TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

3302e046-95b4-466a-9ffe-62781b651cd7

complete
Chain ID
1
Address
0xb7a1515069f54a5a92dd4ce68e9d43f3dca230e3
Block Number
—
Created
Fri, Jan 2, 2026 2:49 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract
Confirmed
0
Validated
0
Source
Bytecode only
Review Backing
Not yet
Best current signal
Untrusted CALL target/value reachable
crit 0 high 0 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
31264 report.consolidate complete 1 / 1 3 months ago
110582 artifact.fetch complete 1 / 3 1 week ago
110583 tool.cast_disasm complete 1 / 3 1 week ago
110584 analysis.bundle complete 1 / 3 1 week ago
110585 capability.graph complete 1 / 3 1 week ago
110586 detector.run complete 1 / 3 1 week ago
110587 validation.fork complete 1 / 3 1 week ago

Artifact

Runtime bytecode: available
Creation TX: —
Deployer: —
Proxy: no
Implementation:
—
Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate
Job Status
complete
Attempts
1 / 1
Findings
0
No findings?
yes
Summary
No concrete, exploitable value extraction path identified from the provided runtime bytecode; state-changing calls are gated by owner/resonateContract checks and no unsafe external call targets or upgrade hooks are exposed.
View stderr 
[codex:428597] OpenAI Codex v0.77.0 (research preview)
[codex:428597] --------
[codex:428597] workdir: /tmp/codex-multi-7u01mfce
[codex:428597] model: gpt-5.2-codex
[codex:428597] provider: openai
[codex:428597] approval: never
[codex:428597] sandbox: read-only
[codex:428597] reasoning effort: xhigh
[codex:428597] reasoning summaries: auto
[codex:428597] session id: 019b7f24-ef6a-72d1-b134-e80e166c5712
[codex:428597] --------
[codex:428597] user
[codex:428597] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:428597] 
[codex:428597] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:428597] 
[codex:428597] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:428597] - Gas inefficiency, code quality, or best practices
[codex:428597] - Theoretical vulnerabilities without a clear extraction path
[codex:428597] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:428597] - Issues requiring social engineering or off-chain coordination
[codex:428597] 
[codex:428597] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:428597] - CALL/DELEGATECALL with controllable destination or calldata
[codex:428597] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:428597] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:428597] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:428597] - External calls before state updates (reentrancy)
[codex:428597] - SELFDESTRUCT with controllable beneficiary
[codex:428597] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:428597] 
[codex:428597] For each finding, you MUST explain:
[codex:428597] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:428597] 2. The concrete sequence of transactions to extract value
[codex:428597] 3. Why you believe this is exploitable (not just suspicious)
[codex:428597] 
[codex:428597] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:428597] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:428597] 
[codex:428597] Output MUST be valid JSON matching the provided schema.
[codex:428597] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:428597] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:428597] mcp startup: no servers
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Preparing to read BYTECODE_BUNDLE.txt**
[codex:428597] exec
[codex:428597] /bin/bash -lc ls in /tmp/codex-multi-7u01mfce succeeded in 5ms:
[codex:428597] BYTECODE_BUNDLE.txt
[codex:428597] codex-output-schema.json
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Reading file contents**
[codex:428597] exec
[codex:428597] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-7u01mfce succeeded in 5ms:
[codex:428597] Runtime bytecode bundle for best-effort auditing.
[codex:428597] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:428597] 
[codex:428597] FILE: runtime_bytecode.hex
[codex:428597] 0x6080604052600436106100295760003560e01c806381bac14f1461002b578063b7760c8f14610072575b005b34801561003757600080fd5b5061005e6004803603602081101561004e57600080fd5b50356001600160a01b031661009e565b604080519115158252519081900360200190f35b61005e6004803603604081101561008857600080fd5b50803590602001356001600160a01b0316610168565b600080546001600160a01b031633146100f5576040805162461bcd60e51b81526020600482015260146024820152732fb7bbb732b910109e9036b9b39739b2b73232b960611b604482015290519081900360640190fd5b6001546001600160a01b031615610144576040805162461bcd60e51b815260206004820152600e60248201526d17dc9bdbdd081b9bdd081b9d5b1b60921b604482015290519081900360640190fd5b600180546001600160a01b0319166001600160a01b03939093169290921790915590565b6001546000906001600160a01b031633146101ca576040805162461bcd60e51b815260206004820152601f60248201527f6d73672e73656e64657220213d205f7265736f6e617465436f6e747261637400604482015290519081900360640190fd5b6040516001600160a01b0383169084156108fc029085906000818181858888f19350505050158015610200573d6000803e3d6000fd5b506001939250505056fea265627a7a72315820aec9d8d1e64d679b97a59f4996c5e3fb412fb57c249c1dc69c4b6262fef7406664736f6c634300050c0032
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Analyzing bytecode structure and function behavior**
[codex:428597] 
[codex:428597] I'm examining the provided bytecode to identify function selectors and understand their arguments, flow, and revert reasons. The two main functions appear to handle address inputs with owner checks and state updates. I’m carefully interpreting the byte patterns to deduce the internal logic, including error strings and storage slot usage, to clarify their roles and identify any security implications.
[codex:428597] exec
[codex:428597] /bin/bash -lc "python - <<'PY'
[codex:428597] from eth_utils import decode_hex
[codex:428597] import sys
[codex:428597] code=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex\\n')[1].strip()
[codex:428597] if code.startswith('0x'): code=code[2:]
[codex:428597] # simple opcode map
[codex:428597] opcodes={
[codex:428597] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:428597] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:428597] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:428597] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:428597] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:428597] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:428597] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:428597] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:428597] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:428597] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:428597] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:428597] }
[codex:428597] 
[codex:428597] code_bytes=bytes.fromhex(code)
[codex:428597] 
[codex:428597] o=0
[codex:428597] while o<len(code_bytes):
[codex:428597]     op=code_bytes[o]
[codex:428597]     name=opcodes.get(op,f'OP{op:02x}')
[codex:428597]     if name.startswith('PUSH'):
[codex:428597]         n=int(name[4:])
[codex:428597]         data=code_bytes[o+1:o+1+n]
[codex:428597]         print(f'{o:04x}: {name} 0x{data.hex()}')
[codex:428597]         o+=1+n
[codex:428597]     else:
[codex:428597]         print(f'{o:04x}: {name}')
[codex:428597]         o+=1
[codex:428597] PY" in /tmp/codex-multi-7u01mfce succeeded in 228ms:
[codex:428597] 0000: PUSH1 0x80
[codex:428597] 0002: PUSH1 0x40
[codex:428597] 0004: MSTORE
[codex:428597] 0005: PUSH1 0x04
[codex:428597] 0007: CALLDATASIZE
[codex:428597] 0008: LT
[codex:428597] 0009: PUSH2 0x0029
[codex:428597] 000c: JUMPI
[codex:428597] 000d: PUSH1 0x00
[codex:428597] 000f: CALLDATALOAD
[codex:428597] 0010: PUSH1 0xe0
[codex:428597] 0012: SHR
[codex:428597] 0013: DUP1
[codex:428597] 0014: PUSH4 0x81bac14f
[codex:428597] 0019: EQ
[codex:428597] 001a: PUSH2 0x002b
[codex:428597] 001d: JUMPI
[codex:428597] 001e: DUP1
[codex:428597] 001f: PUSH4 0xb7760c8f
[codex:428597] 0024: EQ
[codex:428597] 
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Analyzing internal function call and argument handling**
[codex:428597] thinking
[codex:428597] **Preparing symbolic stack simulation for argument tracking**
[codex:428597] exec
[codex:428597] /bin/bash -lc "python - <<'PY'
[codex:428597] # Symbolic stack trace from 0x0168 to 0x01ea
[codex:428597] code_hex=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex\\n')[1].strip()
[codex:428597] if code_hex.startswith('0x'): code_hex=code_hex[2:]
[codex:428597] code=bytes.fromhex(code_hex)
[codex:428597] 
[codex:428597] # Define ops for the relevant range only
[codex:428597] start=0x0168
[codex:428597] end=0x01ea+1
[codex:428597] 
[codex:428597] # decode opcodes
[codex:428597] opnames={
[codex:428597] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:428597] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:428597] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:428597] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:428597] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:428597] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:428597] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:428597] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:428597] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:428597] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:428597] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:428597] }
[codex:428597] 
[codex:428597] # symbolic stack
[codex:428597] stack=['RET','A','B']  # assume entry stack at 0x0168
[codex:428597] 
[codex:428597] pc=start
[codex:428597] 
[codex:428597] # map for pushes to symbolic values
[codex:428597] push_counter=0
[codex:428597] 
[codex:428597] while pc<end:
[codex:428597]     op=code[pc]
[codex:428597]     name=opnames.get(op,f'OP{op:02x}')
[codex:428597]     pc+=1
[codex:428597]     if name.startswith('PUSH'):
[codex:428597]         n=int(name[4:])
[codex:428597]         data=code[pc:pc+n]
[codex:428597]         pc+=n
[codex:428597]         # symbolize push with literal
[codex:428597]         val='0x'+data.hex()
[codex:428597]         stack.append(val)
[codex:428597]         # print
[codex:428597]         #print(name,val,stack)
[codex:428597]         continue
[codex:428597]     if name.startswith('DUP'):
[codex:428597]         n=int(name[3:])
[codex:428597]         stack.append(stack[-n])
[codex:428597]     elif name.startswith('SWAP'):
[codex:428597]         n=int(name[4:])
[codex:428597]         stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:428597]     elif name in ('POP',):
[codex:428597]         stack.pop()
[codex:428597]     elif name in ('SLOAD','CALLER','MLOAD','CALLDATASIZE','CALLDATALOAD','GAS','ADDRESS','BALANCE','ORIGIN','EXTCODESIZE','EXTCODEHASH','RETURNDATASIZE','CODESIZE'):
[codex:428597]         # consume appropriate inputs? For simplification
[codex:428597]         if name=='SLOAD':
[codex:428597]             key=stack.pop()
[codex:428597]             stack.append(f'SLOAD({key})')
[codex:428597]         elif name=='CALLER':
[codex:428597]             stack.append('CALLER')
[codex:428597]         elif name=='MLOAD':
[codex:428597]             key=stack.pop(); stack.append(f'MLOAD({key})')
[codex:428597]         elif name=='CALLDATALOAD':
[codex:428597]             key=stack.pop(); stack.append(f'CALLDATALOAD({key})')
[codex:428597]         elif name=='CALLDATASIZE':
[codex:428597]             stack.append('CALLDATASIZE')
[codex:428597]         elif name=='RETURNDATASIZE':
[codex:428597]             stack.append('RETURNDATASIZE')
[codex:428597]         elif name=='GAS':
[codex:428597]             stack.append('GAS')
[codex:428597]         else:
[codex:428597]             stack.append(name)
[codex:428597]     elif name in ('ADD','SUB','MUL','DIV','AND','OR','EQ','LT','GT','SHL','SHR','ISZERO'):
[codex:428597]         a=stack.pop(); b=stack.pop()
[codex:428597]         stack.append(f'({b} {name} {a})')
[codex:428597]     elif name=='CALL':
[codex:428597]         # CALL consumes 7 args: gas, to, value, in_offset, in_size, out_offset, out_size
[codex:428597]         args=[stack.pop() for _ in range(7)]
[codex:428597]         args=args[::-1]
[codex:428597]         stack.append(f'CALL{args}')
[codex:428597]     elif name in ('JUMP','JUMPI'):
[codex:428597]         # just show stack
[codex:428597]         pass
[codex:428597]     elif name in ('REVERT','RETURN'):
[codex:428597]         pass
[codex:428597]     elif name=='MSTORE':
[codex:428597]         val=stack.pop(); offset=stack.pop()
[codex:428597]         # no push
[codex:428597]     elif name=='MSTORE8':
[codex:428597]         val=stack.pop(); offset=stack.pop()
[codex:428597]     else:
[codex:428597]         # ignore others
[codex:428597]         pass
[codex:428597] 
[codex:428597] print('Final stack at pc',hex(pc),stack)
[codex:428597] PY" in /tmp/codex-multi-7u01mfce succeeded in 18ms:
[codex:428597] Final stack at pc 0x1eb ['RET', 'A', 'B', '0x00', '((SLOAD(0x01) AND (0x01 SUB (0x01 SHL 0xa0))) EQ CALLER)', '0x01ca', '((MLOAD(0x40) SUB MLOAD(0x40)) ADD 0x64)', 'MLOAD(0x40)', '((MLOAD(0x40) ISZERO 0x01ca) MUL 0x08fc)', '((SLOAD(0x01) AND (0x01 SUB (0x01 SHL 0xa0))) EQ CALLER)', '((0x01 SUB (0x01 SHL 0xa0)) AND ((MLOAD(0x40) SUB MLOAD(0x40)) ADD 0x64))', "CALL['0x00', '((0x01 SUB (0x01 SHL 0xa0)) AND ((MLOAD(0x40) SUB MLOAD(0x40)) ADD 0x64))', '0x00', '((0x01 SUB (0x01 SHL 0xa0)) AND ((MLOAD(0x40) SUB MLOAD(0x40)) ADD 0x64))', '((SLOAD(0x01) AND (0x01 SUB (0x01 SHL 0xa0))) EQ CALLER)', 'MLOAD(0x40)', '((MLOAD(0x40) ISZERO 0x01ca) MUL 0x08fc)']"]
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Simulating symbolic execution with path constraints**
[codex:428597] 
[codex:428597] I’m noticing the symbolic tracing missed handling JUMPI’s stack effects and path jumps, which skews the results. To fix this, I’ll implement a step-by-step manual symbolic executor following the path that passes the caller check by jumping to 0x01ca. I’ll track the stack precisely, simulate instruction semantics including JUMPI’s stack pops, and skip the revert branch by directing the program counter to the jump destination. This more focused simulation should give meaningful results.
[codex:428597] exec
[codex:428597] /bin/bash -lc "python - <<'PY'
[codex:428597] code_hex=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex\\n')[1].strip()
[codex:428597] if code_hex.startswith('0x'): code_hex=code_hex[2:]
[codex:428597] code=bytes.fromhex(code_hex)
[codex:428597] 
[codex:428597] # opcode lengths
[codex:428597] opnames={
[codex:428597] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:428597] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:428597] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:428597] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:428597] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:428597] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:428597] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:428597] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:428597] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:428597] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:428597] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:428597] }
[codex:428597] 
[codex:428597] # symbolic stack
[codex:428597] stack=['RET','A','B']
[codex:428597] mem={}
[codex:428597] 
[codex:428597] pc=0x0168
[codex:428597] 
[codex:428597] # helper
[codex:428597] 
[codex:428597] def pop():
[codex:428597]     return stack.pop()
[codex:428597] 
[codex:428597] def push(v):
[codex:428597]     stack.append(v)
[codex:428597] 
[codex:428597] # run until CALL
[codex:428597] while True:
[codex:428597]     op=code[pc]
[codex:428597]     name=opnames.get(op,f'OP{op:02x}')
[codex:428597]     pc+=1
[codex:428597]     if name.startswith('PUSH'):
[codex:428597]         n=int(name[4:])
[codex:428597]         data=code[pc:pc+n]
[codex:428597]         pc+=n
[codex:428597]         push('0x'+data.hex())
[codex:428597]     elif name.startswith('DUP'):
[codex:428597]         n=int(name[3:]); push(stack[-n])
[codex:428597]     elif name.startswith('SWAP'):
[codex:428597]         n=int(name[4:]); stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:428597]     elif name=='POP':
[codex:428597]         pop()
[codex:428597]     elif name=='SLOAD':
[codex:428597]         key=pop(); push(f'SLOAD({key})')
[codex:428597]     elif name=='CALLER':
[codex:428597]         push('CALLER')
[codex:428597]     elif name=='MLOAD':
[codex:428597]         key=pop(); push(f'MLOAD({key})')
[codex:428597]     elif name=='MSTORE':
[codex:428597]         val=pop(); offset=pop(); mem[offset]=val
[codex:428597]     elif name in ('ADD','SUB','MUL','DIV','AND','OR','EQ','LT','GT','SHL','SHR','ISZERO'):
[codex:428597]         a=pop(); b=pop(); push(f'({b} {name} {a})')
[codex:428597]     elif name=='JUMPI':
[codex:428597]         dest=pop(); cond=pop()
[codex:428597]         # force jump to dest (assume cond true)
[codex:428597]         pc=int(dest,16)
[codex:428597]     elif name=='JUMP':
[codex:428597]         dest=pop(); pc=int(dest,16)
[codex:428597]     elif name=='CALL':
[codex:428597]         # pop 7 args
[codex:428597]         args=[pop() for _ in range(7)][::-1]
[codex:428597]         push(f'CALL{args}')
[codex:428597]         # stop after call for analysis
[codex:428597]         print('CALL args:', args)
[codex:428597]         print('Stack at CALL:', stack)
[codex:428597]         break
[codex:428597]     else:
[codex:428597]         # ignore other ops
[codex:428597]         pass
[codex:428597] 
[codex:428597] print('Done at pc',hex(pc))
[codex:428597] PY" in /tmp/codex-multi-7u01mfce succeeded in 21ms:
[codex:428597] CALL args: ['0x00', '((0x01 SUB (0x01 SHL 0xa0)) AND B)', '0x00', '((0x01 SUB (0x01 SHL 0xa0)) AND B)', 'RET', '0x00', '((MLOAD(0x40) ISZERO A) MUL 0x08fc)']
[codex:428597] Stack at CALL: ['RET', 'A', 'B', '0x00', '((MLOAD(0x40) ISZERO A) MUL 0x08fc)', 'RET', '((0x01 SUB (0x01 SHL 0xa0)) AND B)', "CALL['0x00', '((0x01 SUB (0x01 SHL 0xa0)) AND B)', '0x00', '((0x01 SUB (0x01 SHL 0xa0)) AND B)', 'RET', '0x00', '((MLOAD(0x40) ISZERO A) MUL 0x08fc)']"]
[codex:428597] Done at pc 0x1eb
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Analyzing CALL argument construction**
[codex:428597] 
[codex:428597] I'm carefully stepping through the EVM instructions from 0x0168 to 0x01ea to manually reconstruct the stack and trace how CALL's seven arguments are assembled, because the earlier simulation seems off—especially the gas and value ordering. I want to model the stack symbolically with precise op semantics, including memory loads, to understand where the mismatch happens and to produce an accurate symbolic execution of this call sequence.
[codex:428597] exec
[codex:428597] /bin/bash -lc "python - <<'PY'
[codex:428597] code_hex=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex\\n')[1].strip()
[codex:428597] if code_hex.startswith('0x'): code_hex=code_hex[2:]
[codex:428597] code=bytes.fromhex(code_hex)
[codex:428597] 
[codex:428597] opnames={
[codex:428597] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:428597] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:428597] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:428597] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:428597] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:428597] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:428597] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:428597] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:428597] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:428597] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:428597] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:428597] }
[codex:428597] 
[codex:428597] # symbolic stack and memory
[codex:428597] stack=['RET','A','B']
[codex:428597] mem={'0x40':'M40'}
[codex:428597] 
[codex:428597] pc=0x0168
[codex:428597] 
[codex:428597] step=0
[codex:428597] 
[codex:428597] # function to format stack
[codex:428597] 
[codex:428597] def show():
[codex:428597]     return '['+', '.join(stack)+']'
[codex:428597] 
[codex:428597] while True:
[codex:428597]     op=code[pc]
[codex:428597]     name=opnames.get(op,f'OP{op:02x}')
[codex:428597]     pc+=1
[codex:428597]     # print step
[codex:428597]     # print(f'{pc-1:04x}: {name} stack {show()}')
[codex:428597]     if name.startswith('PUSH'):
[codex:428597]         n=int(name[4:])
[codex:428597]         data=code[pc:pc+n]
[codex:428597]         pc+=n
[codex:428597]         stack.append('0x'+data.hex())
[codex:428597]     elif name.startswith('DUP'):
[codex:428597]         n=int(name[3:])
[codex:428597]         stack.append(stack[-n])
[codex:428597]     elif name.startswith('SWAP'):
[codex:428597]         n=int(name[4:])
[codex:428597]         stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:428597]     elif name=='POP':
[codex:428597]         stack.pop()
[codex:428597]     elif name=='SLOAD':
[codex:428597]         key=stack.pop(); stack.append(f'SLOAD({key})')
[codex:428597]     elif name=='CALLER':
[codex:428597]         stack.append('CALLER')
[codex:428597]     elif name=='MLOAD':
[codex:428597]         key=stack.pop(); stack.append(f'MLOAD({key})')
[codex:428597]     elif name=='MSTORE':
[codex:428597]         val=stack.pop(); offset=stack.pop(); mem[offset]=val
[codex:428597]     elif name=='ISZERO':
[codex:428597]         a=stack.pop(); stack.append(f'ISZERO({a})')
[codex:428597]     elif name in ('ADD','SUB','MUL','DIV','AND','OR','EQ','LT','GT','SHL','SHR'):
[codex:428597]         a=stack.pop(); b=stack.pop(); stack.append(f'({b} {name} {a})')
[codex:428597]     elif name=='JUMPI':
[codex:428597]         dest=stack.pop(); cond=stack.pop()
[codex:428597]         # force jump
[codex:428597]         pc=int(dest,16)
[codex:428597]     elif name=='JUMP':
[codex:428597]         dest=stack.pop(); pc=int(dest,16)
[codex:428597]     elif name=='CALL':
[codex:428597]         args=[stack.pop() for _ in range(7)][::-1]
[codex:428597]         print('CALL args order [gas,to,value,in_offset,in_size,out_offset,out_size]:')
[codex:428597]         print(args)
[codex:428597]         print('Remaining stack:', show())
[codex:428597]         break
[codex:428597]     elif name in ('REVERT','RETURN'):
[codex:428597]         break
[codex:428597]     # continue
[codex:428597] 
[codex:428597] PY" in /tmp/codex-multi-7u01mfce succeeded in 19ms:
[codex:428597] CALL args order [gas,to,value,in_offset,in_size,out_offset,out_size]:
[codex:428597] ['0x00', 'MLOAD(0x40)', '0x00', 'MLOAD(0x40)', 'A', '((0x01 SUB (0x01 SHL 0xa0)) AND B)', '(ISZERO(A) MUL 0x08fc)']
[codex:428597] Remaining stack: [RET, A, B, 0x00, ((0x01 SUB (0x01 SHL 0xa0)) AND B), (ISZERO(A) MUL 0x08fc), A, MLOAD(0x40)]
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Analyzing EVM stack behavior and SUB semantics**
[codex:428597] 
[codex:428597] I’m carefully stepping through the EVM opcodes to track stack changes at the function call site, verifying how SUB operates—confirming it computes top minus second. I’m spotting a mismatch between the script’s SUB handling and actual EVM semantics, so I plan to fix the script accordingly and rerun to get accurate results.
[codex:428597] exec
[codex:428597] /bin/bash -lc "python - <<'PY'
[codex:428597] code_hex=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex\\n')[1].strip()
[codex:428597] if code_hex.startswith('0x'): code_hex=code_hex[2:]
[codex:428597] code=bytes.fromhex(code_hex)
[codex:428597] 
[codex:428597] opnames={
[codex:428597] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:428597] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:428597] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:428597] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:428597] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:428597] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:428597] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:428597] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:428597] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:428597] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:428597] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:428597] }
[codex:428597] 
[codex:428597] stack=['RET','A','B']
[codex:428597] 
[codex:428597] pc=0x0168
[codex:428597] 
[codex:428597] while True:
[codex:428597]     op=code[pc]
[codex:428597]     name=opnames.get(op,f'OP{op:02x}')
[codex:428597]     pc+=1
[codex:428597]     if name.startswith('PUSH'):
[codex:428597]         n=int(name[4:]); data=code[pc:pc+n]; pc+=n; stack.append('0x'+data.hex())
[codex:428597]     elif name.startswith('DUP'):
[codex:428597]         n=int(name[3:]); stack.append(stack[-n])
[codex:428597]     elif name.startswith('SWAP'):
[codex:428597]         n=int(name[4:]); stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:428597]     elif name=='POP':
[codex:428597]         stack.pop()
[codex:428597]     elif name=='SLOAD':
[codex:428597]         key=stack.pop(); stack.append(f'SLOAD({key})')
[codex:428597]     elif name=='CALLER':
[codex:428597]         stack.append('CALLER')
[codex:428597]     elif name=='MLOAD':
[codex:428597]         key=stack.pop(); stack.append(f'MLOAD({key})')
[codex:428597]     elif name=='ISZERO':
[codex:428597]         a=stack.pop(); stack.append(f'ISZERO({a})')
[codex:428597]     elif name in ('ADD','SUB','MUL','DIV','AND','OR','EQ','LT','GT','SHL','SHR'):
[codex:428597]         a=stack.pop(); b=stack.pop();
[codex:428597]         # use a - b semantics for SUB; for others use a op b where op is commutative or a/b accordingly
[codex:428597]         if name=='SUB':
[codex:428597]             stack.append(f'({a} SUB {b})')
[codex:428597]         elif name=='DIV':
[codex:428597]             stack.append(f'({a} DIV {b})')
[codex:428597]         elif name=='LT':
[codex:428597]             stack.append(f'({a} LT {b})')
[codex:428597]         elif name=='GT':
[codex:428597]             stack.append(f'({a} GT {b})')
[codex:428597]         elif name=='SHL':
[codex:428597]             stack.append(f'({a} SHL {b})')
[codex:428597]         elif name=='SHR':
[codex:428597]             stack.append(f'({a} SHR {b})')
[codex:428597]         elif name=='EQ':
[codex:428597]             stack.append(f'({a} EQ {b})')
[codex:428597]         elif name=='MUL':
[codex:428597]             stack.append(f'({a} MUL {b})')
[codex:428597]         elif name=='AND':
[codex:428597]             stack.append(f'({a} AND {b})')
[codex:428597]         else:
[codex:428597]             stack.append(f'({a} {name} {b})')
[codex:428597]     elif name=='JUMPI':
[codex:428597]         dest=stack.pop(); cond=stack.pop(); pc=int(dest,16)
[codex:428597]     elif name=='JUMP':
[codex:428597]         dest=stack.pop(); pc=int(dest,16)
[codex:428597]     elif name=='CALL':
[codex:428597]         args=[stack.pop() for _ in range(7)][::-1]
[codex:428597]         print('CALL args [gas,to,value,in_offset,in_size,out_offset,out_size]:')
[codex:428597]         print(args)
[codex:428597]         print('Remaining stack:', stack)
[codex:428597]         break
[codex:428597]     elif name in ('REVERT','RETURN'):
[codex:428597]         break
[codex:428597] 
[codex:428597] PY" in /tmp/codex-multi-7u01mfce succeeded in 22ms:
[codex:428597] CALL args [gas,to,value,in_offset,in_size,out_offset,out_size]:
[codex:428597] ['0x00', 'MLOAD(0x40)', '0x00', 'MLOAD(0x40)', 'A', '(B AND ((0xa0 SHL 0x01) SUB 0x01))', '(0x08fc MUL ISZERO(A))']
[codex:428597] Remaining stack: ['RET', 'A', 'B', '0x00', '(B AND ((0xa0 SHL 0x01) SUB 0x01))', '(0x08fc MUL ISZERO(A))', 'A', 'MLOAD(0x40)']
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Tracing stack order in internal calls**
[codex:428597] exec
[codex:428597] /bin/bash -lc "python - <<'PY'
[codex:428597] code_hex=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex\\n')[1].strip()
[codex:428597] if code_hex.startswith('0x'): code_hex=code_hex[2:]
[codex:428597] code=bytes.fromhex(code_hex)
[codex:428597] 
[codex:428597] opnames={
[codex:428597] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:428597] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:428597] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:428597] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:428597] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:428597] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:428597] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:428597] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:428597] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:428597] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:428597] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:428597] }
[codex:428597] 
[codex:428597] # stack with return address and arg
[codex:428597] stack=['RET','ARG']
[codex:428597] pc=0x009e
[codex:428597] 
[codex:428597] while True:
[codex:428597]     op=code[pc]
[codex:428597]     name=opnames.get(op,f'OP{op:02x}')
[codex:428597]     pc+=1
[codex:428597]     if name.startswith('PUSH'):
[codex:428597]         n=int(name[4:]); data=code[pc:pc+n]; pc+=n; stack.append('0x'+data.hex())
[codex:428597]     elif name.startswith('DUP'):
[codex:428597]         n=int(name[3:]); stack.append(stack[-n])
[codex:428597]     elif name.startswith('SWAP'):
[codex:428597]         n=int(name[4:]); stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:428597]     elif name=='POP':
[codex:428597]         stack.pop()
[codex:428597]     elif name=='SLOAD':
[codex:428597]         key=stack.pop(); stack.append(f'SLOAD({key})')
[codex:428597]     elif name=='CALLER':
[codex:428597]         stack.append('CALLER')
[codex:428597]     elif name=='ISZERO':
[codex:428597]         a=stack.pop(); stack.append(f'ISZERO({a})')
[codex:428597]     elif name in ('ADD','SUB','MUL','DIV','AND','OR','EQ','LT','GT','SHL','SHR'):
[codex:428597]         a=stack.pop(); b=stack.pop();
[codex:428597]         if name=='SUB':
[codex:428597]             stack.append(f'({a} SUB {b})')
[codex:428597]         elif name=='SHL':
[codex:428597]             stack.append(f'({a} SHL {b})')
[codex:428597]         else:
[codex:428597]             stack.append(f'({a} {name} {b})')
[codex:428597]     elif name=='JUMPI':
[codex:428597]         dest=stack.pop(); cond=stack.pop(); pc=int(dest,16)
[codex:428597]     elif name=='JUMP':
[codex:428597]         dest=stack.pop();
[codex:428597]         print('JUMP to',dest,'with stack',stack)
[codex:428597]         break
[codex:428597]     elif name in ('REVERT','RETURN'):
[codex:428597]         print('REVERT/RETURN',name,'stack',stack)
[codex:428597]         break
[codex:428597] 
[codex:428597] PY" in /tmp/codex-multi-7u01mfce succeeded in 19ms:
[codex:428597] JUMP to ((((0xa0 SHL 0x01) SUB 0x01) AND ARG) OR (((0xa0 SHL 0x01) SUB 0x01) AND SLOAD(0x01))) with stack ['RET', '0x00', '0x01']
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Analyzing stack order and jump destination**
[codex:428597] exec
[codex:428597] /bin/bash -lc "python - <<'PY'
[codex:428597] code_hex=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex\\n')[1].strip()
[codex:428597] if code_hex.startswith('0x'): code_hex=code_hex[2:]
[codex:428597] code=bytes.fromhex(code_hex)
[codex:428597] 
[codex:428597] # simple opcode map
[codex:428597] opnames={
[codex:428597] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:428597] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:428597] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:428597] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:428597] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:428597] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:428597] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:428597] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:428597] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:428597] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:428597] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:428597] }
[codex:428597] 
[codex:428597] # stack with ARG bottom, RET top
[codex:428597] stack=['ARG','RET']
[codex:428597] 
[codex:428597] pc=0x009e
[codex:428597] 
[codex:428597] while True:
[codex:428597]     op=code[pc]; name=opnames.get(op,f'OP{op:02x}'); pc+=1
[codex:428597]     if name.startswith('PUSH'):
[codex:428597]         n=int(name[4:]); data=code[pc:pc+n]; pc+=n; stack.append('0x'+data.hex())
[codex:428597]     elif name.startswith('DUP'):
[codex:428597]         n=int(name[3:]); stack.append(stack[-n])
[codex:428597]     elif name.startswith('SWAP'):
[codex:428597]         n=int(name[4:]); stack[-1], stack[-1-n]=stack[-1-n], stack[-1]
[codex:428597]     elif name=='POP':
[codex:428597]         stack.pop()
[codex:428597]     elif name=='SLOAD':
[codex:428597]         key=stack.pop(); stack.append(f'SLOAD({key})')
[codex:428597]     elif name=='CALLER':
[codex:428597]         stack.append('CALLER')
[codex:428597]     elif name=='ISZERO':
[codex:428597]         a=stack.pop(); stack.append(f'ISZERO({a})')
[codex:428597]     elif name in ('ADD','SUB','MUL','DIV','AND','OR','EQ','LT','GT','SHL','SHR'):
[codex:428597]         a=stack.pop(); b=stack.pop();
[codex:428597]         if name=='SUB':
[codex:428597]             stack.append(f'({a} SUB {b})')
[codex:428597]         elif name=='SHL':
[codex:428597]             stack.append(f'({a} SHL {b})')
[codex:428597]         else:
[codex:428597]             stack.append(f'({a} {name} {b})')
[codex:428597]     elif name=='JUMPI':
[codex:428597]         dest=stack.pop(); cond=stack.pop(); pc=int(dest,16)
[codex:428597]     elif name=='JUMP':
[codex:428597]         dest=stack.pop();
[codex:428597]         print('JUMP to',dest,'stack',stack)
[codex:428597]         break
[codex:428597]     elif name in ('REVERT','RETURN'):
[codex:428597]         print('REVERT/RETURN',name,'stack',stack)
[codex:428597]         break
[codex:428597] 
[codex:428597] PY" in /tmp/codex-multi-7u01mfce succeeded in 18ms:
[codex:428597] JUMP to ((((0xa0 SHL 0x01) SUB 0x01) AND RET) OR (((0xa0 SHL 0x01) SUB 0x01) AND SLOAD(0x01))) stack ['ARG', '0x00', '0x01']
[codex:428597] 
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Analyzing EVM stack manipulation in jump and storage blocks**
[codex:428597] thinking
[codex:428597] **Mapping stack state and CALL parameters during execution**
[codex:428597] 
[codex:428597] I'll map the stack step-by-step to understand how the CALL parameters are arranged, confirming that the function sends ETH with carefully computed gas and addresses. This reveals how the contract restricts calls and manages fund forwarding, helping assess if any unusual behavior might allow exploitation.
[codex:428597] exec
[codex:428597] /bin/bash -lc 'cat codex-output-schema.json' in /tmp/codex-multi-7u01mfce succeeded in 6ms:
[codex:428597] {"type": "object", "additionalProperties": false, "required": ["no_findings", "summary", "findings"], "properties": {"no_findings": {"type": "boolean"}, "summary": {"type": "string"}, "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["severity", "category", "title", "evidence", "locations", "exploit_scenario", "recommendation"], "properties": {"severity": {"type": "string", "enum": ["info", "low", "medium", "high", "critical"]}, "category": {"type": "string", "enum": ["access_control", "reentrancy", "math", "oracle", "upgradeability", "auth", "other"]}, "title": {"type": "string"}, "exploit_scenario": {"type": "string"}, "recommendation": {"type": "string"}, "evidence": {"type": "string"}, "locations": {"type": "array", "items": {"type": "string"}}}}}}}
[codex:428597] 
[codex:428597] thinking
[codex:428597] **Preparing concise security summary JSON**
[codex:428597] codex
[codex:428597] {"no_findings":true,"summary":"No concrete, exploitable value extraction path identified from the provided runtime bytecode; state-changing calls are gated by owner/resonateContract checks and no unsafe external call targets or upgrade hooks are exposed.","findings":[]}
[codex:428597] tokens used
[codex:428597] 70,527
[codex:428597] {"no_findings":true,"summary":"No concrete, exploitable value extraction path identified from the provided runtime bytecode; state-changing calls are gated by owner/resonateContract checks and no unsafe external call targets or upgrade hooks are exposed.","findings":[]}
Metadata 
{
    "codex": {
        "ran_at": "2026-01-02T14:49:14.787372+00:00",
        "returncode": 0
    },
    "summary": "No concrete, exploitable value extraction path identified from the provided runtime bytecode; state-changing calls are gated by owner/resonateContract checks and no unsafe external call targets or upgrade hooks are exposed.",
    "raw_final": {
        "summary": "No concrete, exploitable value extraction path identified from the provided runtime bytecode; state-changing calls are gated by owner/resonateContract checks and no unsafe external call targets or upgrade hooks are exposed.",
        "findings": [],
        "no_findings": true
    },
    "no_findings": true,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
0
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
1
EXT*/BALANCE
0
Total opcodes
350
Flags
No heuristic flags raised.
View cast disassembly output 
00000000: PUSH1 0x80
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x04
00000007: CALLDATASIZE
00000008: LT
00000009: PUSH2 0x0029
0000000c: JUMPI
0000000d: PUSH1 0x00
0000000f: CALLDATALOAD
00000010: PUSH1 0xe0
00000012: SHR
00000013: DUP1
00000014: PUSH4 0x81bac14f
00000019: EQ
0000001a: PUSH2 0x002b
0000001d: JUMPI
0000001e: DUP1
0000001f: PUSH4 0xb7760c8f
00000024: EQ
00000025: PUSH2 0x0072
00000028: JUMPI
00000029: JUMPDEST
0000002a: STOP
0000002b: JUMPDEST
0000002c: CALLVALUE
0000002d: DUP1
0000002e: ISZERO
0000002f: PUSH2 0x0037
00000032: JUMPI
00000033: PUSH1 0x00
00000035: DUP1
00000036: REVERT
00000037: JUMPDEST
00000038: POP
00000039: PUSH2 0x005e
0000003c: PUSH1 0x04
0000003e: DUP1
0000003f: CALLDATASIZE
00000040: SUB
00000041: PUSH1 0x20
00000043: DUP2
00000044: LT
00000045: ISZERO
00000046: PUSH2 0x004e
00000049: JUMPI
0000004a: PUSH1 0x00
0000004c: DUP1
0000004d: REVERT
0000004e: JUMPDEST
0000004f: POP
00000050: CALLDATALOAD
00000051: PUSH1 0x01
00000053: PUSH1 0x01
00000055: PUSH1 0xa0
00000057: SHL
00000058: SUB
00000059: AND
0000005a: PUSH2 0x009e
0000005d: JUMP
0000005e: JUMPDEST
0000005f: PUSH1 0x40
00000061: DUP1
00000062: MLOAD
00000063: SWAP2
00000064: ISZERO
00000065: ISZERO
00000066: DUP3
00000067: MSTORE
00000068: MLOAD
00000069: SWAP1
0000006a: DUP2
0000006b: SWAP1
0000006c: SUB
0000006d: PUSH1 0x20
0000006f: ADD
00000070: SWAP1
00000071: RETURN
00000072: JUMPDEST
00000073: PUSH2 0x005e
00000076: PUSH1 0x04
00000078: DUP1
00000079: CALLDATASIZE
0000007a: SUB
0000007b: PUSH1 0x40
0000007d: DUP2
0000007e: LT
0000007f: ISZERO
00000080: PUSH2 0x0088
00000083: JUMPI
00000084: PUSH1 0x00
00000086: DUP1
00000087: REVERT
00000088: JUMPDEST
00000089: POP
0000008a: DUP1
0000008b: CALLDATALOAD
0000008c: SWAP1
0000008d: PUSH1 0x20
0000008f: ADD
00000090: CALLDATALOAD
00000091: PUSH1 0x01
00000093: PUSH1 0x01
00000095: PUSH1 0xa0
00000097: SHL
00000098: SUB
00000099: AND
0000009a: PUSH2 0x0168
0000009d: JUMP
0000009e: JUMPDEST
0000009f: PUSH1 0x00
000000a1: DUP1
000000a2: SLOAD
000000a3: PUSH1 0x01
000000a5: PUSH1 0x01
000000a7: PUSH1 0xa0
000000a9: SHL
000000aa: SUB
000000ab: AND
000000ac: CALLER
000000ad: EQ
000000ae: PUSH2 0x00f5
000000b1: JUMPI
000000b2: PUSH1 0x40
000000b4: DUP1
000000b5: MLOAD
000000b6: PUSH3 0x461bcd
000000ba: PUSH1 0xe5
000000bc: SHL
000000bd: DUP2
000000be: MSTORE
000000bf: PUSH1 0x20
000000c1: PUSH1 0x04
000000c3: DUP3
000000c4: ADD
000000c5: MSTORE
000000c6: PUSH1 0x14
000000c8: PUSH1 0x24
000000ca: DUP3
000000cb: ADD
000000cc: MSTORE
000000cd: PUSH20 0x2fb7bbb732b910109e9036b9b39739b2b73232b9
000000e2: PUSH1 0x61
000000e4: SHL
000000e5: PUSH1 0x44
000000e7: DUP3
000000e8: ADD
000000e9: MSTORE
000000ea: SWAP1
000000eb: MLOAD
000000ec: SWAP1
000000ed: DUP2
000000ee: SWAP1
000000ef: SUB
000000f0: PUSH1 0x64
000000f2: ADD
000000f3: SWAP1
000000f4: REVERT
000000f5: JUMPDEST
000000f6: PUSH1 0x01
000000f8: SLOAD
000000f9: PUSH1 0x01
000000fb: PUSH1 0x01
000000fd: PUSH1 0xa0
000000ff: SHL
00000100: SUB
00000101: AND
00000102: ISZERO
00000103: PUSH2 0x0144
00000106: JUMPI
00000107: PUSH1 0x40
00000109: DUP1
0000010a: MLOAD
0000010b: PUSH3 0x461bcd
0000010f: PUSH1 0xe5
00000111: SHL
00000112: DUP2
00000113: MSTORE
00000114: PUSH1 0x20
00000116: PUSH1 0x04
00000118: DUP3
00000119: ADD
0000011a: MSTORE
0000011b: PUSH1 0x0e
0000011d: PUSH1 0x24
0000011f: DUP3
00000120: ADD
00000121: MSTORE
00000122: PUSH14 0x17dc9bdbdd081b9bdd081b9d5b1b
00000131: PUSH1 0x92
00000133: SHL
00000134: PUSH1 0x44
00000136: DUP3
00000137: ADD
00000138: MSTORE
00000139: SWAP1
0000013a: MLOAD
0000013b: SWAP1
0000013c: DUP2
0000013d: SWAP1
0000013e: SUB
0000013f: PUSH1 0x64
00000141: ADD
00000142: SWAP1
00000143: REVERT
00000144: JUMPDEST
00000145: PUSH1 0x01
00000147: DUP1
00000148: SLOAD
00000149: PUSH1 0x01
0000014b: PUSH1 0x01
0000014d: PUSH1 0xa0
0000014f: SHL
00000150: SUB
00000151: NOT
00000152: AND
00000153: PUSH1 0x01
00000155: PUSH1 0x01
00000157: PUSH1 0xa0
00000159: SHL
0000015a: SUB
0000015b: SWAP4
0000015c: SWAP1
0000015d: SWAP4
0000015e: AND
0000015f: SWAP3
00000160: SWAP1
00000161: SWAP3
00000162: OR
00000163: SWAP1
00000164: SWAP2
00000165: SSTORE
00000166: SWAP1
00000167: JUMP
00000168: JUMPDEST
00000169: PUSH1 0x01
0000016b: SLOAD
0000016c: PUSH1 0x00
0000016e: SWAP1
0000016f: PUSH1 0x01
00000171: PUSH1 0x01
00000173: PUSH1 0xa0
00000175: SHL
00000176: SUB
00000177: AND
00000178: CALLER
00000179: EQ
0000017a: PUSH2 0x01ca
0000017d: JUMPI
0000017e: PUSH1 0x40
00000180: DUP1
00000181: MLOAD
00000182: PUSH3 0x461bcd
00000186: PUSH1 0xe5
00000188: SHL
00000189: DUP2
0000018a: MSTORE
0000018b: PUSH1 0x20
0000018d: PUSH1 0x04
0000018f: DUP3
00000190: ADD
00000191: MSTORE
00000192: PUSH1 0x1f
00000194: PUSH1 0x24
00000196: DUP3
00000197: ADD
00000198: MSTORE
00000199: PUSH32 0x6d73672e73656e64657220213d205f7265736f6e617465436f6e747261637400
000001ba: PUSH1 0x44
000001bc: DUP3
000001bd: ADD
000001be: MSTORE
000001bf: SWAP1
000001c0: MLOAD
000001c1: SWAP1
000001c2: DUP2
000001c3: SWAP1
000001c4: SUB
000001c5: PUSH1 0x64
000001c7: ADD
000001c8: SWAP1
000001c9: REVERT
000001ca: JUMPDEST
000001cb: PUSH1 0x40
000001cd: MLOAD
000001ce: PUSH1 0x01
000001d0: PUSH1 0x01
000001d2: PUSH1 0xa0
000001d4: SHL
000001d5: SUB
000001d6: DUP4
000001d7: AND
000001d8: SWAP1
000001d9: DUP5
000001da: ISZERO
000001db: PUSH2 0x08fc
000001de: MUL
000001df: SWAP1
000001e0: DUP6
000001e1: SWAP1
000001e2: PUSH1 0x00
000001e4: DUP2
000001e5: DUP2
000001e6: DUP2
000001e7: DUP6
000001e8: DUP9
000001e9: DUP9
000001ea: CALL
000001eb: SWAP4
000001ec: POP
000001ed: POP
000001ee: POP
000001ef: POP
000001f0: ISZERO
000001f1: DUP1
000001f2: ISZERO
000001f3: PUSH2 0x0200
000001f6: JUMPI
000001f7: RETURNDATASIZE
000001f8: PUSH1 0x00
000001fa: DUP1
000001fb: RETURNDATACOPY
000001fc: RETURNDATASIZE
000001fd: PUSH1 0x00
000001ff: REVERT
00000200: JUMPDEST
00000201: POP
00000202: PUSH1 0x01
00000204: SWAP4
00000205: SWAP3
00000206: POP
00000207: POP
00000208: POP
00000209: JUMP
0000020a: INVALID
0000020b: LOG2
0000020c: PUSH6 0x627a7a723158
00000213: KECCAK256
00000214: UNKNOWN(0xAE)
00000215: UNKNOWN(0xC9)
00000216: UNKNOWN(0xD8)
00000217: UNKNOWN(0xD1)
00000218: UNKNOWN(0xE6)
00000219: UNKNOWN(0x4D)
0000021a: PUSH8 0x9b97a59f4996c5e3
00000223: UNKNOWN(0xFB)
00000224: COINBASE
00000225: UNKNOWN(0x2F)
00000226: UNKNOWN(0xB5)
00000227: PUSH29

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
high other detector Untrusted CALL target/value reachable 60 no no
view
trace_id: 0x1aeb440001eaf9f149ba5a4525663c47c30baa4b3b54a565fdc8cdc9275bf149
call_targets: 0xb7a1515069f54a5a92dd4ce68e9d43f3dca230e3
target_varies: no
classification: constant_target
validation_json 
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x1aeb440001eaf9f149ba5a4525663c47c30baa4b3b54a565fdc8cdc9275bf149",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xb7a1515069f54a5a92dd4ce68e9d43f3dca230e3"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x81bac14f",
            "selector": "0x81bac14f",
            "calldata_variants": [
                "0x81bac14f",
                "0x81bac14f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xb7760c8f",
            "selector": "0xb7760c8f",
            "calldata_variants": [
                "0xb7760c8f",
                "0xb7760c8f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 490,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 1,
    "guards_detected": [],
    "untrusted_call_count": 1
}
high other detector ETH value transfer possible 55 no no
view
trace_id: 0x1aeb440001eaf9f149ba5a4525663c47c30baa4b3b54a565fdc8cdc9275bf149
call_targets: 0xb7a1515069f54a5a92dd4ce68e9d43f3dca230e3
target_varies: no
classification: constant_target
validation_json 
{
    "sink": "CALL",
    "errors": 0,
    "status": "sink_reached",
    "attempts": 1,
    "trace_id": "0x1aeb440001eaf9f149ba5a4525663c47c30baa4b3b54a565fdc8cdc9275bf149",
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": [
        "0xb7a1515069f54a5a92dd4ce68e9d43f3dca230e3"
    ],
    "matched_probe": null,
    "target_varies": false,
    "classification": "constant_target"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x81bac14f",
            "selector": "0x81bac14f",
            "calldata_variants": [
                "0x81bac14f",
                "0x81bac14f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0xb7760c8f",
            "selector": "0xb7760c8f",
            "calldata_variants": [
                "0xb7760c8f",
                "0xb7760c8f0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 490,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 1,
    "guards_detected": []
}