP5
[codex:1519866] 0567: GAS
[codex:1519866] 0568: DELEGATECALL
[codex:1519866] 0569: PUSH2 0x0574
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Examining storage writes and calls for vulnerabilities**
[codex:1519866]
[codex:1519866] I’m gathering more context around each SSTORE and CALL instruction to see if any calls transfer value without authorization; I plan to disassemble surrounding code (about 30 opcodes before and after) to analyze function boundaries and potential access control. The presence of constants like `deadbeef` hints at specific storage slots or placeholders, so I want to understand if this contract has unprotected functions that could be exploited.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] names = {i: f'OP{i:02x}' for i in range(256)}
[codex:1519866] # Fill names
[codex:1519866] names.update({
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',
[codex:1519866] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1519866] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1519866] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:1519866] })
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op)
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] # index by pc
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] interesting={'SSTORE','CALL','DELEGATECALL','SELFDESTRUCT'}
[codex:1519866] for i,(pc,name,data) in enumerate(ops):
[codex:1519866] if name in interesting:
[codex:1519866] print(f'=== {name} at {pc:#x} ===')
[codex:1519866] start=max(0,i-20); end=min(len(ops), i+20)
[codex:1519866] for j in range(start,end):
[codex:1519866] p,n,d=ops[j]
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866] print()
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 32ms:
[codex:1519866] === DELEGATECALL at 0x17f ===
[codex:1519866] 0167: JUMP
[codex:1519866] 0168: JUMPDEST
[codex:1519866] 0169: CALLDATASIZE
[codex:1519866] 016a: PUSH2 0x016f
[codex:1519866] 016d: JUMPI
[codex:1519866] 016e: STOP
[codex:1519866] 016f: JUMPDEST
[codex:1519866] 0170: PUSH1 0x40
[codex:1519866] 0172: MLOAD
[codex:1519866] 0173: CALLDATASIZE
[codex:1519866] 0174: OP5f
[codex:1519866] 0175: DUP3
[codex:1519866] 0176: CALLDATACOPY
[codex:1519866] 0177: OP5f
[codex:1519866] 0178: OP5f
[codex:1519866] 0179: CALLDATASIZE
[codex:1519866] 017a: DUP4
[codex:1519866] 017b: PUSH1 0x02
[codex:1519866] 017d: SLOAD
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing function dispatch and storage writes**
[codex:1519866]
[codex:1519866] I'm piecing together how the contract maps function selectors to their code locations by parsing the dispatcher for PUSH4/EQ/PUSH2/JUMPI patterns, so I can track where each SSTORE occurs within specific functions, especially checking access controls around the critical slot2 storage update. This will help me understand who can change the implementation address and if there are protections in place.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] names = {i: f'OP{i:02x}' for i in range(256)}
[codex:1519866] # fill names for push etc
[codex:1519866] for i in range(0x60,0x80):
[codex:1519866] names[i]=f'PUSH{i-0x5f}'
[codex:1519866] for i in range(0x80,0x90):
[codex:1519866] names[i]=f'DUP{i-0x7f}'
[codex:1519866] for i in range(0x90,0xa0):
[codex:1519866] names[i]=f'SWAP{i-0x8f}'
[codex:1519866] base={
[codex:1519866] 0x14:'EQ',0x57:'JUMPI'
[codex:1519866] }
[codex:1519866] # also include from before
[codex:1519866] for k,v in base.items():
[codex:1519866] names[k]=v
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] selectors=[]
[codex:1519866] for i in range(len(ops)-3):
[codex:1519866] pc,name,data=ops[i]
[codex:1519866] if name=='PUSH4':
[codex:1519866] if ops[i+1][1]=='EQ' and ops[i+2][1]=='PUSH2' and ops[i+3][1]=='JUMPI':
[codex:1519866] sel=data
[codex:1519866] dest=int(ops[i+2][2],16)
[codex:1519866] selectors.append((sel,dest,pc))
[codex:1519866]
[codex:1519866] print('selectors count',len(selectors))
[codex:1519866] for sel,dest,pc in selectors:
[codex:1519866] print(f'{sel} -> {dest:#x} (pc {pc:#x})')
[codex:1519866]
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 41ms:
[codex:1519866] selectors count 20
[codex:1519866] eed2f252 -> 0x411 (pc 0x34)
[codex:1519866] f08a0323 -> 0x43d (pc 0x3f)
[codex:1519866] fa461e33 -> 0x45c (pc 0x4a)
[codex:1519866] c311d049 -> 0x3b4 (pc 0x5a)
[codex:1519866] d0ebdbe7 -> 0x3d3 (pc 0x65)
[codex:1519866] d34628cc -> 0x3f2 (pc 0x70)
[codex:1519866] 9e281a98 -> 0x338 (pc 0x8b)
[codex:1519866] bdb25d0e -> 0x357 (pc 0x96)
[codex:1519866] bfd79284 -> 0x376 (pc 0xa1)
[codex:1519866] 6fefbbc2 -> 0x2fa (pc 0xb1)
[codex:1519866] 7580a1bc -> 0x319 (pc 0xbc)
[codex:1519866] 481c6a75 -> 0x290 (pc 0xe2)
[codex:1519866] 51b9b0fa -> 0x2bc (pc 0xed)
[codex:1519866] 6c3bbfd7 -> 0x2db (pc 0xf8)
[codex:1519866] 23a69e75 -> 0x252 (pc 0x108)
[codex:1519866] 2c8958f6 -> 0x271 (pc 0x113)
[codex:1519866] 0b58f97d -> 0x1ba (pc 0x12e)
[codex:1519866] 13af4035 -> 0x20f (pc 0x139)
[codex:1519866] 1cfed885 -> 0x22e (pc 0x144)
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Mapping function selectors to entrypoints**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] # disassemble
[codex:1519866] names = {i: f'OP{i:02x}' for i in range(256)}
[codex:1519866] # Add common names
[codex:1519866] names.update({
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',
[codex:1519866] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1519866] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1519866] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:1519866] })
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] # function selectors mapping
[codex:1519866] selectors={
[codex:1519866] '6fefbbc2':0x2fa,
[codex:1519866] '7580a1bc':0x319,
[codex:1519866] '9e281a98':0x338,
[codex:1519866] 'bdb25d0e':0x357,
[codex:1519866] 'bfd79284':0x376,
[codex:1519866] 'c311d049':0x3b4,
[codex:1519866] 'd0ebdbe7':0x3d3,
[codex:1519866] 'd34628cc':0x3f2,
[codex:1519866] 'eed2f252':0x411,
[codex:1519866] 'f08a0323':0x43d,
[codex:1519866] 'fa461e33':0x45c,
[codex:1519866] '23a69e75':0x252,
[codex:1519866] '2c8958f6':0x271,
[codex:1519866] '0b58f97d':0x1ba,
[codex:1519866] '13af4035':0x20f,
[codex:1519866] '1cfed885':0x22e,
[codex:1519866] '07d47d97':0x19b,
[codex:1519866] '481c6a75':0x290,
[codex:1519866] '51b9b0fa':0x2bc,
[codex:1519866] '6c3bbfd7':0x2db,
[codex:1519866] }
[codex:1519866]
[codex:1519866] # index ops by pc
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] for sel, dest in selectors.items():
[codex:1519866] i=pc_to_idx.get(dest)
[codex:1519866] if i is None:
[codex:1519866] print('missing',sel)
[codex:1519866] continue
[codex:1519866] print(f'\\n=== selector {sel} entry {dest:#x} ===')
[codex:1519866] # print first 40 ops from entry
[codex:1519866] for p,n,d in ops[i:i+60]:
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 32ms:
[codex:1519866]
[codex:1519866] === selector 6fefbbc2 entry 0x2fa ===
[codex:1519866] 02fa: JUMPDEST
[codex:1519866] 02fb: CALLVALUE
[codex:1519866] 02fc: DUP1
[codex:1519866] 02fd: ISZERO
[codex:1519866] 02fe: PUSH2 0x0305
[codex:1519866] 0301: JUMPI
[codex:1519866] 0302: OP5f
[codex:1519866] 0303: OP5f
[codex:1519866] 0304: REVERT
[codex:1519866] 0305: JUMPDEST
[codex:1519866] 0306: POP
[codex:1519866] 0307: PUSH2 0x0199
[codex:1519866] 030a: PUSH2 0x0314
[codex:1519866] 030d: CALLDATASIZE
[codex:1519866] 030e: PUSH1 0x04
[codex:1519866] 0310: PUSH2 0x1af2
[codex:1519866] 0313: JUMP
[codex:1519866] 0314: JUMPDEST
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing overlapping function outputs**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] names = {i: f'OP{i:02x}' for i in range(256)}
[codex:1519866] # Add names (same as before)
[codex:1519866] names.update({
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',
[codex:1519866] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1519866] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1519866] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:1519866] })
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] def dump(start, count=80):
[codex:1519866] i=pc_to_idx[start]
[codex:1519866] for p,n,d in ops[i:i+count]:
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866]
[codex:1519866] for addr in [0x0578,0x063d,0x070a,0x0760,0x088b,0x0a22,0x0b3d,0x0c99,0x0d2b,0x0dd3,0x0f55,0x0ffd,0x10cb,0x11e2,0x12b0,0x1459,0x1671,0x1713,0x178b]:
[codex:1519866] if addr not in pc_to_idx:
[codex:1519866] print('missing',hex(addr));
[codex:1519866] continue
[codex:1519866] print('\\n=== internal @',hex(addr),'===')
[codex:1519866] dump(addr, 80)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 33ms:
[codex:1519866]
[codex:1519866] === internal @ 0x578 ===
[codex:1519866] 0578: JUMPDEST
[codex:1519866] 0579: OP5f
[codex:1519866] 057a: SLOAD
[codex:1519866] 057b: PUSH1 0x40
[codex:1519866] 057d: DUP1
[codex:1519866] 057e: MLOAD
[codex:1519866] 057f: DUP1
[codex:1519866] 0580: DUP3
[codex:1519866] 0581: ADD
[codex:1519866] 0582: SWAP1
[codex:1519866] 0583: SWAP2
[codex:1519866] 0584: MSTORE
[codex:1519866] 0585: PUSH1 0x04
[codex:1519866] 0587: DUP2
[codex:1519866] 0588: MSTORE
[codex:1519866] 0589: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000
[codex:1519866] 05aa: PUSH1 0x20
[codex:1519866] 05ac: DUP3
[codex:1519866]
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing internal functions and access controls**
[codex:1519866]
[codex:1519866] I'm examining internal functions related to ownership checks, delegatecalls, and token transfers, mapping their selectors and storage slots. I'm especially focused on identifying which functions enforce access control and which might expose token transfers or external calls without restrictions. The Uniswap V3 swap callback stands out as a complex public function that requires careful validation to prevent unauthorized token transfers from the contract during swaps. I’m considering whether the contract properly verifies the pool caller and swap initiator to avoid potential exploits.
[codex:1519866] thinking
[codex:1519866] **Examining token transfer and approval mechanics**
[codex:1519866]
[codex:1519866] I'm focused on how the callback function handles token transfers and approvals, inspecting related internal functions for building safe ERC20 approve and transfer calls. The absence of the typical `transferFrom` selector in the bytecode is curious, suggesting the contract might only use `transfer` and `approve` within its logic. I’m trying to piece together whether the swap callback can pull tokens from arbitrary payers or is limited to the contract's balance.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866] print('23b872dd' in code)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 28ms:
[codex:1519866] False
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing swap callback and access control**
[codex:1519866]
[codex:1519866] I'm exploring how the contract uses `transfer` (not `transferFrom`), indicating it pays swaps from its own balance rather than pulling from users. That implies callbacks are only triggered if this contract itself calls the pool's `swap`, so external attackers can't easily exploit callbacks unless they can make this contract perform swaps. I'm investigating whether swap functions exposed (selectors 23a69e75 and 2c8958f6) are access controlled; initial observation shows they might be public, which could present a vulnerability if attackers trigger swaps draining the contract’s tokens. I'll dive deeper into the internal function 0x1459 to understand pool computations and caller verification to clarify the security posture.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] # disassembler
[codex:1519866] names = {i: f'OP{i:02x}' for i in range(256)}
[codex:1519866] # names as before
[codex:1519866] names.update({
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',
[codex:1519866] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1519866] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1519866] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:1519866] })
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] def dump_range(start, end):
[codex:1519866] i=pc_to_idx[start]
[codex:1519866] for p,n,d in ops[i:]:
[codex:1519866] if p> end: break
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866]
[codex:1519866] # dump 0x1459 - 0x1630
[codex:1519866] print('--- 0x1459-0x1630 ---')
[codex:1519866] dump_range(0x1459,0x1630)
[codex:1519866]
[codex:1519866] # dump 0x1388-0x1458 to see call and checks
[codex:1519866] print('--- 0x1380-0x1458 ---')
[codex:1519866] dump_range(0x1380,0x1458)
[codex:1519866]
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 exited 1 in 36ms:
[codex:1519866] --- 0x1459-0x1630 ---
[codex:1519866] 1459: JUMPDEST
[codex:1519866] 145a: PUSH1 0x40
[codex:1519866] 145c: MLOAD
[codex:1519866] 145d: DUP6
[codex:1519866] 145e: CALLDATALOAD
[codex:1519866] 145f: PUSH1 0x60
[codex:1519866] 1461: SWAP1
[codex:1519866] 1462: DUP2
[codex:1519866] 1463: SHR
[codex:1519866] 1464: SWAP2
[codex:1519866] 1465: PUSH1 0x14
[codex:1519866] 1467: DUP9
[codex:1519866] 1468: ADD
[codex:1519866] 1469: CALLDATALOAD
[codex:1519866] 146a: SWAP1
[codex:1519866] 146b: SWAP2
[codex:1519866] 146c: SHR
[codex:1519866] 146d: SWAP1
[codex:1519866] 146e: PUSH1 0x28
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing callback function and pool validation**
[codex:1519866]
[codex:1519866] I'm digging into the disassembled code for a callback function that computes a pool address and verifies the caller matches it. This check ensures only the correct pool can invoke the callback. I notice delegatecalls to a plugin address if certain conditions hold and a token transfer back to the pool. Now, I'm curious about the swap initiation and will review earlier code (around 0x13c6) to confirm how the swap is triggered and whether it's protected against misuse.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] names = {i: f'OP{i:02x}' for i in range(256)}
[codex:1519866] # names mapping as before
[codex:1519866] names.update({
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',
[codex:1519866] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1519866] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1519866] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:1519866] })
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] def dump_range(start, end):
[codex:1519866] i=pc_to_idx[start]
[codex:1519866] for p,n,d in ops[i:]:
[codex:1519866] if p> end: break
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866]
[codex:1519866] # find nearest JUMPDEST before 0x142f
[codex:1519866] start=0x13c6
[codex:1519866] print('--- 0x13c6-0x1458 ---')
[codex:1519866] dump_range(start, 0x1458)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 31ms:
[codex:1519866] --- 0x13c6-0x1458 ---
[codex:1519866] 13c6: JUMPDEST
[codex:1519866] 13c7: OP5f
[codex:1519866] 13c8: JUMPDEST
[codex:1519866] 13c9: DUP2
[codex:1519866] 13ca: MLOAD
[codex:1519866] 13cb: DUP2
[codex:1519866] 13cc: LT
[codex:1519866] 13cd: ISZERO
[codex:1519866] 13ce: PUSH2 0x0574
[codex:1519866] 13d1: JUMPI
[codex:1519866] 13d2: OP5f
[codex:1519866] 13d3: PUSH2 0x13dc
[codex:1519866] 13d6: DUP4
[codex:1519866] 13d7: DUP4
[codex:1519866] 13d8: PUSH2 0x17c9
[codex:1519866] 13db: JUMP
[codex:1519866] 13dc: JUMPDEST
[codex:1519866] 13dd: SWAP1
[codex:1519866] 13de: POP
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing indirect calls in callback loop**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] import sys
[codex:1519866] try:
[codex:1519866] import sha3
[codex:1519866] print('sha3 available', sha3)
[codex:1519866] k=sha3.keccak_256()
[codex:1519866] k.update(b'uniswapV3SwapCallback(int256,int256,bytes)')
[codex:1519866] print(k.hexdigest()[:8])
[codex:1519866] k=sha3.keccak_256(); k.update(b'uniswapV3MintCallback(uint256,uint256,bytes)'); print('mint',k.hexdigest()[:8])
[codex:1519866] k=sha3.keccak_256(); k.update(b'uniswapV3FlashCallback(uint256,uint256,bytes)'); print('flash',k.hexdigest()[:8])
[codex:1519866] except Exception as e:
[codex:1519866] print('err',e)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 20ms:
[codex:1519866] err No module named 'sha3'
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Checking for keccak availability**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] try:
[codex:1519866] from Crypto.Hash import keccak
[codex:1519866] k=keccak.new(digest_bits=256)
[codex:1519866] k.update(b'uniswapV3SwapCallback(int256,int256,bytes)')
[codex:1519866] print(k.hexdigest()[:8])
[codex:1519866] k=keccak.new(digest_bits=256); k.update(b'uniswapV3MintCallback(uint256,uint256,bytes)'); print('mint',k.hexdigest()[:8])
[codex:1519866] k=keccak.new(digest_bits=256); k.update(b'uniswapV3FlashCallback(uint256,uint256,bytes)'); print('flash',k.hexdigest()[:8])
[codex:1519866] except Exception as e:
[codex:1519866] print('err',e)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 47ms:
[codex:1519866] fa461e33
[codex:1519866] mint d3487997
[codex:1519866] flash e9cbafb0
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Clarifying callback selectors and access control**
[codex:1519866]
[codex:1519866] I'm confirming which selectors match known callbacks like swap and mint, then investigating whether any public functions that might initiate swaps lack access control, which could pose a risk. I’m inspecting disassembled functions around key selectors to see if sender checks exist and suspect some functions are public but may not safely restrict fund usage. I’ll look more into ABI decoding patterns to understand parameter handling better.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] names={i:f'OP{i:02x}' for i in range(256)}
[codex:1519866] # add minimal names for readability
[codex:1519866] names.update({
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1519866] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:1519866] })
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] def dump(start, count=60):
[codex:1519866] i=pc_to_idx[start]
[codex:1519866] for p,n,d in ops[i:i+count]:
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866]
[codex:1519866] for addr in [0x19cf,0x1a5f,0x1abf,0x1af2,0x1b09,0x1b3a,0x191f,0x1986]:
[codex:1519866] if addr not in pc_to_idx:
[codex:1519866] print('missing',hex(addr));continue
[codex:1519866] print('\\n== decode @',hex(addr),'==')
[codex:1519866] dump(addr, 60)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 33ms:
[codex:1519866]
[codex:1519866] == decode @ 0x19cf ==
[codex:1519866] 19cf: JUMPDEST
[codex:1519866] 19d0: OP5f
[codex:1519866] 19d1: OP5f
[codex:1519866] 19d2: OP5f
[codex:1519866] 19d3: OP5f
[codex:1519866] 19d4: PUSH1 0x60
[codex:1519866] 19d6: DUP6
[codex:1519866] 19d7: DUP8
[codex:1519866] 19d8: SUB
[codex:1519866] 19d9: SLT
[codex:1519866] 19da: ISZERO
[codex:1519866] 19db: PUSH2 0x19e2
[codex:1519866] 19de: JUMPI
[codex:1519866] 19df: OP5f
[codex:1519866] 19e0: OP5f
[codex:1519866] 19e1: REVERT
[codex:1519866] 19e2: JUMPDEST
[codex:1519866] 19e3: DUP5
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing access control and delegatecalls**
[codex:1519866]
[codex:1519866] I’m digging into the contract’s functions to see if any public method could let an attacker transfer tokens by exploiting delegatecalls or storage manipulation. Most sensitive setters are owner-only, but a couple public functions might initiate swaps or operations without explicit access checks, so I’m piecing together how those decode inputs and interact with mappings to understand any loopholes.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] names={i:f'OP{i:02x}' for i in range(256)}
[codex:1519866] # minimal names
[codex:1519866] names.update({0x5b:'JUMPDEST',0x56:'JUMP',0x57:'JUMPI',0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x20:'SHA3',0x14:'EQ',0x10:'LT',0x11:'GT',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',0x50:'POP',0x33:'CALLER',0x5a:'GAS',0xf1:'CALL',0xf4:'DELEGATECALL',0xf3:'RETURN',0xfd:'REVERT'})
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] def dump(start,count=50):
[codex:1519866] i=pc_to_idx[start]
[codex:1519866] for p,n,d in ops[i:i+count]:
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866]
[codex:1519866] print('== 0x18da ==')
[codex:1519866] dump(0x18da,60)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 34ms:
[codex:1519866] == 0x18da ==
[codex:1519866] 18da: JUMPDEST
[codex:1519866] 18db: OP5f
[codex:1519866] 18dc: OP5f
[codex:1519866] 18dd: OP83
[codex:1519866] 18de: PUSH1 0x1f
[codex:1519866] 18e0: OP84
[codex:1519866] 18e1: OP01
[codex:1519866] 18e2: OP12
[codex:1519866] 18e3: PUSH2 0x18ea
[codex:1519866] 18e6: JUMPI
[codex:1519866] 18e7: OP5f
[codex:1519866] 18e8: OP5f
[codex:1519866] 18e9: REVERT
[codex:1519866] 18ea: JUMPDEST
[codex:1519866] 18eb: POP
[codex:1519866] 18ec: OP81
[codex:1519866] 18ed: CALLDATALOAD
[codex:1519866] 18ee: PUSH8 0xffffffffffffffff
[codex:1519866] 18f7: OP81
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing contract control and swap logic**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] # disassemble small region around 0x047b
[codex:1519866] names={i:f'OP{i:02x}' for i in range(256)}
[codex:1519866] # fill names minimal
[codex:1519866] names.update({
[codex:1519866] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1519866] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1519866] 0x20:'SHA3',
[codex:1519866] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',
[codex:1519866] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1519866] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:1519866] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1519866] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1519866] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1519866] 0xa0:'LOG0',
[codex:1519866] 0xf1:'CALL',0xf4:'DELEGATECALL',0xf3:'RETURN',0xfd:'REVERT',
[codex:1519866] })
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] name=names.get(op,f'OP{op:02x}')
[codex:1519866] pc_next=pc+2
[codex:1519866] data=None
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] data=code[pc_next:pc_next+2*n]
[codex:1519866] pc_next+=2*n
[codex:1519866] ops.append((pc//2,name,data))
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] pc_to_idx={pc:i for i,(pc,_,_) in enumerate(ops)}
[codex:1519866]
[codex:1519866] def dump_range(start,end):
[codex:1519866] i=pc_to_idx[start]
[codex:1519866] for p,n,d in ops[i:]:
[codex:1519866] if p> end: break
[codex:1519866] if d:
[codex:1519866] print(f'{p:04x}: {n} 0x{d}')
[codex:1519866] else:
[codex:1519866] print(f'{p:04x}: {n}')
[codex:1519866]
[codex:1519866] print('--- 0x047b-0x0580 ---')
[codex:1519866] dump_range(0x047b,0x0580)
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 32ms:
[codex:1519866] --- 0x047b-0x0580 ---
[codex:1519866] 047b: JUMPDEST
[codex:1519866] 047c: CALLER
[codex:1519866] 047d: OP5f
[codex:1519866] 047e: SWAP1
[codex:1519866] 047f: DUP2
[codex:1519866] 0480: MSTORE
[codex:1519866] 0481: PUSH1 0x03
[codex:1519866] 0483: PUSH1 0x20
[codex:1519866] 0485: SWAP1
[codex:1519866] 0486: DUP2
[codex:1519866] 0487: MSTORE
[codex:1519866] 0488: PUSH1 0x40
[codex:1519866] 048a: SWAP2
[codex:1519866] 048b: DUP3
[codex:1519866] 048c: SWAP1
[codex:1519866] 048d: SHA3
[codex:1519866] 048e: SLOAD
[codex:1519866] 048f: DUP3
[codex:1519866] 0490: MLOAD
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing modular contract delegatecall logic**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from Crypto.Hash import keccak
[codex:1519866]
[codex:1519866] def sig(sel):
[codex:1519866] k=keccak.new(digest_bits=256)
[codex:1519866] k.update(sel.encode())
[codex:1519866] return k.hexdigest()[:8]
[codex:1519866]
[codex:1519866] sigs=[
[codex:1519866] 'transferFrom(address,address,uint256)',
[codex:1519866] 'transferFrom(address,address,uint160,address)',
[codex:1519866] 'transferFrom(address,address,uint160,address,address)',
[codex:1519866] 'transferFrom(address,address,uint160)',
[codex:1519866] 'transfer(address,uint256)',
[codex:1519866] 'permitTransferFrom((address,uint256),address,uint256,bytes)',
[codex:1519866] 'permitTransferFrom((address,uint256),address,uint256,bytes32,bytes)',
[codex:1519866] 'permitTransferFrom(((address,uint256),uint256),address,uint256,bytes)',
[codex:1519866] 'transferFrom(address,address,uint256,address)',
[codex:1519866] 'transferFrom(address,address,uint160,address)',
[codex:1519866] 'transferFrom(address,address,uint160,address,bool)',
[codex:1519866] 'transferFrom(address,address,uint256,address,uint256)',
[codex:1519866] 'transferFrom(address,address,uint256,address,uint256,uint256)',
[codex:1519866] 'transferFrom(address,address,uint256,bytes)',
[codex:1519866] 'permit(address,address,uint256,uint256,uint8,bytes32,bytes32)'
[codex:1519866] ]
[codex:1519866]
[codex:1519866] for s in sigs:
[codex:1519866] print(s, sig(s))
[codex:1519866]
[codex:1519866] # also Permit2 specific known signature
[codex:1519866] print('permit2.transferFrom', sig('transferFrom(address,address,uint160,address)'))
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 39ms:
[codex:1519866] transferFrom(address,address,uint256) 23b872dd
[codex:1519866] transferFrom(address,address,uint160,address) 36c78516
[codex:1519866] transferFrom(address,address,uint160,address,address) d4f525d2
[codex:1519866] transferFrom(address,address,uint160) 8e7f429e
[codex:1519866] transfer(address,uint256) a9059cbb
[codex:1519866] permitTransferFrom((address,uint256),address,uint256,bytes) f4213b74
[codex:1519866] permitTransferFrom((address,uint256),address,uint256,bytes32,bytes) 7ba1db81
[codex:1519866] permitTransferFrom(((address,uint256),uint256),address,uint256,bytes) 541d57d2
[codex:1519866] transferFrom(address,address,uint256,address) 5fc9309c
[codex:1519866] transferFrom(address,address,uint160,address) 36c78516
[codex:1519866] transferFrom(address,address,uint160,address,bool) 4d7205d6
[codex:1519866] transferFrom(address,address,uint256,address,uint256) d26e0d18
[codex:1519866] transferFrom(address,address,uint256,address,uint256,uint256) 510fcb71
[codex:1519866] transferFrom(address,address,uint256,bytes) ab67aa58
[codex:1519866] permit(address,address,uint256,uint256,uint8,bytes32,bytes32) d505accf
[codex:1519866] permit2.transferFrom 36c78516
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Investigating potential unrestricted calls**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from pathlib import Path
[codex:1519866] import re
[codex:1519866]
[codex:1519866] hexdata=Path('/tmp/codex-multi-4uplani4/BYTECODE_BUNDLE.txt').read_text()
[codex:1519866] code=re.search(r'0x([0-9a-fA-F]+)', hexdata).group(1).lower()
[codex:1519866]
[codex:1519866] ops=[]
[codex:1519866] pc=0
[codex:1519866] callers=[]
[codex:1519866] while pc < len(code):
[codex:1519866] op=int(code[pc:pc+2],16)
[codex:1519866] if op==0x33:
[codex:1519866] callers.append(pc//2)
[codex:1519866] pc_next=pc+2
[codex:1519866] if 0x60 <= op <= 0x7f:
[codex:1519866] n=op-0x5f
[codex:1519866] pc_next+=2*n
[codex:1519866] pc=pc_next
[codex:1519866]
[codex:1519866] print('CALLER ops at:', [hex(x) for x in callers])
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 34ms:
[codex:1519866] CALLER ops at: ['0x47c', '0x5c6', '0x68b', '0x8d9', '0xa70', '0xb8c', '0xce7', '0xd79', '0xdcd', '0xe22', '0xfa3', '0xfde', '0x104b', '0x1119', '0x1230', '0x1543']
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing function caller checks and callbacks**
[codex:1519866]
[codex:1519866] I'm investigating how certain public functions interact with caller checks, especially involving callback functions like 0x1459 that verify if the caller matches the pool address. I’m curious if functions like 0x070a or 23a69e75, which call 0x1459, are really public or only intended as callbacks for specific DEX pools like Algebra or PancakeV3, ensuring no vulnerability from arbitrary user calls. I’ll test callback signatures by computing keccak hashes to identify them.
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from Crypto.Hash import keccak
[codex:1519866]
[codex:1519866] def sel(sig):
[codex:1519866] k=keccak.new(digest_bits=256)
[codex:1519866] k.update(sig.encode())
[codex:1519866] return k.hexdigest()[:8]
[codex:1519866]
[codex:1519866] sigs=[
[codex:1519866] 'algebraSwapCallback(int256,int256,bytes)',
[codex:1519866] 'pancakeV3SwapCallback(int256,int256,bytes)',
[codex:1519866] 'uniV3SwapCallback(int256,int256,bytes)',
[codex:1519866] 'swapCallback(int256,int256,bytes)',
[codex:1519866] 'uniswapV3SwapCallback(int256,int256,bytes)',
[codex:1519866] 'swapCallback(int256,int256,bytes)',
[codex:1519866] 'swapCallback(int256,int256,bytes)',
[codex:1519866] 'IUniswapV3SwapCallback.uniswapV3SwapCallback(int256,int256,bytes)',
[codex:1519866] 'swapCallback(int256,int256,bytes)',
[codex:1519866] 'swapCallback(int256,int256,bytes32)',
[codex:1519866] 'uniswapV3SwapCallback(int256,int256,bytes)',
[codex:1519866] 'pancakeV3SwapCallback(int256,int256,bytes)',
[codex:1519866] 'swapCallback(int256,int256,bytes)'
[codex:1519866] ]
[codex:1519866]
[codex:1519866] for s in sigs:
[codex:1519866] print(s, sel(s))
[codex:1519866]
[codex:1519866] # maybe algebraSwapCallback uses int256,int256,bytes
[codex:1519866]
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 39ms:
[codex:1519866] algebraSwapCallback(int256,int256,bytes) 2c8958f6
[codex:1519866] pancakeV3SwapCallback(int256,int256,bytes) 23a69e75
[codex:1519866] uniV3SwapCallback(int256,int256,bytes) 61ce8a8e
[codex:1519866] swapCallback(int256,int256,bytes) fa483e72
[codex:1519866] uniswapV3SwapCallback(int256,int256,bytes) fa461e33
[codex:1519866] swapCallback(int256,int256,bytes) fa483e72
[codex:1519866] swapCallback(int256,int256,bytes) fa483e72
[codex:1519866] IUniswapV3SwapCallback.uniswapV3SwapCallback(int256,int256,bytes) e6628ffd
[codex:1519866] swapCallback(int256,int256,bytes) fa483e72
[codex:1519866] swapCallback(int256,int256,bytes32) b32e11bd
[codex:1519866] uniswapV3SwapCallback(int256,int256,bytes) fa461e33
[codex:1519866] pancakeV3SwapCallback(int256,int256,bytes) 23a69e75
[codex:1519866] swapCallback(int256,int256,bytes) fa483e72
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Analyzing swap callback selectors**
[codex:1519866] exec
[codex:1519866] /bin/bash -lc "python - <<'PY'
[codex:1519866] from Crypto.Hash import keccak
[codex:1519866]
[codex:1519866] def sel(sig):
[codex:1519866] k=keccak.new(digest_bits=256)
[codex:1519866] k.update(sig.encode())
[codex:1519866] return k.hexdigest()[:8]
[codex:1519866]
[codex:1519866] cands=[
[codex:1519866] 'uniswapV3MintCallback(uint256,uint256,bytes)',
[codex:1519866] 'pancakeV3MintCallback(uint256,uint256,bytes)',
[codex:1519866] 'algebraMintCallback(uint256,uint256,bytes)',
[codex:1519866] 'mintCallback(uint256,uint256,bytes)',
[codex:1519866] 'swapCallback(int256,int256,bytes)',
[codex:1519866] 'flashCallback(uint256,uint256,bytes)',
[codex:1519866] 'uniswapV3FlashCallback(uint256,uint256,bytes)',
[codex:1519866] ]
[codex:1519866]
[codex:1519866] for s in cands:
[codex:1519866] print(s, sel(s))
[codex:1519866] PY" in /tmp/codex-multi-4uplani4 succeeded in 41ms:
[codex:1519866] uniswapV3MintCallback(uint256,uint256,bytes) d3487997
[codex:1519866] pancakeV3MintCallback(uint256,uint256,bytes) 99eee9d0
[codex:1519866] algebraMintCallback(uint256,uint256,bytes) 3dd657c5
[codex:1519866] mintCallback(uint256,uint256,bytes) 9f382e9b
[codex:1519866] swapCallback(int256,int256,bytes) fa483e72
[codex:1519866] flashCallback(uint256,uint256,bytes) c3924ed6
[codex:1519866] uniswapV3FlashCallback(uint256,uint256,bytes) e9cbafb0
[codex:1519866]
[codex:1519866] thinking
[codex:1519866] **Preparing final JSON report**
[codex:1519866] codex
[codex:1519866] {"no_findings":true,"summary":"Reviewed BYTECODE_BUNDLE.txt runtime bytecode; no concrete, exploitable profit path identified from bytecode alone.","findings":[]}
[codex:1519866] tokens used
[codex:1519866] 116,603
[codex:1519866] {"no_findings":true,"summary":"Reviewed BYTECODE_BUNDLE.txt runtime bytecode; no concrete, exploitable profit path identified from bytecode alone.","findings":[]}
{
"codex": {
"ran_at": "2026-01-02T04:47:59.108419+00:00",
"returncode": 0
},
"summary": "Reviewed BYTECODE_BUNDLE.txt runtime bytecode; no concrete, exploitable profit path identified from bytecode alone.",
"raw_final": {
"summary": "Reviewed BYTECODE_BUNDLE.txt runtime bytecode; no concrete, exploitable profit path identified from bytecode alone.",
"findings": [],
"no_findings": true
},
"no_findings": true,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x0168 0000000c: JUMPI 0000000d: PUSH0 0000000e: CALLDATALOAD 0000000f: PUSH1 0xe0 00000011: SHR 00000012: DUP1 00000013: PUSH4 0x6fefbbc2 00000018: GT 00000019: PUSH2 0x00ca 0000001c: JUMPI 0000001d: DUP1 0000001e: PUSH4 0xc311d049 00000023: GT 00000024: PUSH2 0x007e 00000027: JUMPI 00000028: DUP1 00000029: PUSH4 0xeed2f252 0000002e: GT 0000002f: PUSH2 0x0058 00000032: JUMPI 00000033: DUP1 00000034: PUSH4 0xeed2f252 00000039: EQ 0000003a: PUSH2 0x0411 0000003d: JUMPI 0000003e: DUP1 0000003f: PUSH4 0xf08a0323 00000044: EQ 00000045: PUSH2 0x043d 00000048: JUMPI 00000049: DUP1 0000004a: PUSH4 0xfa461e33 0000004f: EQ 00000050: PUSH2 0x045c 00000053: JUMPI 00000054: PUSH2 0x016f 00000057: JUMP 00000058: JUMPDEST 00000059: DUP1 0000005a: PUSH4 0xc311d049 0000005f: EQ 00000060: PUSH2 0x03b4 00000063: JUMPI 00000064: DUP1 00000065: PUSH4 0xd0ebdbe7 0000006a: EQ 0000006b: PUSH2 0x03d3 0000006e: JUMPI 0000006f: DUP1 00000070: PUSH4 0xd34628cc 00000075: EQ 00000076: PUSH2 0x03f2 00000079: JUMPI 0000007a: PUSH2 0x016f 0000007d: JUMP 0000007e: JUMPDEST 0000007f: DUP1 00000080: PUSH4 0x9e281a98 00000085: GT 00000086: PUSH2 0x00af 00000089: JUMPI 0000008a: DUP1 0000008b: PUSH4 0x9e281a98 00000090: EQ 00000091: PUSH2 0x0338 00000094: JUMPI 00000095: DUP1 00000096: PUSH4 0xbdb25d0e 0000009b: EQ 0000009c: PUSH2 0x0357 0000009f: JUMPI 000000a0: DUP1 000000a1: PUSH4 0xbfd79284 000000a6: EQ 000000a7: PUSH2 0x0376 000000aa: JUMPI 000000ab: PUSH2 0x016f 000000ae: JUMP 000000af: JUMPDEST 000000b0: DUP1 000000b1: PUSH4 0x6fefbbc2 000000b6: EQ 000000b7: PUSH2 0x02fa 000000ba: JUMPI 000000bb: DUP1 000000bc: PUSH4 0x7580a1bc 000000c1: EQ 000000c2: PUSH2 0x0319 000000c5: JUMPI 000000c6: PUSH2 0x016f 000000c9: JUMP 000000ca: JUMPDEST 000000cb: DUP1 000000cc: PUSH4 0x23a69e75 000000d1: GT 000000d2: PUSH2 0x0121 000000d5: JUMPI 000000d6: DUP1 000000d7: PUSH4 0x481c6a75 000000dc: GT 000000dd: PUSH2 0x0106 000000e0: JUMPI 000000e1: DUP1 000000e2: PUSH4 0x481c6a75 000000e7: EQ 000000e8: PUSH2 0x0290 000000eb: JUMPI 000000ec: DUP1 000000ed: PUSH4 0x51b9b0fa 000000f2: EQ 000000f3: PUSH2 0x02bc 000000f6: JUMPI 000000f7: DUP1 000000f8: PUSH4 0x6c3bbfd7 000000fd: EQ 000000fe: PUSH2 0x02db 00000101: JUMPI 00000102: PUSH2 0x016f 00000105: JUMP 00000106: JUMPDEST 00000107: DUP1 00000108: PUSH4 0x23a69e75 0000010d: EQ 0000010e: PUSH2 0x0252 00000111: JUMPI 00000112: DUP1 00000113: PUSH4 0x2c8958f6 00000118: EQ 00000119: PUSH2 0x0271 0000011c: JUMPI 0000011d: PUSH2 0x016f 00000120: JUMP 00000121: JUMPDEST 00000122: DUP1 00000123: PUSH4 0x0b58f97d 00000128: GT 00000129: PUSH2 0x0152 0000012c: JUMPI 0000012d: DUP1 0000012e: PUSH4 0x0b58f97d 00000133: EQ 00000134: PUSH2 0x01ba 00000137: JUMPI 00000138: DUP1 00000139: PUSH4 0x13af4035 0000013e: EQ 0000013f: PUSH2 0x020f 00000142: JUMPI 00000143: DUP1 00000144: PUSH4 0x1cfed885 00000149: EQ 0000014a: PUSH2 0x022e 0000014d: JUMPI 0000014e: PUSH2 0x016f 00000151: JUMP 00000152: JUMPDEST 00000153: DUP1 00000154: ISZERO 00000155: PUSH2 0x0191 00000158: JUMPI 00000159: DUP1 0000015a: PUSH4 0x07d47d97 0000015f: EQ 00000160: PUSH2 0x019b 00000163: JUMPI 00000164: PUSH2 0x016f 00000167: JUMP 00000168: JUMPDEST 00000169: CALLDATASIZE 0000016a: PUSH2 0x016f 0000016d: JUMPI 0000016e: STOP 0000016f: JUMPDEST 00000170: PUSH1 0x40 00000172: MLOAD 00000173: CALLDATASIZE 00000174: PUSH0 00000175: DUP3 00000176: CALLDATACOPY 00000177: PUSH0 00000178: PUSH0 00000179: CALLDATASIZE 0000017a: DUP4 0000017b: PUSH1 0x02 0000017d: SLOAD 0000017e: GAS 0000017f: DELEGATECALL 00000180: RETURNDATASIZE 00000181: PUSH0 00000182: DUP4 00000183: RETURNDATACOPY 00000184: DUP1 00000185: PUSH2 0x018c 00000188: JUMPI 00000189: RETURNDATASIZE 0000018a: DUP3 0000018b: REVERT 0000018c: JUMPDEST 0000018d: POP 0000018e: RETURNDATASIZE 0000018f: DUP2 00000190: RETURN 00000191: JUMPDEST 00000192: PUSH2 0x0199 00000195: PUSH2 0x047b 00000198: JUMP 00000199: JUMPDEST 0000019a: STOP 0000019b: JUMPDEST 0000019c: CALLVALUE 0000019d: DUP1 0000019e: ISZERO 0000019f: PUSH2 0x01a6 000001a2: JUMPI 000001a3: PUSH0 000001a4: PUSH0 000001a5: REVERT 000001a6: JUMPDEST 000001a7: POP 000001a8: PUSH2 0x0199 000001ab: PUSH2 0x01b5 000001ae: CALLDATASIZE 000001af: PUSH1 0x04 000001b1: PUSH2 0x191f 000001b4: JUMP 000001b5: JUMPDEST 000001b6: PUSH2 0x0578 000001b9: JUMP 000001ba: JUMPDEST 000001bb: CALLVALUE 000001bc: DUP1 000001bd: ISZERO 000001be: PUSH2 0x01c5 000001c1: JUMPI 000001c2: PUSH0 000001c3: PUSH0 000001c4: REVERT 000001c5: JUMPDEST 000001c6: POP 000001c7: PUSH0 000001c8: SLOAD 000001c9: PUSH2 0x01e5 000001cc: SWAP1 000001cd: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001e2: AND 000001e3: DUP2 000001e4: JUMP 000001e5: JUMPDEST 000001e6: PUSH1 0x40 000001e8: MLOAD 000001e9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001fe: SWAP1 000001ff: SWAP2 00000200: AND 00000201: DUP2 00000202: MSTORE 00000203: PUSH1 0x20 00000205: ADD 00000206: JUMPDEST 00000207: PUSH1 0x40 00000209: MLOAD 0000020a: DUP1 0000020b: SWAP2 0000020c: SUB 0000020d: SWAP1 0000020e: RETURN 0000020f: JUMPDEST 00000210: CALLVALUE 00000211: DUP1 00000212: ISZERO 00000213: PUSH2 0x021a 00000216: JUMPI 00000217: PUSH0 00000218: PUSH0 00000219: REVERT 0000021a: JUMPDEST 0000021b: POP 0000021c: PUSH2 0x0199 0000021f: PUSH2 0x0229 00000222: CALLDATASIZE 00000223: PUSH1 0x04 00000225: PUSH2 0x1986 00000228: JUMP 00000229: JUMPDEST 0000022a: PUSH2 0x063d 0000022d: JUMP 0000022e: JUMPDEST 0000022f: CALLVALUE 00000230: DUP1 00000231: ISZERO 00000232: PUSH2 0x0239 00000235: JUMPI 00000236: PUSH0 00000237: PUSH0 00000238: REVERT 00000239: JUMPDEST 0000023a: POP 0000023b: PUSH2 0x01e5 0000023e: PUSH2 0x0248 00000241: CALLDATASIZE 00000242: PUSH1 0x04 00000244: PUSH2 0x19b6 00000247: JUMP 00000248: JUMPDEST 00000249: PUSH4 0xdeadbeef 0000024e: ADD 0000024f: SLOAD 00000250: SWAP1 00000251: JUMP 00000252: JUMPDEST 00000253: CALLVALUE 00000254: DUP1 00000255: ISZERO 00000256: PUSH2 0x025d 00000259: JUMPI 0000025a: PUSH0 0000025b: PUSH0 0000025c: REVERT 0000025d: JUMPDEST 0000025e: POP 0000025f: PUSH2 0x0199 00000262: PUSH2 0x026c 00000265: CALLDATASIZE 00000266: PUSH1 0x04 00000268: PUSH2 0x19cf 0000026b: JUMP 0000026c: JUMPDEST 0000026d: PUSH2 0x070a 00000270: JUMP 00000271: JUMPDEST 00000272: CALLVALUE 00000273: DUP1 00000274: ISZERO 00000275: PUSH2 0x027c 00000278: JUMPI 00000279: PUSH0 0000027a: PUSH0 0000027b: REVERT 0000027c: JUMPDEST 0000027d: POP 0000027e: PUSH2 0x0199 00000281: PUSH2 0x028b 00000284: CALLDATASIZE 00000285: PUSH1 0x04 00000287: PUSH2 0x19cf 0000028a: JUMP 0000028b: JUMPDEST 0000028c: PUSH2 0x0760 0000028f: JUMP 00000290: JUMPDEST 00000291: CALLVALUE 00000292: DUP1 00000293: ISZERO 00000294: PUSH2 0x029b 00000297: JUMPI 00000298: PUSH0 00000299: PUSH0 0000029a: REVERT 0000029b: JUMPDEST 0000029c: POP 0000029d: PUSH1 0x01 0000029f: SLOAD 000002a0: PUSH2 0x01e5 000002a3: SWAP1 000002a4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002b9: AND 000002ba: DUP2 000002bb: JUMP 000002bc: JUMPDEST 000002bd: CALLVALUE 000002be: DUP1 000002bf: ISZERO 000002c0: PUSH2 0x02c7 000002c3: JUMPI 000002c4: PUSH0 000002c5: PUSH0 000002c6: REVERT 000002c7: JUMPDEST 000002c8: POP 000002c9: PUSH2 0x0199 000002cc: PUSH2 0x02d6 000002cf: CALLDATASIZE 000002d0: PUSH1 0x04 000002d2: PUSH2 0x1a5f 000002d5: JUMP 000002d6: JUMPDEST 000002d7: PUSH2 0x088b 000002da: JUMP 000002db: JUMPDEST 000002dc: CALLVALUE 000002dd: DUP1 000002de: ISZERO 000002df: PUSH2 0x02e6 000002e2: JUMPI 000002e3: PUSH0 000002e4: PUSH0 000002e5: REVERT 000002e6: JUMPDEST 000002e7: POP 000002e8: PUSH2 0x0199 000002eb: PUSH2 0x02f5 000002ee: CALLDATASIZE 000002ef: PUSH1 0x04 000002f1: PUSH2 0x1abf 000002f4: JUMP 000002f5: JUMPDEST 000002f6: PUSH2 0x0a22 000002f9: JUMP 000002fa: JUMPDEST 000002fb: CALLVALUE 000002fc: DUP1 000002fd: ISZERO 000002fe: PUSH2 0x0305 00000301: JUMPI 00000302: PUSH0 00000303: PUSH0 00000304: REVERT 00000305: JUMPDEST 00000306: POP 00000307: PUSH2 0x0199 0000030a: PUSH2 0x0314 0000030d: CALLDATASIZE 0000030e: PUSH1 0x04 00000310: PUSH2 0x1af2 00000313: JUMP 00000314: JUMPDEST 00000315: PUSH2 0x0b3d 00000318: JUMP 00000319: JUMPDEST 0000031a: CALLVALUE 0000031b: DUP1 0000031c: ISZERO 0000031d: PUSH2 0x0324 00000320: JUMPI 00000321: PUSH0 00000322: PUSH0 00000323: REVERT 00000324: JUMPDEST 00000325: POP 00000326: PUSH2 0x0199 00000329: PUSH2 0x0333 0000032c: CALLDATASIZE 0000032d: PUSH1 0x04 0000032f: PUSH2 0x1b09 00000332: JUMP 00000333: JUMPDEST 00000334: PUSH2 0x0c99 00000337: JUMP 00000338: JUMPDEST 00000339: CALLVALUE 0000033a: DUP1 0000033b: ISZERO 0000033c: PUSH2 0x0343 0000033f: JUMPI 00000340: PUSH0 00000341: PUSH0 00000342: REVERT 00000343: JUMPDEST 00000344: POP 00000345: PUSH2 0x0199 00000348: PUSH2 0x0352 0000034b: CALLDATASIZE 0000034c: PUSH1 0x04 0000034e: PUSH2 0x1b3a 00000351: JUMP 00000352: JUMPDEST 00000353: PUSH2 0x0d2b 00000356: JUMP 00000357: JUMPDEST 00000358: CALLVALUE 00000359: DUP1 0000035a: ISZERO 0000035b: PUSH2 0x0362 0000035e: JUMPI 0000035f: PUSH0 00000360: PUSH0 00000361: REVERT 00000362: JUMPDEST 00000363: POP 00000364: PUSH2 0x0199 00000367: PUSH2 0x0371 0000036a: CALLDATASIZE 0000036b: PUSH1 0x04 0000036d: PUSH2 0x1a5f 00000370: JUMP 00000371: JUMPDEST 00000372: PUSH2 0x0dd3 00000375: JUMP 00000376: JUMPDEST 00000377: CALLVALUE 00000378: DUP1 00000379: ISZERO 0000037a: PUSH2 0x0381 0000037d: JUMPI 0000037e: PUSH0 0000037f: PUSH0 00000380: REVERT 00000381: JUMPDEST 00000382: POP 00000383: PUSH2 0x03a4 00000386: PUSH2 0x0390 00000389: CALLDATASIZE 0000038a: PUSH1 0x04 0000038c: PUSH2 0x1986 0000038f: JUMP 00000390: JUMPDEST 00000391: PUSH1 0x03 00000393: PUSH1 0x20 00000395: MSTORE 00000396: PUSH0 00000397: SWAP1 00000398: DUP2 00000399: MSTORE 0000039a: PUSH1 0x40 0000039c: SWAP1 0000039d: KECCAK256 0000039e: SLOAD 0000039f: PUSH1 0xff 000003a1: AND 000003a2: DUP2 000003a3: JUMP 000003a4: JUMPDEST 000003a5: PUSH1 0x40 000003a7: MLOAD 000003a8: SWAP1 000003a9: ISZERO 000003aa: ISZERO 000003ab: DUP2 000003ac: MSTORE 000003ad: PUSH1 0x20 000003af: ADD 000003b0: PUSH2 0x0206 000003b3: JUMP 000003b4: JUMPDEST 000003b5: CALLVALUE 000003b6: DUP1 000003b7: ISZERO 000003b8: PUSH2 0x03bf 000003bb: JUMPI 000003bc: PUSH0 000003bd: PUSH0 000003be: REVERT 000003bf: JUMPDEST 000003c0: POP 000003c1: PUSH2 0x0199 000003c4: PUSH2 0x03ce 000003c7: CALLDATASIZE 000003c8: PUSH1 0x04 000003ca: PUSH2 0x1af2 000003cd: JUMP 000003ce: JUMPDEST 000003cf: PUSH2 0x0f55 000003d2: JUMP 000003d3: JUMPDEST 000003d4: CALLVALUE 000003d5: DUP1 000003d6: ISZERO 000003d7: PUSH2 0x03de 000003da: JUMPI 000003db: PUSH0 000003dc: PUSH0 000003dd: REVERT 000003de: JUMPDEST 000003df: POP 000003e0: PUSH2 0x0199 000003e3: PUSH2 0x03ed 000003e6: CALLDATASIZE 000003e7: PUSH1 0x04 000003e9: PUSH2 0x1986 000003ec: JUMP 000003ed: JUMPDEST 000003ee: PUSH2 0x0ffd 000003f1: JUMP 000003f2: JUMPDEST 000003f3: CALLVALUE 000003f4: DUP1 000003f5: ISZERO 000003f6: PUSH2 0x03fd 000003f9: JUMPI 000003fa: PUSH0 000003fb: PUSH0 000003fc: REVERT 000003fd: JUMPDEST 000003fe: POP 000003ff: PUSH2 0x0199 00000402: PUSH2 0x040c 00000405: CALLDATASIZE 00000406: PUSH1 0x04 00000408: PUSH2 0x1abf 0000040b: JUMP 0000040c: JUMPDEST 0000040d: PUSH2 0x10cb 00000410: JUMP 00000411: JUMPDEST 00000412: CALLVALUE 00000413: DUP1 00000414: ISZERO 00000415: PUSH2 0x041c 00000418: JUMPI 00000419: PUSH0 0000041a: PUSH0 0000041b: REVERT 0000041c: JUMPDEST 0000041d: POP 0000041e: PUSH1 0x02 00000420: SLOAD 00000421: PUSH2 0x01e5 00000424: SWAP1 00000425: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000043a: AND 0000043b: DUP2 0000043c: JUMP 0000043d: JUMPDEST 0000043e: CALLVALUE 0000043f: DUP1 00000440: ISZERO 00000441: PUSH2 0x0448 00000444: JUMPI 00000445: PUSH0 00000446: PUSH0 00000447: REVERT 00000448: JUMPDEST 00000449: POP 0000044a: PUSH2 0x0199 0000044d: PUSH2 0x0457 00000450: CALLDATASIZE 00000451: PUSH1 0x04 00000453: PUSH2 0x1986 00000456: JUMP 00000457: JUMPDEST 00000458: PUSH2 0x11e2 0000045b: JUMP 0000045c: JUMPDEST 0000045d: CALLVALUE 0000045e: DUP1 0000045f: ISZERO 00000460: PUSH2 0x0467 00000463: JUMPI 00000464: PUSH0 00000465: PUSH0 00000466: REVERT 00000467: JUMPDEST 00000468: POP 00000469: PUSH2 0x0199 0000046c: PUSH2 0x0476 0000046f: CALLDATASIZE 00000470: PUSH1 0x04 00000472: PUSH2 0x19cf 00000475: JUMP 00000476: JUMPDEST 00000477: PUSH2 0x12b0 0000047a: JUMP 0000047b: JUMPDEST 0000047c: CALLER 0000047d: PUSH0 0000047e: SWAP1 0000047f: DUP2 00000480: MSTORE 00000481: PUSH1 0x03 00000483: PUSH1 0x20 00000485: SWAP1 00000486: DUP2 00000487: MSTORE 00000488: PUSH1 0x40 0000048a: SWAP2 0000048b: DUP3 0000048c: SWAP1 0000048d: KECCAK256 0000048e: SLOAD 0000048f: DUP3 00000490: MLOAD 00000491: DUP1 00000492: DUP5 00000493: ADD 00000494: SWAP1 00000495: SWAP4 00000496: MSTORE 00000497: PUSH1 0x04 00000499: DUP4 0000049a: MSTORE 0000049b: PUSH32 0x4d30303200000000000000000000000000000000000000000000000000000000 000004bc: SWAP2 000004bd: DUP4 000004be: ADD 000004bf: SWAP2 000004c0: SWAP1 000004c1: SWAP2 000004c2: MSTORE 000004c3: PUSH1 0xff 000004c5: AND 000004c6: PUSH2 0x0505 000004c9: JUMPI 000004ca: PUSH1 0x40 000004cc: MLOAD 000004cd: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 000004ee: DUP2 000004ef: MSTORE 000004f0: PUSH1 0x04 000004f2: ADD 000004f3: PUSH2 0x04fc 000004f6: SWAP2 000004f7: SWAP1 000004f8: PUSH2 0x1b62 000004fb: JUMP 000004fc: JUMPDEST 000004fd: PUSH1 0x40 000004ff: MLOAD 00000500: DUP1 00000501: SWAP2 00000502: SUB 00000503: SWAP1 00000504: REVERT 00000505: JUMPDEST 00000506: POP 00000507: PUSH1 0x40 00000509: MLOAD 0000050a: PUSH32 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc 0000052b: CALLDATASIZE 0000052c: ADD 0000052d: PUSH1 0x04 0000052f: DUP3 00000530: CALLDATACOPY 00000531: DUP1 00000532: MLOAD 00000533: PUSH1 0xf8 00000535: SHR 00000536: PUSH4 0xdeadbeef 0000053b: ADD 0000053c: SLOAD 0000053d: PUSH0 0000053e: PUSH0 0000053f: PUSH32 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffb 00000560: CALLDATASIZE 00000561: ADD 00000562: PUSH1 0x01 00000564: DUP6 00000565: ADD 00000566: DUP5 00000567: GAS 00000568: DELEGATECALL 00000569: PUSH2 0x0574 0000056c: JUMPI 0000056d: RETURNDATASIZE 0000056e: PUSH0 0000056f: DUP4 00000570: RETURNDATACOPY 00000571: RETURNDATASIZE 00000572: DUP3 00000573: REVERT 00000574: JUMPDEST 00000575: POP 00000576: POP 00000577: JUMP 00000578: JUMPDEST 00000579: PUSH0 0000057a: SLOAD 0000057b: PUSH1 0x40 0000057d: DUP1 0000057e: MLOAD 0000057f: DUP1 00000580: DUP3 00000581: ADD 00000582: SWAP1 00000583: SWAP2 00000584: MSTORE 00000585: PUSH1 0x04 00000587: DUP2 00000588: MSTORE 00000589: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 000005aa: PUSH1 0x20 000005ac: DUP3 000005ad: ADD 000005ae: MSTORE 000005af: SWAP1 000005b0: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005c5: AND 000005c6: CALLER 000005c7: EQ 000005c8: PUSH2 0x05fe 000005cb: JUMPI 000005cc: PUSH1 0x40 000005ce: MLOAD 000005cf: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 000005f0: DUP2 000005f1: MSTORE 000005f2: PUSH1 0x04 000005f4: ADD 000005f5: PUSH2 0x04fc 000005f8: SWAP2 000005f9: SWAP1 000005fa: PUSH2 0x1b62 000005fd: JUMP 000005fe: JUMPDEST 000005ff: POP 00000600: PUSH2 0x0574 00000603: DUP3 00000604: DUP3 00000605: DUP1 00000606: DUP1 00000607: PUSH1 0x1f 00000609: ADD 0000060a: PUSH1 0x20 0000060c: DUP1 0000060d: SWAP2 0000060e: DIV 0000060f: MUL 00000610: PUSH1 0x20 00000612: ADD 00000613: PUSH1 0x40 00000615: MLOAD 00000616: SWAP1 00000617: DUP2 00000618: ADD 00000619: PUSH1 0x40 0000061b: MSTORE 0000061c: DUP1 0000061d: SWAP4 0000061e: SWAP3 0000061f: SWAP2 00000620: SWAP1 00000621: DUP2 00000622: DUP2 00000623: MSTORE 00000624: PUSH1 0x20 00000626: ADD 00000627: DUP4 00000628: DUP4 00000629: DUP1 0000062a: DUP3 0000062b: DUP5 0000062c: CALLDATACOPY 0000062d: PUSH0 0000062e: SWAP3 0000062f: ADD 00000630: SWAP2 00000631: SWAP1 00000632: SWAP2 00000633: MSTORE 00000634: POP 00000635: PUSH2 0x13c6 00000638: SWAP3 00000639: POP 0000063a: POP 0000063b: POP 0000063c: JUMP 0000063d: JUMPDEST 0000063e: PUSH0 0000063f: SLOAD 00000640: PUSH1 0x40 00000642: DUP1 00000643: MLOAD 00000644: DUP1 00000645: DUP3 00000646: ADD 00000647: SWAP1 00000648: SWAP2 00000649: MSTORE 0000064a: PUSH1 0x04 0000064c: DUP2 0000064d: MSTORE 0000064e: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 0000066f: PUSH1 0x20 00000671: DUP3 00000672: ADD 00000673: MSTORE 00000674: SWAP1 00000675: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000068a: AND 0000068b: CALLER 0000068c: EQ 0000068d: PUSH2 0x06c3 00000690: JUMPI 00000691: PUSH1 0x40 00000693: MLOAD 00000694: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 000006b5: DUP2 000006b6: MSTORE 000006b7: PUSH1 0x04 000006b9: ADD 000006ba: PUSH2 0x04fc 000006bd: SWAP2 000006be: SWAP1 000006bf: PUSH2 0x1b62 000006c2: JUMP 000006c3: JUMPDEST 000006c4: POP 000006c5: PUSH0 000006c6: DUP1 000006c7: SLOAD 000006c8: PUSH32 0xffffffffffffffffffffffff0000000000000000000000000000000000000000 000006e9: AND 000006ea: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006ff: SWAP3 00000700: SWAP1 00000701: SWAP3 00000702: AND 00000703: SWAP2 00000704: SWAP1 00000705: SWAP2 00000706: OR 00000707: SWAP1 00000708: SSTORE 00000709: JUMP 0000070a: JUMPDEST 0000070b: PUSH2 0x075a 0000070e: DUP5 0000070f: DUP5 00000710: DUP5 00000711: DUP5 00000712: PUSH32 0x6ce8eb472fa82df5469c6ab6d485f17c3ad13c8cd7af59b3d4a8026c5ce0f7e2 00000733: PUSH32 0x00000000000000000000000041ff9aa7e16b8b1a8a8dc4f0efacd93d02d071c9 00000754: PUSH1 0x60 00000756: PUSH2 0x1459 00000759: JUMP 0000075a: JUMPDEST 0000075b: POP 0000075c: POP 0000075d: POP 0000075e: POP 0000075f: JUMP 00000760: JUMPDEST 00000761: PUSH1 0x2b 00000763: DUP3 00000764: ADD 00000765: CALLDATALOAD 00000766: PUSH1 0xf8 00000768: SHR 00000769: PUSH1 0x02 0000076b: DUP2 0000076c: SWAP1 0000076d: SUB 0000076e: PUSH2 0x07c6 00000771: JUMPI 00000772: PUSH2 0x07c1 00000775: DUP6 00000776: DUP6 00000777: DUP6 00000778: DUP6 00000779: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 0000079a: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 000007bb: PUSH1 0x40 000007bd: PUSH2 0x1459 000007c0: JUMP 000007c1: JUMPDEST 000007c2: PUSH2 0x0884 000007c5: JUMP 000007c6: JUMPDEST 000007c7: DUP1 000007c8: PUSH1 0xff 000007ca: AND 000007cb: PUSH1 0x05 000007cd: SUB 000007ce: PUSH2 0x0821 000007d1: JUMPI 000007d2: PUSH2 0x07c1 000007d5: DUP6 000007d6: DUP6 000007d7: DUP6 000007d8: DUP6 000007d9: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 000007fa: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 0000081b: PUSH1 0x40 0000081d: PUSH2 0x1459 00000820: JUMP 00000821: JUMPDEST 00000822: PUSH1 0x40 00000824: DUP1 00000825: MLOAD 00000826: DUP1 00000827: DUP3 00000828: ADD 00000829: DUP3 0000082a: MSTORE 0000082b: PUSH1 0x04 0000082d: DUP1 0000082e: DUP3 0000082f: MSTORE 00000830: PUSH32 0x4d30323200000000000000000000000000000000000000000000000000000000 00000851: PUSH1 0x20 00000853: DUP4 00000854: ADD 00000855: MSTORE 00000856: SWAP2 00000857: MLOAD 00000858: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000879: DUP2 0000087a: MSTORE 0000087b: PUSH2 0x04fc 0000087e: SWAP3 0000087f: ADD 00000880: PUSH2 0x1b62 00000883: JUMP 00000884: JUMPDEST 00000885: POP 00000886: POP 00000887: POP 00000888: POP 00000889: POP 0000088a: JUMP 0000088b: JUMPDEST 0000088c: PUSH0 0000088d: SLOAD 0000088e: PUSH1 0x40 00000890: DUP1 00000891: MLOAD 00000892: DUP1 00000893: DUP3 00000894: ADD 00000895: SWAP1 00000896: SWAP2 00000897: MSTORE 00000898: PUSH1 0x04 0000089a: DUP2 0000089b: MSTORE 0000089c: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 000008bd: PUSH1 0x20 000008bf: DUP3 000008c0: ADD 000008c1: MSTORE 000008c2: SWAP1 000008c3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008d8: AND 000008d9: CALLER 000008da: EQ 000008db: PUSH2 0x0911 000008de: JUMPI 000008df: PUSH1 0x40 000008e1: MLOAD 000008e2: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000903: DUP2 00000904: MSTORE 00000905: PUSH1 0x04 00000907: ADD 00000908: PUSH2 0x04fc 0000090b: SWAP2 0000090c: SWAP1 0000090d: PUSH2 0x1b62 00000910: JUMP 00000911: JUMPDEST 00000912: POP 00000913: PUSH1 0x40 00000915: DUP1 00000916: MLOAD 00000917: DUP1 00000918: DUP3 00000919: ADD 0000091a: SWAP1 0000091b: SWAP2 0000091c: MSTORE 0000091d: PUSH1 0x04 0000091f: DUP2 00000920: MSTORE 00000921: PUSH32 0x4d30303500000000000000000000000000000000000000000000000000000000 00000942: PUSH1 0x20 00000944: DUP3 00000945: ADD 00000946: MSTORE 00000947: DUP4 00000948: DUP3 00000949: EQ 0000094a: PUSH2 0x0980 0000094d: JUMPI 0000094e: PUSH1 0x40 00000950: MLOAD 00000951: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000972: DUP2 00000973: MSTORE 00000974: PUSH1 0x04 00000976: ADD 00000977: PUSH2 0x04fc 0000097a: SWAP2 0000097b: SWAP1 0000097c: PUSH2 0x1b62 0000097f: JUMP 00000980: JUMPDEST 00000981: POP 00000982: PUSH0 00000983: JUMPDEST 00000984: DUP4 00000985: DUP2 00000986: LT 00000987: ISZERO 00000988: PUSH2 0x0884 0000098b: JUMPI 0000098c: PUSH2 0x0a1a 0000098f: DUP4 00000990: DUP4 00000991: DUP4 00000992: DUP2 00000993: DUP2 00000994: LT 00000995: PUSH2 0x09a0 00000998: JUMPI 00000999: PUSH2 0x09a0 0000099c: PUSH2 0x1bb5 0000099f: JUMP 000009a0: JUMPDEST 000009a1: SWAP1 000009a2: POP 000009a3: PUSH1 0x20 000009a5: MUL 000009a6: ADD 000009a7: PUSH1 0x20 000009a9: DUP2 000009aa: ADD 000009ab: SWAP1 000009ac: PUSH2 0x09b5 000009af: SWAP2 000009b0: SWAP1 000009b1: PUSH2 0x1986 000009b4: JUMP 000009b5: JUMPDEST 000009b6: PUSH32 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 000009d7: DUP8 000009d8: DUP8 000009d9: DUP6 000009da: DUP2 000009db: DUP2 000009dc: LT 000009dd: PUSH2 0x09e8 000009e0: JUMPI 000009e1: PUSH2 0x09e8 000009e4: PUSH2 0x1bb5 000009e7: JUMP 000009e8: JUMPDEST 000009e9: SWAP1 000009ea: POP 000009eb: PUSH1 0x20 000009ed: MUL 000009ee: ADD 000009ef: PUSH1 0x20 000009f1: DUP2 000009f2: ADD 000009f3: SWAP1 000009f4: PUSH2 0x09fd 000009f7: SWAP2 000009f8: SWAP1 000009f9: PUSH2 0x1986 000009fc: JUMP 000009fd: JUMPDEST 000009fe: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000a13: AND 00000a14: SWAP2 00000a15: SWAP1 00000a16: PUSH2 0x1671 00000a19: JUMP 00000a1a: JUMPDEST 00000a1b: PUSH1 0x01 00000a1d: ADD 00000a1e: PUSH2 0x0983 00000a21: JUMP 00000a22: JUMPDEST 00000a23: PUSH0 00000a24: SLOAD 00000a25: PUSH1 0x40 00000a27: DUP1 00000a28: MLOAD 00000a29: DUP1 00000a2a: DUP3 00000a2b: ADD 00000a2c: SWAP1 00000a2d: SWAP2 00000a2e: MSTORE 00000a2f: PUSH1 0x04 00000a31: DUP2 00000a32: MSTORE 00000a33: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 00000a54: PUSH1 0x20 00000a56: DUP3 00000a57: ADD 00000a58: MSTORE 00000a59: SWAP1 00000a5a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000a6f: AND 00000a70: CALLER 00000a71: EQ 00000a72: PUSH2 0x0aa8 00000a75: JUMPI 00000a76: PUSH1 0x40 00000a78: MLOAD 00000a79: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000a9a: DUP2 00000a9b: MSTORE 00000a9c: PUSH1 0x04 00000a9e: ADD 00000a9f: PUSH2 0x04fc 00000aa2: SWAP2 00000aa3: SWAP1 00000aa4: PUSH2 0x1b62 00000aa7: JUMP 00000aa8: JUMPDEST 00000aa9: POP 00000aaa: PUSH0 00000aab: JUMPDEST 00000aac: DUP2 00000aad: DUP2 00000aae: LT 00000aaf: ISZERO 00000ab0: PUSH2 0x0b38 00000ab3: JUMPI 00000ab4: PUSH0 00000ab5: PUSH1 0x03 00000ab7: PUSH0 00000ab8: DUP6 00000ab9: DUP6 00000aba: DUP6 00000abb: DUP2 00000abc: DUP2 00000abd: LT 00000abe: PUSH2 0x0ac9 00000ac1: JUMPI 00000ac2: PUSH2 0x0ac9 00000ac5: PUSH2 0x1bb5 00000ac8: JUMP 00000ac9: JUMPDEST 00000aca: SWAP1 00000acb: POP 00000acc: PUSH1 0x20 00000ace: MUL 00000acf: ADD 00000ad0: PUSH1 0x20 00000ad2: DUP2 00000ad3: ADD 00000ad4: SWAP1 00000ad5: PUSH2 0x0ade 00000ad8: SWAP2 00000ad9: SWAP1 00000ada: PUSH2 0x1986 00000add: JUMP 00000ade: JUMPDEST 00000adf: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000af4: AND 00000af5: DUP2 00000af6: MSTORE 00000af7: PUSH1 0x20 00000af9: DUP2 00000afa: ADD 00000afb: SWAP2 00000afc: SWAP1 00000afd: SWAP2 00000afe: MSTORE 00000aff: PUSH1 0x40 00000b01: ADD 00000b02: PUSH0 00000b03: KECCAK256 00000b04: DUP1 00000b05: SLOAD 00000b06: PUSH32 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00 00000b27: AND 00000b28: SWAP2 00000b29: ISZERO 00000b2a: ISZERO 00000b2b: SWAP2 00000b2c: SWAP1 00000b2d: SWAP2 00000b2e: OR 00000b2f: SWAP1 00000b30: SSTORE 00000b31: PUSH1 0x01 00000b33: ADD 00000b34: PUSH2 0x0aab 00000b37: JUMP 00000b38: JUMPDEST 00000b39: POP 00000b3a: POP 00000b3b: POP 00000b3c: JUMP 00000b3d: JUMPDEST 00000b3e: PUSH1 0x01 00000b40: SLOAD 00000b41: PUSH1 0x40 00000b43: DUP1 00000b44: MLOAD 00000b45: DUP1 00000b46: DUP3 00000b47: ADD 00000b48: SWAP1 00000b49: SWAP2 00000b4a: MSTORE 00000b4b: PUSH1 0x04 00000b4d: DUP2 00000b4e: MSTORE 00000b4f: PUSH32 0x4d30303300000000000000000000000000000000000000000000000000000000 00000b70: PUSH1 0x20 00000b72: DUP3 00000b73: ADD 00000b74: MSTORE 00000b75: SWAP1 00000b76: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000b8b: AND 00000b8c: CALLER 00000b8d: EQ 00000b8e: PUSH2 0x0bc4 00000b91: JUMPI 00000b92: PUSH1 0x40 00000b94: MLOAD 00000b95: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000bb6: DUP2 00000bb7: MSTORE 00000bb8: PUSH1 0x04 00000bba: ADD 00000bbb: PUSH2 0x04fc 00000bbe: SWAP2 00000bbf: SWAP1 00000bc0: PUSH2 0x1b62 00000bc3: JUMP 00000bc4: JUMPDEST 00000bc5: POP 00000bc6: PUSH0 00000bc7: DUP1 00000bc8: SLOAD 00000bc9: PUSH1 0x40 00000bcb: MLOAD 00000bcc: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000be1: SWAP1 00000be2: SWAP2 00000be3: AND 00000be4: SWAP1 00000be5: DUP4 00000be6: SWAP1 00000be7: JUMPDEST 00000be8: PUSH0 00000be9: PUSH1 0x40 00000beb: MLOAD 00000bec: DUP1 00000bed: DUP4 00000bee: SUB 00000bef: DUP2 00000bf0: DUP6 00000bf1: DUP8 00000bf2: GAS 00000bf3: CALL 00000bf4: SWAP3 00000bf5: POP 00000bf6: POP 00000bf7: POP 00000bf8: RETURNDATASIZE 00000bf9: DUP1 00000bfa: PUSH0 00000bfb: DUP2 00000bfc: EQ 00000bfd: PUSH2 0x0c21 00000c00: JUMPI 00000c01: PUSH1 0x40 00000c03: MLOAD 00000c04: SWAP2 00000c05: POP 00000c06: PUSH1 0x1f 00000c08: NOT 00000c09: PUSH1 0x3f 00000c0b: RETURNDATASIZE 00000c0c: ADD 00000c0d: AND 00000c0e: DUP3 00000c0f: ADD 00000c10: PUSH1 0x40 00000c12: MSTORE 00000c13: RETURNDATASIZE 00000c14: DUP3 00000c15: MSTORE 00000c16: RETURNDATASIZE 00000c17: PUSH0 00000c18: PUSH1 0x20 00000c1a: DUP5 00000c1b: ADD 00000c1c: RETURNDATACOPY 00000c1d: PUSH2 0x0c26 00000c20: JUMP 00000c21: JUMPDEST 00000c22: PUSH1 0x60 00000c24: SWAP2 00000c25: POP 00000c26: JUMPDEST 00000c27: POP 00000c28: POP 00000c29: SWAP1 00000c2a: POP 00000c2b: DUP1 00000c2c: PUSH1 0x40 00000c2e: MLOAD 00000c2f: DUP1 00000c30: PUSH1 0x40 00000c32: ADD 00000c33: PUSH1 0x40 00000c35: MSTORE 00000c36: DUP1 00000c37: PUSH1 0x04 00000c39: DUP2 00000c3a: MSTORE 00000c3b: PUSH1 0x20 00000c3d: ADD 00000c3e: PUSH32 0x4d30303400000000000000000000000000000000000000000000000000000000 00000c5f: DUP2 00000c60: MSTORE 00000c61: POP 00000c62: SWAP1 00000c63: PUSH2 0x0b38 00000c66: JUMPI 00000c67: PUSH1 0x40 00000c69: MLOAD 00000c6a: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000c8b: DUP2 00000c8c: MSTORE 00000c8d: PUSH1 0x04 00000c8f: ADD 00000c90: PUSH2 0x04fc 00000c93: SWAP2 00000c94: SWAP1 00000c95: PUSH2 0x1b62 00000c98: JUMP 00000c99: JUMPDEST 00000c9a: PUSH0 00000c9b: SLOAD 00000c9c: PUSH1 0x40 00000c9e: DUP1 00000c9f: MLOAD 00000ca0: DUP1 00000ca1: DUP3 00000ca2: ADD 00000ca3: SWAP1 00000ca4: SWAP2 00000ca5: MSTORE 00000ca6: PUSH1 0x04 00000ca8: DUP2 00000ca9: MSTORE 00000caa: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 00000ccb: PUSH1 0x20 00000ccd: DUP3 00000cce: ADD 00000ccf: MSTORE 00000cd0: SWAP1 00000cd1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000ce6: AND 00000ce7: CALLER 00000ce8: EQ 00000ce9: PUSH2 0x0d1f 00000cec: JUMPI 00000ced: PUSH1 0x40 00000cef: MLOAD 00000cf0: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000d11: DUP2 00000d12: MSTORE 00000d13: PUSH1 0x04 00000d15: ADD 00000d16: PUSH2 0x04fc 00000d19: SWAP2 00000d1a: SWAP1 00000d1b: PUSH2 0x1b62 00000d1e: JUMP 00000d1f: JUMPDEST 00000d20: POP 00000d21: PUSH4 0xdeadbeef 00000d26: SWAP1 00000d27: SWAP2 00000d28: ADD 00000d29: SSTORE 00000d2a: JUMP 00000d2b: JUMPDEST 00000d2c: PUSH0 00000d2d: SLOAD 00000d2e: PUSH1 0x40 00000d30: DUP1 00000d31: MLOAD 00000d32: DUP1 00000d33: DUP3 00000d34: ADD 00000d35: SWAP1 00000d36: SWAP2 00000d37: MSTORE 00000d38: PUSH1 0x04 00000d3a: DUP2 00000d3b: MSTORE 00000d3c: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 00000d5d: PUSH1 0x20 00000d5f: DUP3 00000d60: ADD 00000d61: MSTORE 00000d62: SWAP1 00000d63: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000d78: AND 00000d79: CALLER 00000d7a: EQ 00000d7b: PUSH2 0x0db1 00000d7e: JUMPI 00000d7f: PUSH1 0x40 00000d81: MLOAD 00000d82: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000da3: DUP2 00000da4: MSTORE 00000da5: PUSH1 0x04 00000da7: ADD 00000da8: PUSH2 0x04fc 00000dab: SWAP2 00000dac: SWAP1 00000dad: PUSH2 0x1b62 00000db0: JUMP 00000db1: JUMPDEST 00000db2: POP 00000db3: PUSH2 0x0574 00000db6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000dcb: DUP4 00000dcc: AND 00000dcd: CALLER 00000dce: DUP4 00000dcf: PUSH2 0x178b 00000dd2: JUMP 00000dd3: JUMPDEST 00000dd4: PUSH1 0x01 00000dd6: SLOAD 00000dd7: PUSH1 0x40 00000dd9: DUP1 00000dda: MLOAD 00000ddb: DUP1 00000ddc: DUP3 00000ddd: ADD 00000dde: SWAP1 00000ddf: SWAP2 00000de0: MSTORE 00000de1: PUSH1 0x04 00000de3: DUP2 00000de4: MSTORE 00000de5: PUSH32 0x4d30303300000000000000000000000000000000000000000000000000000000 00000e06: PUSH1 0x20 00000e08: DUP3 00000e09: ADD 00000e0a: MSTORE 00000e0b: SWAP1 00000e0c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000e21: AND 00000e22: CALLER 00000e23: EQ 00000e24: PUSH2 0x0e5a 00000e27: JUMPI 00000e28: PUSH1 0x40 00000e2a: MLOAD 00000e2b: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000e4c: DUP2 00000e4d: MSTORE 00000e4e: PUSH1 0x04 00000e50: ADD 00000e51: PUSH2 0x04fc 00000e54: SWAP2 00000e55: SWAP1 00000e56: PUSH2 0x1b62 00000e59: JUMP 00000e5a: JUMPDEST 00000e5b: POP 00000e5c: PUSH1 0x40 00000e5e: DUP1 00000e5f: MLOAD 00000e60: DUP1 00000e61: DUP3 00000e62: ADD 00000e63: SWAP1 00000e64: SWAP2 00000e65: MSTORE 00000e66: PUSH1 0x04 00000e68: DUP2 00000e69: MSTORE 00000e6a: PUSH32 0x4d30303500000000000000000000000000000000000000000000000000000000 00000e8b: PUSH1 0x20 00000e8d: DUP3 00000e8e: ADD 00000e8f: MSTORE 00000e90: DUP4 00000e91: DUP3 00000e92: EQ 00000e93: PUSH2 0x0ec9 00000e96: JUMPI 00000e97: PUSH1 0x40 00000e99: MLOAD 00000e9a: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000ebb: DUP2 00000ebc: MSTORE 00000ebd: PUSH1 0x04 00000ebf: ADD 00000ec0: PUSH2 0x04fc 00000ec3: SWAP2 00000ec4: SWAP1 00000ec5: PUSH2 0x1b62 00000ec8: JUMP 00000ec9: JUMPDEST 00000eca: POP 00000ecb: PUSH0 00000ecc: JUMPDEST 00000ecd: DUP4 00000ece: DUP2 00000ecf: LT 00000ed0: ISZERO 00000ed1: PUSH2 0x0884 00000ed4: JUMPI 00000ed5: PUSH0 00000ed6: SLOAD 00000ed7: PUSH2 0x0f4d 00000eda: SWAP1 00000edb: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000ef0: AND 00000ef1: DUP5 00000ef2: DUP5 00000ef3: DUP5 00000ef4: DUP2 00000ef5: DUP2 00000ef6: LT 00000ef7: PUSH2 0x0f02 00000efa: JUMPI 00000efb: PUSH2 0x0f02 00000efe: PUSH2 0x1bb5 00000f01: JUMP 00000f02: JUMPDEST 00000f03: SWAP1 00000f04: POP 00000f05: PUSH1 0x20 00000f07: MUL 00000f08: ADD 00000f09: CALLDATALOAD 00000f0a: DUP8 00000f0b: DUP8 00000f0c: DUP6 00000f0d: DUP2 00000f0e: DUP2 00000f0f: LT 00000f10: PUSH2 0x0f1b 00000f13: JUMPI 00000f14: PUSH2 0x0f1b 00000f17: PUSH2 0x1bb5 00000f1a: JUMP 00000f1b: JUMPDEST 00000f1c: SWAP1 00000f1d: POP 00000f1e: PUSH1 0x20 00000f20: MUL 00000f21: ADD 00000f22: PUSH1 0x20 00000f24: DUP2 00000f25: ADD 00000f26: SWAP1 00000f27: PUSH2 0x0f30 00000f2a: SWAP2 00000f2b: SWAP1 00000f2c: PUSH2 0x1986 00000f2f: JUMP 00000f30: JUMPDEST 00000f31: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000f46: AND 00000f47: SWAP2 00000f48: SWAP1 00000f49: PUSH2 0x178b 00000f4c: JUMP 00000f4d: JUMPDEST 00000f4e: PUSH1 0x01 00000f50: ADD 00000f51: PUSH2 0x0ecc 00000f54: JUMP 00000f55: JUMPDEST 00000f56: PUSH0 00000f57: SLOAD 00000f58: PUSH1 0x40 00000f5a: DUP1 00000f5b: MLOAD 00000f5c: DUP1 00000f5d: DUP3 00000f5e: ADD 00000f5f: SWAP1 00000f60: SWAP2 00000f61: MSTORE 00000f62: PUSH1 0x04 00000f64: DUP2 00000f65: MSTORE 00000f66: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 00000f87: PUSH1 0x20 00000f89: DUP3 00000f8a: ADD 00000f8b: MSTORE 00000f8c: SWAP1 00000f8d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000fa2: AND 00000fa3: CALLER 00000fa4: EQ 00000fa5: PUSH2 0x0fdb 00000fa8: JUMPI 00000fa9: PUSH1 0x40 00000fab: MLOAD 00000fac: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000fcd: DUP2 00000fce: MSTORE 00000fcf: PUSH1 0x04 00000fd1: ADD 00000fd2: PUSH2 0x04fc 00000fd5: SWAP2 00000fd6: SWAP1 00000fd7: PUSH2 0x1b62 00000fda: JUMP 00000fdb: JUMPDEST 00000fdc: POP 00000fdd: PUSH0 00000fde: CALLER 00000fdf: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000ff4: AND 00000ff5: DUP3 00000ff6: PUSH1 0x40 00000ff8: MLOAD 00000ff9: PUSH2 0x0be7 00000ffc: JUMP 00000ffd: JUMPDEST 00000ffe: PUSH0 00000fff: SLOAD 00001000: PUSH1 0x40 00001002: DUP1 00001003: MLOAD 00001004: DUP1 00001005: DUP3 00001006: ADD 00001007: SWAP1 00001008: SWAP2 00001009: MSTORE 0000100a: PUSH1 0x04 0000100c: DUP2 0000100d: MSTORE 0000100e: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 0000102f: PUSH1 0x20 00001031: DUP3 00001032: ADD 00001033: MSTORE 00001034: SWAP1 00001035: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000104a: AND 0000104b: CALLER 0000104c: EQ 0000104d: PUSH2 0x1083 00001050: JUMPI 00001051: PUSH1 0x40 00001053: MLOAD 00001054: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00001075: DUP2 00001076: MSTORE 00001077: PUSH1 0x04 00001079: ADD 0000107a: PUSH2 0x04fc 0000107d: SWAP2 0000107e: SWAP1 0000107f: PUSH2 0x1b62 00001082: JUMP 00001083: JUMPDEST 00001084: POP 00001085: PUSH1 0x01 00001087: DUP1 00001088: SLOAD 00001089: PUSH32 0xffffffffffffffffffffffff0000000000000000000000000000000000000000 000010aa: AND 000010ab: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000010c0: SWAP3 000010c1: SWAP1 000010c2: SWAP3 000010c3: AND 000010c4: SWAP2 000010c5: SWAP1 000010c6: SWAP2 000010c7: OR 000010c8: SWAP1 000010c9: SSTORE 000010ca: JUMP 000010cb: JUMPDEST 000010cc: PUSH0 000010cd: SLOAD 000010ce: PUSH1 0x40 000010d0: DUP1 000010d1: MLOAD 000010d2: DUP1 000010d3: DUP3 000010d4: ADD 000010d5: SWAP1 000010d6: SWAP2 000010d7: MSTORE 000010d8: PUSH1 0x04 000010da: DUP2 000010db: MSTORE 000010dc: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 000010fd: PUSH1 0x20 000010ff: DUP3 00001100: ADD 00001101: MSTORE 00001102: SWAP1 00001103: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00001118: AND 00001119: CALLER 0000111a: EQ 0000111b: PUSH2 0x1151 0000111e: JUMPI 0000111f: PUSH1 0x40 00001121: MLOAD 00001122: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00001143: DUP2 00001144: MSTORE 00001145: PUSH1 0x04 00001147: ADD 00001148: PUSH2 0x04fc 0000114b: SWAP2 0000114c: SWAP1 0000114d: PUSH2 0x1b62 00001150: JUMP 00001151: JUMPDEST 00001152: POP 00001153: PUSH0 00001154: JUMPDEST 00001155: DUP2 00001156: DUP2 00001157: LT 00001158: ISZERO 00001159: PUSH2 0x0b38 0000115c: JUMPI 0000115d: PUSH1 0x01 0000115f: PUSH1 0x03 00001161: PUSH0 00001162: DUP6 00001163: DUP6 00001164: DUP6 00001165: DUP2 00001166: DUP2 00001167: LT 00001168: PUSH2 0x1173 0000116b: JUMPI 0000116c: PUSH2 0x1173 0000116f: PUSH2 0x1bb5 00001172: JUMP 00001173: JUMPDEST 00001174: SWAP1 00001175: POP 00001176: PUSH1 0x20 00001178: MUL 00001179: ADD 0000117a: PUSH1 0x20 0000117c: DUP2 0000117d: ADD 0000117e: SWAP1 0000117f: PUSH2 0x1188 00001182: SWAP2 00001183: SWAP1 00001184: PUSH2 0x1986 00001187: JUMP 00001188: JUMPDEST 00001189: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000119e: AND 0000119f: DUP2 000011a0: MSTORE 000011a1: PUSH1 0x20 000011a3: DUP2 000011a4: ADD 000011a5: SWAP2 000011a6: SWAP1 000011a7: SWAP2 000011a8: MSTORE 000011a9: PUSH1 0x40 000011ab: ADD 000011ac: PUSH0 000011ad: KECCAK256 000011ae: DUP1 000011af: SLOAD 000011b0: PUSH32 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00 000011d1: AND 000011d2: SWAP2 000011d3: ISZERO 000011d4: ISZERO 000011d5: SWAP2 000011d6: SWAP1 000011d7: SWAP2 000011d8: OR 000011d9: SWAP1 000011da: SSTORE 000011db: PUSH1 0x01 000011dd: ADD 000011de: PUSH2 0x1154 000011e1: JUMP 000011e2: JUMPDEST 000011e3: PUSH0 000011e4: SLOAD 000011e5: PUSH1 0x40 000011e7: DUP1 000011e8: MLOAD 000011e9: DUP1 000011ea: DUP3 000011eb: ADD 000011ec: SWAP1 000011ed: SWAP2 000011ee: MSTORE 000011ef: PUSH1 0x04 000011f1: DUP2 000011f2: MSTORE 000011f3: PUSH32 0x4d30303100000000000000000000000000000000000000000000000000000000 00001214: PUSH1 0x20 00001216: DUP3 00001217: ADD 00001218: MSTORE 00001219: SWAP1 0000121a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000122f: AND 00001230: CALLER 00001231: EQ 00001232: PUSH2 0x1268 00001235: JUMPI 00001236: PUSH1 0x40 00001238: MLOAD 00001239: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 0000125a: DUP2 0000125b: MSTORE 0000125c: PUSH1 0x04 0000125e: ADD 0000125f: PUSH2 0x04fc 00001262: SWAP2 00001263: SWAP1 00001264: PUSH2 0x1b62 00001267: JUMP 00001268: JUMPDEST 00001269: POP 0000126a: PUSH1 0x02 0000126c: DUP1 0000126d: SLOAD 0000126e: PUSH32 0xffffffffffffffffffffffff0000000000000000000000000000000000000000 0000128f: AND 00001290: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000012a5: SWAP3 000012a6: SWAP1 000012a7: SWAP3 000012a8: AND 000012a9: SWAP2 000012aa: SWAP1 000012ab: SWAP2 000012ac: OR 000012ad: SWAP1 000012ae: SSTORE 000012af: JUMP 000012b0: JUMPDEST 000012b1: PUSH1 0x2b 000012b3: DUP3 000012b4: ADD 000012b5: CALLDATALOAD 000012b6: PUSH1 0xf8 000012b8: SHR 000012b9: PUSH0 000012ba: DUP2 000012bb: SWAP1 000012bc: SUB 000012bd: PUSH2 0x1310 000012c0: JUMPI 000012c1: PUSH2 0x07c1 000012c4: DUP6 000012c5: DUP6 000012c6: DUP6 000012c7: DUP6 000012c8: PUSH32 0xe34f199b19b2b4f47f68442619d555527d244f78a3297ea89325f843f87b8b54 000012e9: PUSH32 0x0000000000000000000000001f98431c8ad98523631ae4a59f267346ea31f984 0000130a: PUSH1 0x60 0000130c: PUSH2 0x1459 0000130f: JUMP 00001310: JUMPDEST 00001311: DUP1 00001312: PUSH1 0xff 00001314: AND 00001315: PUSH1 0x03 00001317: SUB 00001318: PUSH2 0x136b 0000131b: JUMPI 0000131c: PUSH2 0x07c1 0000131f: DUP6 00001320: DUP6 00001321: DUP6 00001322: DUP6 00001323: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 00001344: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 00001365: PUSH1 0x60 00001367: PUSH2 0x1459 0000136a: JUMP 0000136b: JUMPDEST 0000136c: DUP1 0000136d: PUSH1 0xff 0000136f: AND 00001370: PUSH1 0x04 00001372: SUB 00001373: PUSH2 0x0821 00001376: JUMPI 00001377: PUSH2 0x07c1 0000137a: DUP6 0000137b: DUP6 0000137c: DUP6 0000137d: DUP6 0000137e: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 0000139f: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000000 000013c0: PUSH1 0x60 000013c2: PUSH2 0x1459 000013c5: JUMP 000013c6: JUMPDEST 000013c7: PUSH0 000013c8: JUMPDEST 000013c9: DUP2 000013ca: MLOAD 000013cb: DUP2 000013cc: LT 000013cd: ISZERO 000013ce: PUSH2 0x0574 000013d1: JUMPI 000013d2: PUSH0 000013d3: PUSH2 0x13dc 000013d6: DUP4 000013d7: DUP4 000013d8: PUSH2 0x17c9 000013db: JUMP 000013dc: JUMPDEST 000013dd: SWAP1 000013de: POP 000013df: PUSH0 000013e0: PUSH2 0x13f6 000013e3: DUP5 000013e4: PUSH2 0x13ee 000013e7: DUP6 000013e8: PUSH1 0x14 000013ea: PUSH2 0x1be2 000013ed: JUMP 000013ee: JUMPDEST 000013ef: ADD 000013f0: PUSH1 0x20 000013f2: ADD 000013f3: MLOAD 000013f4: SWAP1 000013f5: JUMP 000013f6: JUMPDEST 000013f7: SWAP1 000013f8: POP 000013f9: PUSH0 000013fa: PUSH2 0x1408 000013fd: DUP6 000013fe: PUSH2 0x13ee 00001401: DUP7 00001402: PUSH1 0x34 00001404: PUSH2 0x1be2 00001407: JUMP 00001408: JUMPDEST 00001409: SWAP1 0000140a: POP 0000140b: PUSH0 0000140c: PUSH2 0x1421 0000140f: DUP7 00001410: PUSH2 0x141a 00001413: DUP8 00001414: PUSH1 0x54 00001416: PUSH2 0x1be2 00001419: JUMP 0000141a: JUMPDEST 0000141b: ADD 0000141c: PUSH1 0x20 0000141e: ADD 0000141f: SWAP1 00001420: JUMP 00001421: JUMPDEST 00001422: SWAP1 00001423: POP 00001424: PUSH0 00001425: PUSH0 00001426: DUP4 00001427: DUP4 00001428: DUP7 00001429: DUP9 0000142a: PUSH2 0x1388 0000142d: GAS 0000142e: SUB 0000142f: CALL 00001430: DUP1 00001431: PUSH2 0x1438 00001434: JUMPI 00001435: PUSH0 00001436: PUSH0 00001437: REVERT 00001438: JUMPDEST 00001439: POP 0000143a: PUSH2 0x1444 0000143d: DUP3 0000143e: PUSH1 0x54 00001440: PUSH2 0x1be2 00001443: JUMP 00001444: JUMPDEST 00001445: PUSH2 0x144e 00001448: SWAP1 00001449: DUP7 0000144a: PUSH2 0x1be2 0000144d: JUMP 0000144e: JUMPDEST 0000144f: SWAP5 00001450: POP 00001451: POP 00001452: POP 00001453: POP 00001454: POP 00001455: PUSH2 0x13c8 00001458: JUMP 00001459: JUMPDEST 0000145a: PUSH1 0x40 0000145c: MLOAD 0000145d: DUP6 0000145e: CALLDATALOAD 0000145f: PUSH1 0x60 00001461: SWAP1 00001462: DUP2 00001463: SHR 00001464: SWAP2 00001465: PUSH1 0x14 00001467: DUP9 00001468: ADD 00001469: CALLDATALOAD 0000146a: SWAP1 0000146b: SWAP2 0000146c: SHR 0000146d: SWAP1 0000146e: PUSH1 0x28 00001470: DUP9 00001471: ADD 00001472: CALLDATALOAD 00001473: PUSH1 0xe8 00001475: SHR 00001476: SWAP1 00001477: PUSH1 0x2c 00001479: DUP10 0000147a: ADD 0000147b: CALLDATALOAD 0000147c: PUSH1 0xf8 0000147e: SHR 0000147f: SWAP1 00001480: PUSH0 00001481: SWAP1 00001482: DUP5 00001483: DUP7 00001484: LT 00001485: PUSH1 0x01 00001487: DUP2 00001488: EQ 00001489: PUSH2 0x149a 0000148c: JUMPI 0000148d: DUP6 0000148e: DUP3 0000148f: MSTORE 00001490: DUP7 00001491: PUSH1 0x20 00001493: DUP4 00001494: ADD 00001495: MSTORE 00001496: PUSH2 0x14a4 00001499: JUMP 0000149a: JUMPDEST 0000149b: DUP7 0000149c: DUP3 0000149d: MSTORE 0000149e: DUP6 0000149f: PUSH1 0x20 000014a1: DUP4 000014a2: ADD 000014a3: MSTORE 000014a4: JUMPDEST 000014a5: POP 000014a6: PUSH1 0x60 000014a8: DUP8 000014a9: SUB 000014aa: PUSH2 0x14b4 000014ad: JUMPI 000014ae: DUP4 000014af: PUSH1 0x40 000014b1: DUP3 000014b2: ADD 000014b3: MSTORE 000014b4: JUMPDEST 000014b5: DUP7 000014b6: DUP2 000014b7: KECCAK256 000014b8: PUSH32 0xff00000000000000000000000000000000000000000000000000000000000000 000014d9: DUP3 000014da: MSTORE 000014db: PUSH1 0x60 000014dd: DUP10 000014de: SWAP1 000014df: SHL 000014e0: PUSH1 0x01 000014e2: DUP4 000014e3: ADD 000014e4: MSTORE 000014e5: PUSH1 0x15 000014e7: DUP3 000014e8: ADD 000014e9: MSTORE 000014ea: PUSH1 0x35 000014ec: DUP2 000014ed: ADD 000014ee: DUP10 000014ef: SWAP1 000014f0: MSTORE 000014f1: PUSH1 0x55 000014f3: SWAP1 000014f4: KECCAK256 000014f5: PUSH1 0x40 000014f7: DUP1 000014f8: MLOAD 000014f9: DUP1 000014fa: DUP3 000014fb: ADD 000014fc: SWAP1 000014fd: SWAP2 000014fe: MSTORE 000014ff: PUSH1 0x04 00001501: DUP2 00001502: MSTORE 00001503: PUSH32 0x4d30313100000000000000000000000000000000000000000000000000000000 00001524: PUSH1 0x20 00001526: DUP3 00001527: ADD 00001528: MSTORE 00001529: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000153e: SWAP1 0000153f: SWAP2 00001540: AND 00001541: SWAP2 00001542: POP 00001543: CALLER 00001544: DUP3 00001545: EQ 00001546: PUSH2 0x157c 00001549: JUMPI 0000154a: PUSH1 0x40 0000154c: MLOAD 0000154d: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 0000156e: DUP2 0000156f: MSTORE 00001570: PUSH1 0x04 00001572: ADD 00001573: PUSH2 0x04fc 00001576: SWAP2 00001577: SWAP1 00001578: PUSH2 0x1b62 0000157b: JUMP 0000157c: JUMPDEST 0000157d: POP 0000157e: PUSH0 0000157f: PUSH0 00001580: DUP14 00001581: SGT 00001582: PUSH2 0x158b 00001585: JUMPI 00001586: DUP12 00001587: PUSH2 0x158d 0000158a: JUMP 0000158b: JUMPDEST 0000158c: DUP13 0000158d: JUMPDEST 0000158e: SWAP1 0000158f: POP 00001590: DUP3 00001591: ISZERO 00001592: PUSH2 0x161a 00001595: JUMPI 00001596: PUSH4 0xdeadbeef 0000159b: PUSH1 0x2d 0000159d: DUP13 0000159e: ADD 0000159f: CALLDATALOAD 000015a0: PUSH1 0xf8 000015a2: SHR 000015a3: ADD 000015a4: SLOAD 000015a5: PUSH1 0x40 000015a7: MLOAD 000015a8: PUSH32 0x39f8530600000000000000000000000000000000000000000000000000000000 000015c9: DUP2 000015ca: MSTORE 000015cb: PUSH1 0x2e 000015cd: DUP14 000015ce: ADD 000015cf: SWAP2 000015d0: SWAP1 000015d1: PUSH32 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd2 000015f2: DUP14 000015f3: ADD 000015f4: DUP1 000015f5: DUP5 000015f6: PUSH1 0x04 000015f8: DUP5 000015f9: ADD 000015fa: CALLDATACOPY 000015fb: PUSH0 000015fc: PUSH0 000015fd: PUSH1 0x04 000015ff: DUP4 00001600: ADD 00001601: DUP5 00001602: DUP7 00001603: GAS 00001604: DELEGATECALL 00001605: PUSH2 0x1615 00001608: JUMPI 00001609: PUSH1 0x40 0000160b: MLOAD 0000160c: SWAP4 0000160d: POP 0000160e: RETURNDATASIZE 0000160f: PUSH0 00001610: DUP6 00001611: RETURNDATACOPY 00001612: RETURNDATASIZE 00001613: DUP5 00001614: REVERT 00001615: JUMPDEST 00001616: POP 00001617: POP 00001618: POP 00001619: POP 0000161a: JUMPDEST 0000161b: PUSH1 0x40 0000161d: MLOAD 0000161e: PUSH32 0xa9059cbb00000000000000000000000000000000000000000000000000000000 0000163f: DUP2 00001640: MSTORE 00001641: DUP3 00001642: PUSH1 0x04 00001644: DUP3 00001645: ADD 00001646: MSTORE 00001647: DUP2 00001648: PUSH1 0x24 0000164a: DUP3 0000164b: ADD 0000164c: MSTORE 0000164d: PUSH0 0000164e: PUSH0 0000164f: PUSH1 0x44 00001651: DUP4 00001652: PUSH0 00001653: DUP12 00001654: GAS 00001655: CALL 00001656: PUSH2 0x1661 00001659: JUMPI 0000165a: RETURNDATASIZE 0000165b: PUSH0 0000165c: DUP3 0000165d: RETURNDATACOPY 0000165e: RETURNDATASIZE 0000165f: DUP2 00001660: REVERT 00001661: JUMPDEST 00001662: POP 00001663: POP 00001664: POP 00001665: POP 00001666: POP 00001667: POP 00001668: POP 00001669: POP 0000166a: POP 0000166b: POP 0000166c: POP 0000166d: POP 0000166e: POP 0000166f: POP 00001670: JUMP 00001671: JUMPDEST 00001672: PUSH1 0x40 00001674: DUP1 00001675: MLOAD 00001676: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000168b: DUP5 0000168c: AND 0000168d: PUSH1 0x24 0000168f: DUP3 00001690: ADD 00001691: MSTORE 00001692: PUSH1 0x44 00001694: DUP1 00001695: DUP3 00001696: ADD 00001697: DUP5 00001698: SWAP1 00001699: MSTORE 0000169a: DUP3 0000169b: MLOAD 0000169c: DUP1 0000169d: DUP4 0000169e: SUB 0000169f: SWAP1 000016a0: SWAP2 000016a1: ADD 000016a2: DUP2 000016a3: MSTORE 000016a4: PUSH1 0x64 000016a6: SWAP1 000016a7: SWAP2 000016a8: ADD 000016a9: SWAP1 000016aa: SWAP2 000016ab: MSTORE 000016ac: PUSH1 0x20 000016ae: DUP2 000016af: ADD 000016b0: DUP1 000016b1: MLOAD 000016b2: PUSH28 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff 000016cf: AND 000016d0: PUSH32 0x095ea7b300000000000000000000000000000000000000000000000000000000 000016f1: OR 000016f2: SWAP1 000016f3: MSTORE 000016f4: PUSH2 0x16fd 000016f7: DUP5 000016f8: DUP3 000016f9: PUSH2 0x17e3 000016fc: JUMP 000016fd: JUMPDEST 000016fe: PUSH2 0x075a 00001701: JUMPI 00001702: PUSH1 0x40 00001704: MLOAD 00001705: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000171a: DUP5 0000171b: DUP2 0000171c: AND 0000171d: PUSH1 0x24 0000171f: DUP4 00001720: ADD 00001721: MSTORE 00001722: PUSH0 00001723: PUSH1 0x44 00001725: DUP4 00001726: ADD 00001727: MSTORE 00001728: PUSH2 0x1781 0000172b: SWAP2 0000172c: DUP7 0000172d: SWAP2 0000172e: DUP3 0000172f: AND 00001730: SWAP1 00001731: PUSH4 0x095ea7b3 00001736: SWAP1 00001737: PUSH1 0x64 00001739: ADD 0000173a: JUMPDEST 0000173b: PUSH1 0x40 0000173d: MLOAD 0000173e: PUSH1 0x20 00001740: DUP2 00001741: DUP4 00001742: SUB 00001743: SUB 00001744: DUP2 00001745: MSTORE 00001746: SWAP1 00001747: PUSH1 0x40 00001749: MSTORE 0000174a: SWAP2 0000174b: POP 0000174c: PUSH1 0xe0 0000174e: SHL 0000174f: PUSH1 0x20 00001751: DUP3 00001752: ADD 00001753: DUP1 00001754: MLOAD 00001755: PUSH28 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff 00001772: DUP4 00001773: DUP2 00001774: DUP4 00001775: AND 00001776: OR 00001777: DUP4 00001778: MSTORE 00001779: POP 0000177a: POP 0000177b: POP 0000177c: POP 0000177d: PUSH2 0x183b 00001780: JUMP 00001781: JUMPDEST 00001782: PUSH2 0x075a 00001785: DUP5 00001786: DUP3 00001787: PUSH2 0x183b 0000178a: JUMP 0000178b: JUMPDEST 0000178c: PUSH1 0x40 0000178e: MLOAD 0000178f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000017a4: DUP4 000017a5: DUP2 000017a6: AND 000017a7: PUSH1 0x24 000017a9: DUP4 000017aa: ADD 000017ab: MSTORE 000017ac: PUSH1 0x44 000017ae: DUP3 000017af: ADD 000017b0: DUP4 000017b1: SWAP1 000017b2: MSTORE 000017b3: PUSH2 0x0b38 000017b6: SWAP2 000017b7: DUP6 000017b8: SWAP2 000017b9: DUP3 000017ba: AND 000017bb: SWAP1 000017bc: PUSH4 0xa9059cbb 000017c1: SWAP1 000017c2: PUSH1 0x64 000017c4: ADD 000017c5: PUSH2 0x173a 000017c8: JUMP 000017c9: JUMPDEST 000017ca: PUSH0 000017cb: PUSH0 000017cc: PUSH2 0x17d8 000017cf: DUP5 000017d0: DUP5 000017d1: ADD 000017d2: PUSH1 0x20 000017d4: ADD 000017d5: MLOAD 000017d6: SWAP1 000017d7: JUMP 000017d8: JUMPDEST 000017d9: PUSH1 0x60 000017db: SHR 000017dc: SWAP5 000017dd: SWAP4 000017de: POP 000017df: POP 000017e0: POP 000017e1: POP 000017e2: JUMP 000017e3: JUMPDEST 000017e4: PUSH0 000017e5: PUSH0 000017e6: PUSH0 000017e7: PUSH0 000017e8: PUSH1 0x20 000017ea: PUSH0 000017eb: DUP7 000017ec: MLOAD 000017ed: PUSH1 0x20 000017ef: DUP9 000017f0: ADD 000017f1: PUSH0 000017f2: DUP11 000017f3: GAS 000017f4: CALL 000017f5: SWAP3 000017f6: POP 000017f7: RETURNDATASIZE 000017f8: SWAP2 000017f9: POP 000017fa: PUSH0 000017fb: MLOAD 000017fc: SWAP1 000017fd: POP 000017fe: DUP3 000017ff: DUP1 00001800: ISZERO 00001801: PUSH2 0x182f 00001804: JUMPI 00001805: POP 00001806: DUP2 00001807: ISZERO 00001808: PUSH2 0x1814 0000180b: JUMPI 0000180c: DUP1 0000180d: PUSH1 0x01 0000180f: EQ 00001810: PUSH2 0x182f 00001813: JUMP 00001814: JUMPDEST 00001815: PUSH0 00001816: DUP7 00001817: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000182c: AND 0000182d: EXTCODESIZE 0000182e: GT 0000182f: JUMPDEST 00001830: SWAP4 00001831: POP 00001832: POP 00001833: POP 00001834: POP 00001835: JUMPDEST 00001836: SWAP3 00001837: SWAP2 00001838: POP 00001839: POP 0000183a: JUMP 0000183b: JUMPDEST 0000183c: PUSH0 0000183d: PUSH0 0000183e: PUSH1 0x20 00001840: PUSH0 00001841: DUP5 00001842: MLOAD 00001843: PUSH1 0x20 00001845: DUP7 00001846: ADD 00001847: PUSH0 00001848: DUP9 00001849: GAS 0000184a: CALL 0000184b: DUP1 0000184c: PUSH2 0x185a 0000184f: JUMPI 00001850: PUSH1 0x40 00001852: MLOAD 00001853: RETURNDATASIZE 00001854: PUSH0 00001855: DUP3 00001856: RETURNDATACOPY 00001857: RETURNDATASIZE 00001858: DUP2 00001859: REVERT 0000185a: JUMPDEST 0000185b: POP 0000185c: POP 0000185d: PUSH0 0000185e: MLOAD 0000185f: RETURNDATASIZE 00001860: SWAP2 00001861: POP 00001862: DUP2 00001863: ISZERO 00001864: PUSH2 0x1871 00001867: JUMPI 00001868: DUP1 00001869: PUSH1 0x01 0000186b: EQ 0000186c: ISZERO 0000186d: PUSH2 0x188b 00001870: JUMP 00001871: JUMPDEST 00001872: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00001887: DUP5 00001888: AND 00001889: EXTCODESIZE 0000188a: ISZERO 0000188b: JUMPDEST 0000188c: ISZERO 0000188d: PUSH2 0x075a 00001890: JUMPI 00001891: PUSH1 0x40 00001893: MLOAD 00001894: PUSH32 0x5274afe700000000000000000000000000000000000000000000000000000000 000018b5: DUP2 000018b6: MSTORE 000018b7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000018cc: DUP6 000018cd: AND 000018ce: PUSH1 0x04 000018d0: DUP3 000018d1: ADD 000018d2: MSTORE 000018d3: PUSH1 0x24 000018d5: ADD 000018d6: PUSH2 0x04fc 000018d9: JUMP 000018da: JUMPDEST 000018db: PUSH0 000018dc: PUSH0 000018dd: DUP4 000018de: PUSH1 0x1f 000018e0: DUP5 000018e1: ADD 000018e2: SLT 000018e3: PUSH2 0x18ea 000018e6: JUMPI 000018e7: PUSH0 000018e8: PUSH0 000018e9: REVERT 000018ea: JUMPDEST 000018eb: POP 000018ec: DUP2 000018ed: CALLDATALOAD 000018ee: PUSH8 0xffffffffffffffff 000018f7: DUP2 000018f8: GT 000018f9: ISZERO 000018fa: PUSH2 0x1901 000018fd: JUMPI 000018fe: PUSH0 000018ff: PUSH0 00001900: REVERT 00001901: JUMPDEST 00001902: PUSH1 0x20 00001904: DUP4 00001905: ADD 00001906: SWAP2 00001907: POP 00001908: DUP4 00001909: PUSH1 0x20 0000190b: DUP3 0000190c: DUP6 0000190d: ADD 0000190e: ADD 0000190f: GT 00001910: ISZERO 00001911: PUSH2 0x1918 00001914: JUMPI 00001915: PUSH0 00001916: PUSH0 00001917: REVERT 00001918: JUMPDEST 00001919: SWAP3 0000191a: POP 0000191b: SWAP3 0000191c: SWAP1 0000191d: POP 0000191e: JUMP 0000191f: JUMPDEST 00001920: PUSH0 00001921: PUSH0 00001922: PUSH1 0x20 00001924: DUP4 00001925: DUP6 00001926: SUB 00001927: SLT 00001928: ISZERO 00001929: PUSH2 0x1930 0000192c: JUMPI 0000192d: PUSH0 0000192e: PUSH0 0000192f: REVERT 00001930: JUMPDEST 00001931: DUP3 00001932: CALLDATALOAD 00001933: PUSH8 0xffffffffffffffff 0000193c: DUP2 0000193d: GT 0000193e: ISZERO 0000193f: PUSH2 0x1946 00001942: JUMPI 00001943: PUSH0 00001944: PUSH0 00001945: REVERT 00001946: JUMPDEST 00001947: PUSH2 0x1952 0000194a: DUP6 0000194b: DUP3 0000194c: DUP7 0000194d: ADD 0000194e: PUSH2 0x18da 00001951: JUMP 00001952: JUMPDEST 00001953: SWAP1 00001954: SWAP7 00001955: SWAP1 00001956: SWAP6 00001957: POP 00001958: SWAP4 00001959: POP 0000195a: POP 0000195b: POP 0000195c: POP 0000195d: JUMP 0000195e: JUMPDEST 0000195f: DUP1 00001960: CALLDATALOAD 00001961: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00001976: DUP2 00001977: AND 00001978: DUP2 00001979: EQ 0000197a: PUSH2 0x1981 0000197d: JUMPI 0000197e: PUSH0 0000197f: PUSH0 00001980: REVERT 00001981: JUMPDEST 00001982: SWAP2 00001983: SWAP1 00001984: POP 00001985: JUMP 00001986: JUMPDEST 00001987: PUSH0 00001988: PUSH1 0x20 0000198a: DUP3 0000198b: DUP5 0000198c: SUB 0000198d: SLT 0000198e: ISZERO 0000198f: PUSH2 0x1996 00001992: JUMPI 00001993: PUSH0 00001994: PUSH0 00001995: REVERT 00001996: JUMPDEST 00001997: PUSH2 0x199f 0000199a: DUP3 0000199b: PUSH2 0x195e 0000199e: JUMP 0000199f: JUMPDEST 000019a0: SWAP4 000019a1: SWAP3 000019a2: POP 000019a3: POP 000019a4: POP 000019a5: JUMP 000019a6: JUMPDEST 000019a7: DUP1 000019a8: CALLDATALOAD 000019a9: PUSH1 0xff 000019ab: DUP2 000019ac: AND 000019ad: DUP2 000019ae: EQ 000019af: PUSH2 0x1981 000019b2: JUMPI 000019b3: PUSH0 000019b4: PUSH0 000019b5: REVERT 000019b6: JUMPDEST 000019b7: PUSH0 000019b8: PUSH1 0x20 000019ba: DUP3 000019bb: DUP5 000019bc: SUB 000019bd: SLT 000019be: ISZERO 000019bf: PUSH2 0x19c6 000019c2: JUMPI 000019c3: PUSH0 000019c4: PUSH0 000019c5: REVERT 000019c6: JUMPDEST 000019c7: PUSH2 0x199f 000019ca: DUP3 000019cb: PUSH2 0x19a6 000019ce: JUMP 000019cf: JUMPDEST 000019d0: PUSH0 000019d1: PUSH0 000019d2: PUSH0 000019d3: PUSH0 000019d4: PUSH1 0x60 000019d6: DUP6 000019d7: DUP8 000019d8: SUB 000019d9: SLT 000019da: ISZERO 000019db: PUSH2 0x19e2 000019de: JUMPI 000019df: PUSH0 000019e0: PUSH0 000019e1: REVERT 000019e2: JUMPDEST 000019e3: DUP5 000019e4: CALLDATALOAD 000019e5: SWAP4 000019e6: POP 000019e7: PUSH1 0x20 000019e9: DUP6 000019ea: ADD 000019eb: CALLDATALOAD 000019ec: SWAP3 000019ed: POP 000019ee: PUSH1 0x40 000019f0: DUP6 000019f1: ADD 000019f2: CALLDATALOAD 000019f3: PUSH8 0xffffffffffffffff 000019fc: DUP2 000019fd: GT 000019fe: ISZERO 000019ff: PUSH2 0x1a06 00001a02: JUMPI 00001a03: PUSH0 00001a04: PUSH0 00001a05: REVERT 00001a06: JUMPDEST 00001a07: PUSH2 0x1a12 00001a0a: DUP8 00001a0b: DUP3 00001a0c: DUP9 00001a0d: ADD 00001a0e: PUSH2 0x18da 00001a11: JUMP 00001a12: JUMPDEST 00001a13: SWAP6 00001a14: SWAP9 00001a15: SWAP5 00001a16: SWAP8 00001a17: POP 00001a18: SWAP6 00001a19: POP 00001a1a: POP 00001a1b: POP 00001a1c: POP 00001a1d: JUMP 00001a1e: JUMPDEST 00001a1f: PUSH0 00001a20: PUSH0 00001a21: DUP4 00001a22: PUSH1 0x1f 00001a24: DUP5 00001a25: ADD 00001a26: SLT 00001a27: PUSH2 0x1a2e 00001a2a: JUMPI 00001a2b: PUSH0 00001a2c: PUSH0 00001a2d: REVERT 00001a2e: JUMPDEST 00001a2f: POP 00001a30: DUP2 00001a31: CALLDATALOAD 00001a32: PUSH8 0xffffffffffffffff 00001a3b: DUP2 00001a3c: GT 00001a3d: ISZERO 00001a3e: PUSH2 0x1a45 00001a41: JUMPI 00001a42: PUSH0 00001a43: PUSH0 00001a44: REVERT 00001a45: JUMPDEST 00001a46: PUSH1 0x20 00001a48: DUP4 00001a49: ADD 00001a4a: SWAP2 00001a4b: POP 00001a4c: DUP4 00001a4d: PUSH1 0x20 00001a4f: DUP3 00001a50: PUSH1 0x05 00001a52: SHL 00001a53: DUP6 00001a54: ADD 00001a55: ADD 00001a56: GT 00001a57: ISZERO 00001a58: PUSH2 0x1918 00001a5b: JUMPI 00001a5c: PUSH0 00001a5d: PUSH0 00001a5e: REVERT 00001a5f: JUMPDEST 00001a60: PUSH0 00001a61: PUSH0 00001a62: PUSH0 00001a63: PUSH0 00001a64: PUSH1 0x40 00001a66: DUP6 00001a67: DUP8 00001a68: SUB 00001a69: SLT 00001a6a: ISZERO 00001a6b: PUSH2 0x1a72 00001a6e: JUMPI 00001a6f: PUSH0 00001a70: PUSH0 00001a71: REVERT 00001a72: JUMPDEST 00001a73: DUP5 00001a74: CALLDATALOAD 00001a75: PUSH8 0xffffffffffffffff 00001a7e: DUP2 00001a7f: GT 00001a80: ISZERO 00001a81: PUSH2 0x1a88 00001a84: JUMPI 00001a85: PUSH0 00001a86: PUSH0 00001a87: REVERT 00001a88: JUMPDEST 00001a89: PUSH2 0x1a94 00001a8c: DUP8 00001a8d: DUP3 00001a8e: DUP9 00001a8f: ADD 00001a90: PUSH2 0x1a1e 00001a93: JUMP 00001a94: JUMPDEST 00001a95: SWAP1 00001a96: SWAP6 00001a97: POP 00001a98: SWAP4 00001a99: POP 00001a9a: POP 00001a9b: PUSH1 0x20 00001a9d: DUP6 00001a9e: ADD 00001a9f: CALLDATALOAD 00001aa0: PUSH8 0xffffffffffffffff 00001aa9: DUP2 00001aaa: GT 00001aab: ISZERO 00001aac: PUSH2 0x1ab3 00001aaf: JUMPI 00001ab0: PUSH0 00001ab1: PUSH0 00001ab2: REVERT 00001ab3: JUMPDEST 00001ab4: PUSH2 0x1a12 00001ab7: DUP8 00001ab8: DUP3 00001ab9: DUP9 00001aba: ADD 00001abb: PUSH2 0x1a1e 00001abe: JUMP 00001abf: JUMPDEST 00001ac0: PUSH0 00001ac1: PUSH0 00001ac2: PUSH1 0x20 00001ac4: DUP4 00001ac5: DUP6 00001ac6: SUB 00001ac7: SLT 00001ac8: ISZERO 00001ac9: PUSH2 0x1ad0 00001acc: JUMPI 00001acd: PUSH0 00001ace: PUSH0 00001acf: REVERT 00001ad0: JUMPDEST 00001ad1: DUP3 00001ad2: CALLDATALOAD 00001ad3: PUSH8 0xffffffffffffffff 00001adc: DUP2 00001add: GT 00001ade: ISZERO 00001adf: PUSH2 0x1ae6 00001ae2: JUMPI 00001ae3: PUSH0 00001ae4: PUSH0 00001ae5: REVERT 00001ae6: JUMPDEST 00001ae7: PUSH2 0x1952 00001aea: DUP6 00001aeb: DUP3 00001aec: DUP7 00001aed: ADD 00001aee: PUSH2 0x1a1e 00001af1: JUMP 00001af2: JUMPDEST 00001af3: PUSH0 00001af4: PUSH1 0x20 00001af6: DUP3 00001af7: DUP5 00001af8: SUB 00001af9: SLT 00001afa: ISZERO 00001afb: PUSH2 0x1b02 00001afe: JUMPI 00001aff: PUSH0 00001b00: PUSH0 00001b01: REVERT 00001b02: JUMPDEST 00001b03: POP 00001b04: CALLDATALOAD 00001b05: SWAP2 00001b06: SWAP1 00001b07: POP 00001b08: JUMP 00001b09: JUMPDEST 00001b0a: PUSH0 00001b0b: PUSH0 00001b0c: PUSH1 0x40 00001b0e: DUP4 00001b0f: DUP6 00001b10: SUB 00001b11: SLT 00001b12: ISZERO 00001b13: PUSH2 0x1b1a 00001b16: JUMPI 00001b17: PUSH0 00001b18: PUSH0 00001b19: REVERT 00001b1a: JUMPDEST 00001b1b: PUSH2 0x1b23 00001b1e: DUP4 00001b1f: PUSH2 0x19a6 00001b22: JUMP 00001b23: JUMPDEST 00001b24: SWAP2 00001b25: POP 00001b26: PUSH2 0x1b31 00001b29: PUSH1 0x20 00001b2b: DUP5 00001b2c: ADD 00001b2d: PUSH2 0x195e 00001b30: JUMP 00001b31: JUMPDEST 00001b32: SWAP1 00001b33: POP 00001b34: SWAP3 00001b35: POP 00001b36: SWAP3 00001b37: SWAP1 00001b38: POP 00001b39: JUMP 00001b3a: JUMPDEST 00001b3b: PUSH0 00001b3c: PUSH0 00001b3d: PUSH1 0x40 00001b3f: DUP4 00001b40: DUP6 00001b41: SUB 00001b42: SLT 00001b43: ISZERO 00001b44: PUSH2 0x1b4b 00001b47: JUMPI 00001b48: PUSH0 00001b49: PUSH0 00001b4a: REVERT 00001b4b: JUMPDEST 00001b4c: PUSH2 0x1b54 00001b4f: DUP4 00001b50: PUSH2 0x195e 00001b53: JUMP 00001b54: JUMPDEST 00001b55: SWAP5 00001b56: PUSH1 0x20 00001b58: SWAP4 00001b59: SWAP1 00001b5a: SWAP4 00001b5b: ADD 00001b5c: CALLDATALOAD 00001b5d: SWAP4 00001b5e: POP 00001b5f: POP 00001b60: POP 00001b61: JUMP 00001b62: JUMPDEST 00001b63: PUSH1 0x20 00001b65: DUP2 00001b66: MSTORE 00001b67: PUSH0 00001b68: DUP3 00001b69: MLOAD 00001b6a: DUP1 00001b6b: PUSH1 0x20 00001b6d: DUP5 00001b6e: ADD 00001b6f: MSTORE 00001b70: DUP1 00001b71: PUSH1 0x20 00001b73: DUP6 00001b74: ADD 00001b75: PUSH1 0x40 00001b77: DUP6 00001b78: ADD 00001b79: MCOPY 00001b7a: PUSH0 00001b7b: PUSH1 0x40 00001b7d: DUP3 00001b7e: DUP6 00001b7f: ADD 00001b80: ADD 00001b81: MSTORE 00001b82: PUSH1 0x40 00001b84: PUSH32 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0 00001ba5: PUSH1 0x1f 00001ba7: DUP4 00001ba8: ADD 00001ba9: AND 00001baa: DUP5 00001bab: ADD 00001bac: ADD 00001bad: SWAP2 00001bae: POP 00001baf: POP 00001bb0: SWAP3 00001bb1: SWAP2 00001bb2: POP 00001bb3: POP 00001bb4: JUMP 00001bb5: JUMPDEST 00001bb6: PUSH32 0x4e487b7100000000000000000000000000000000000000000000000000000000 00001bd7: PUSH0 00001bd8: MSTORE 00001bd9: PUSH1 0x32 00001bdb: PUSH1 0x04 00001bdd: MSTORE 00001bde: PUSH1 0x24 00001be0: PUSH0 00001be1: REVERT 00001be2: JUMPDEST 00001be3: DUP1 00001be4: DUP3 00001be5: ADD 00001be6: DUP1 00001be7: DUP3 00001be8: GT 00001be9: ISZERO 00001bea: PUSH2 0x1835 00001bed: JUMPI 00001bee: PUSH32 0x4e487b7100000000000000000000000000000000000000000000000000000000 00001c0f: PUSH0 00001c10: MSTORE 00001c11: PUSH1 0x11 00001c13: PUSH1 0x04 00001c15: MSTORE 00001c16: PUSH1 0x24 00001c18: PUSH0 00001c19: REVERT
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | upgradeability | detector | Untrusted DELEGATECALL target reachable | 70 | no | no |
viewtrace_id: 0x2aa65b095bfc33dac00f2f85a8231ba7744834f583bb4ee85c09a4b9d2790e03
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "unknown",
"attempts": 192,
"trace_id": "0x2aa65b095bfc33dac00f2f85a8231ba7744834f583bb4ee85c09a4b9d2790e03",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": null,
"matched_probe": null,
"target_varies": null,
"classification": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xeed2f252",
"selector": "0xeed2f252",
"calldata_variants": [
"0xeed2f252",
"0xeed2f2520000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf08a0323",
"selector": "0xf08a0323",
"calldata_variants": [
"0xf08a0323",
"0xf08a03230000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfa461e33",
"selector": "0xfa461e33",
"calldata_variants": [
"0xfa461e33",
"0xfa461e330000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc311d049",
"selector": "0xc311d049",
"calldata_variants": [
"0xc311d049",
"0xc311d0490000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd0ebdbe7",
"selector": "0xd0ebdbe7",
"calldata_variants": [
"0xd0ebdbe7",
"0xd0ebdbe70000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd34628cc",
"selector": "0xd34628cc",
"calldata_variants": [
"0xd34628cc",
"0xd34628cc0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x9e281a98",
"selector": "0x9e281a98",
"calldata_variants": [
"0x9e281a98",
"0x9e281a980000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xbdb25d0e",
"selector": "0xbdb25d0e",
"calldata_variants": [
"0xbdb25d0e",
"0xbdb25d0e0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 383,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
},
{
"pc": 1384,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
},
{
"pc": 5636,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [],
"delegatecall_count": 3,
"untrusted_delegatecall_count": 3
}
|
| high | other | detector | Untrusted CALL target/value reachable | 60 | no | no |
viewtrace_id: 0x36809841de1a32aefaa5f2924d02eb080070fd982f811da3b617fe525a4a68fd
call_targets:
0xa000016d11e045500240e2dfb9938c226e8a873c
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x36809841de1a32aefaa5f2924d02eb080070fd982f811da3b617fe525a4a68fd",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xa000016d11e045500240e2dfb9938c226e8a873c"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xeed2f252",
"selector": "0xeed2f252",
"calldata_variants": [
"0xeed2f252",
"0xeed2f2520000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf08a0323",
"selector": "0xf08a0323",
"calldata_variants": [
"0xf08a0323",
"0xf08a03230000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfa461e33",
"selector": "0xfa461e33",
"calldata_variants": [
"0xfa461e33",
"0xfa461e330000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc311d049",
"selector": "0xc311d049",
"calldata_variants": [
"0xc311d049",
"0xc311d0490000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd0ebdbe7",
"selector": "0xd0ebdbe7",
"calldata_variants": [
"0xd0ebdbe7",
"0xd0ebdbe70000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd34628cc",
"selector": "0xd34628cc",
"calldata_variants": [
"0xd34628cc",
"0xd34628cc0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x9e281a98",
"selector": "0x9e281a98",
"calldata_variants": [
"0x9e281a98",
"0x9e281a980000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xbdb25d0e",
"selector": "0xbdb25d0e",
"calldata_variants": [
"0xbdb25d0e",
"0xbdb25d0e0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 3059,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 5167,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 5717,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 5,
"guards_detected": [],
"untrusted_call_count": 4
}
|
| high | other | detector | ETH value transfer possible | 55 | no | no |
viewtrace_id: 0x36809841de1a32aefaa5f2924d02eb080070fd982f811da3b617fe525a4a68fd
call_targets:
0xa000016d11e045500240e2dfb9938c226e8a873c
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x36809841de1a32aefaa5f2924d02eb080070fd982f811da3b617fe525a4a68fd",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xa000016d11e045500240e2dfb9938c226e8a873c"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xeed2f252",
"selector": "0xeed2f252",
"calldata_variants": [
"0xeed2f252",
"0xeed2f2520000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf08a0323",
"selector": "0xf08a0323",
"calldata_variants": [
"0xf08a0323",
"0xf08a03230000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfa461e33",
"selector": "0xfa461e33",
"calldata_variants": [
"0xfa461e33",
"0xfa461e330000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc311d049",
"selector": "0xc311d049",
"calldata_variants": [
"0xc311d049",
"0xc311d0490000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd0ebdbe7",
"selector": "0xd0ebdbe7",
"calldata_variants": [
"0xd0ebdbe7",
"0xd0ebdbe70000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd34628cc",
"selector": "0xd34628cc",
"calldata_variants": [
"0xd34628cc",
"0xd34628cc0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x9e281a98",
"selector": "0x9e281a98",
"calldata_variants": [
"0x9e281a98",
"0x9e281a980000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xbdb25d0e",
"selector": "0xbdb25d0e",
"calldata_variants": [
"0xbdb25d0e",
"0xbdb25d0e0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 3059,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 5167,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 5717,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 3,
"guards_detected": []
}
|
| medium | upgradeability | cast | DELEGATECALL present | 80 | no | — |
viewevidence_json{
"notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
"delegatecall_count": 3
}
|