3b633a48-a23d-4d56-9851-5fa10c3a4c1d
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 31179 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 76888 | artifact.fetch | complete | 1 / 3 | 1 week ago |
| 76889 | tool.cast_disasm | complete | 1 / 3 | 1 week ago |
| 76890 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 76891 | capability.graph | complete | 1 / 3 | 1 week ago |
| 76892 | detector.run | complete | 1 / 3 | 1 week ago |
| 76893 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
[codex:390600] OpenAI Codex v0.77.0 (research preview)
[codex:390600] --------
[codex:390600] workdir: /tmp/codex-multi-hun_6o5y
[codex:390600] model: gpt-5.2-codex
[codex:390600] provider: openai
[codex:390600] approval: never
[codex:390600] sandbox: read-only
[codex:390600] reasoning effort: xhigh
[codex:390600] reasoning summaries: auto
[codex:390600] session id: 019b7c5f-4ac7-73a3-adae-df968de8de82
[codex:390600] --------
[codex:390600] user
[codex:390600] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:390600]
[codex:390600] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:390600]
[codex:390600] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:390600] - Gas inefficiency, code quality, or best practices
[codex:390600] - Theoretical vulnerabilities without a clear extraction path
[codex:390600] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:390600] - Issues requiring social engineering or off-chain coordination
[codex:390600]
[codex:390600] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:390600] - CALL/DELEGATECALL with controllable destination or calldata
[codex:390600] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:390600] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:390600] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:390600] - External calls before state updates (reentrancy)
[codex:390600] - SELFDESTRUCT with controllable beneficiary
[codex:390600] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:390600]
[codex:390600] For each finding, you MUST explain:
[codex:390600] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:390600] 2. The concrete sequence of transactions to extract value
[codex:390600] 3. Why you believe this is exploitable (not just suspicious)
[codex:390600]
[codex:390600] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:390600] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:390600]
[codex:390600] Output MUST be valid JSON matching the provided schema.
[codex:390600] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:390600] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:390600] mcp startup: no servers
[codex:390600]
[codex:390600] thinking
[codex:390600] **Reviewing BYTECODE_BUNDLE.txt**
[codex:390600] exec
[codex:390600] /bin/bash -lc ls in /tmp/codex-multi-hun_6o5y succeeded in 6ms:
[codex:390600] BYTECODE_BUNDLE.txt
[codex:390600] codex-output-schema.json
[codex:390600] exec
[codex:390600] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-hun_6o5y succeeded in 5ms:
[codex:390600] Runtime bytecode bundle for best-effort auditing.
[codex:390600] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:390600]
[codex:390600] FILE: runtime_bytecode.hex
[codex:390600] 0x608060405260043610610083576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff1680632079fb9a1461011d5780637df73e271461018a578063959f9114146101e557806397f6c448146101fc57806398f44b9a146102dc578063a0b7967b146103a3578063abe3219c146103ce575b600034111561011b577f0113761859388286b05db53a5354f9ae21375ba9131de67113c0964d7bc397b13433600036604051808581526020018473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200180602001828103825284848281815260200192508082843782019150509550505050505060405180910390a15b005b34801561012957600080fd5b50610148600480360381019080803590602001909291905050506103fd565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b34801561019657600080fd5b506101cb600480360381019080803573ffffffffffffffffffffffffffffffffffffffff16906020019092919050505061043b565b604051808215151515815260200191505060405180910390f35b3480156101f157600080fd5b506101fa6104de565b005b6102da6004803603810190808035906020019092919080359060200190929190803590602001908201803590602001908080601f016020809104026020016040519081016040528093929190818152602001838380828437820191505050505050919291929080359060200190929190803573ffffffffffffffffffffffffffffffffffffffff169060200190929190803590602001908201803590602001908080601f0160208091040260200160405190810160405280939291908181526020018383808284378201915050505050509192919290505050610571565b005b3480156102e857600080fd5b506103a1600480360381019080803590602001909291908035906020019092919080359060200190929190803573ffffffffffffffffffffffffffffffffffffffff169060200190929190803573ffffffffffffffffffffffffffffffffffffffff169060200190929190803590602001908201803590602001908080601f0160208091040260200160405190810160405280939291908181526020018383808284378201915050505050509192919290505050610885565b005b3480156103af57600080fd5b506103b8610a2a565b6040518082815260200191505060405180910390f35b3480156103da57600080fd5b506103e3610a84565b604051808215151515815260200191505060405180910390f35b60008181548110151561040c57fe5b906000526020600020016000915054906101000a900473ffffffffffffffffffffffffffffffffffffffff1681565b600080600090505b6000805490508110156104d3578273ffffffffffffffffffffffffffffffffffffffff1660008281548110151561047657fe5b9060005260206000200160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1614156104c657600191506104d8565b8080600101915050610443565b600091505b50919050565b6104e73361043b565b15156104f257600080fd5b60018060006101000a81548160ff0219169083151502179055507fa7dab64e845898e416ea04214ebc8014aa6c3dff511bcd708bbfa64e1559d55e33604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390a1565b60008061057d3361043b565b151561058857600080fd5b838887898860405160200180807f45544845520000000000000000000000000000000000000000000000000000008152506005018673ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166c0100000000000000000000000002815260140185815260200184805190602001908083835b602083101515610634578051825260208201915060208101905060208303925061060f565b6001836020036101000a038019825116818451168082178552505050505050905001838152602001828152602001955050505050506040516020818303038152906040526040518082805190602001908083835b6020831015156106ad5780518252602082019150602081019050602083039250610688565b6001836020036101000a038019825116818451168082178552505050505050905001915050604051809103902091506106e98483858a89610a97565b90508373ffffffffffffffffffffffffffffffffffffffff166108fc899081150290604051600060405180830381858888f19350505050151561072b57600080fd5b7fd00dde70ab4635be4f88c39a53a7c224c66333926c14ca4f30b9570ccd880ea1338583898c87604051808773ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020018673ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020018573ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001806020018481526020018360001916600019168152602001828103825285818151815260200191508051906020019080838360005b8381101561083c578082015181840152602081019050610821565b50505050905090810190601f1680156108695780820380516001836020036101000a031916815260200191505b5097505050505050505060405180910390a15050505050505050565b60006108903361043b565b151561089b57600080fd5b838784888860405160200180807f45524332300000000000000000000000000000000000000000000000000000008152506005018673ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166c010000000000000000000000000281526014018581526020018473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166c01000000000000000000000000028152601401838152602001828152602001955050505050506040516020818303038152906040526040518082805190602001908083835b6020831015156109ae5780518252602082019150602081019050602083039250610989565b6001836020036101000a038019825116818451168082178552505050505050905001915050604051809103902090506109ea8482848989610a97565b50610a1684888573ffffffffffffffffffffffffffffffffffffffff16610b429092919063ffffffff16565b1515610a2157600080fd5b50505050505050565b6000806000809150600090505b600a811015610a795781600282600a81101515610a5057fe5b01541115610a6c57600281600a81101515610a6757fe5b015491505b8080600101915050610a37565b600182019250505090565b600160009054906101000a900460ff1681565b600080610aa48686610c6f565b9050600160009054906101000a900460ff168015610ac85750610ac68761043b565b155b15610ad257600080fd5b42841015610adf57600080fd5b610ae883610d3c565b610af18161043b565b1515610afc57600080fd5b3373ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff161415610b3557600080fd5b8091505095945050505050565b6000606060008484604051602401808373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001828152602001925050506040516020818303038152906040527fa9059cbb000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19166020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff838183161783525050505091508151905060ff60005260206000826020850160008a5af11515610c2e57600080fd5b60005160ff8114610c4e5760018114610c575760008114610c6057600080fd5b60019350610c65565b60019350610c65565b600093505b5050509392505050565b60008060008060418551141515610c8557600080fd5b602085015192506040850151915060ff6041860151169050601b8160ff161015610cb057601b810190505b600186828585604051600081526020016040526040518085600019166000191681526020018460ff1660ff1681526020018360001916600019168152602001826000191660001916815260200194505050505060206040516020810390808403906000865af1158015610d27573d6000803e3d6000fd5b50505060206040510351935050505092915050565b600080610d483361043b565b1515610d5357600080fd5b60009150600090505b600a811015610dbb5782600282600a81101515610d7557fe5b01541415610d8257600080fd5b600282600a81101515610d9157fe5b0154600282600a81101515610da257fe5b01541015610dae578091505b8080600101915050610d5c565b600282600a81101515610dca57fe5b0154831015610dd857600080fd5b612710600283600a81101515610dea57fe5b015401831115610df957600080fd5b82600283600a81101515610e0957fe5b01819055505050505600a165627a7a72305820d8f92f614b75e773d337885bbc97e998403b7a2fdf83e5e0826716b7f23af7cf0029
[codex:390600]
[codex:390600] thinking
[codex:390600] **Evaluating bytecode for exploit potential**
[codex:390600]
[codex:390600] I’m carefully dissecting the contract’s runtime bytecode to map function selectors to logic and identify any exploitable patterns like unchecked call values or improper signature verification. I'm manually decoding key functions—especially the fallback payable function, signer checks, enabling toggles, and multisig transfer actions—to see if any unauthorized transfer or signature replay vulnerabilities exist. The goal is to produce a JSON schema describing the contract interface only if concrete exploit paths emerge from this detailed bytecode analysis.
[codex:390600] exec
[codex:390600] /bin/bash -lc "python - <<'PY'
[codex:390600] import binascii, textwrap
[codex:390600] hexdata=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex')[1].split('\\n',1)[1].strip()
[codex:390600] if hexdata.startswith('0x'): hexdata=hexdata[2:]
[codex:390600] code=bytes.fromhex(hexdata)
[codex:390600]
[codex:390600] # opcode map
[codex:390600] opnames = {i: f'PUSH{i-0x5f}' for i in range(0x60,0x80)}
[codex:390600] opnames.update({i: f'DUP{i-0x7f}' for i in range(0x80,0x90)})
[codex:390600] opnames.update({i: f'SWAP{i-0x8f}' for i in range(0x90,0xa0)})
[codex:390600] opnames.update({0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:390600] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:390600] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:390600] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:390600] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:390600] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'})
[codex:390600]
[codex:390600] pc=0
[codex:390600] out=[]
[codex:390600] while pc < len(code):
[codex:390600] op=code[pc]
[codex:390600] name=opnames.get(op, f'OP{op:02x}')
[codex:390600] if 0x60 <= op <= 0x7f:
[codex:390600] n=op-0x5f
[codex:390600] arg=code[pc+1:pc+1+n]
[codex:390600] out.append(f'{pc:04x}: {name} 0x{arg.hex()}')
[codex:390600] pc+=1+n
[codex:390600] else:
[codex:390600] out.append(f'{pc:04x}: {name}')
[codex:390600] pc+=1
[codex:390600]
[codex:390600] # print a slice around key regions
[codex:390600] for line in out[:200]:
[codex:390600] print(line)
[codex:390600] print('... total ops', len(out))
[codex:390600] # Optionally, write full disassembly to /tmp for inspection
[codex:390600] open('/tmp/disasm.txt','w').write('\\n'.join(out))
[codex:390600] print('disasm at /tmp/disasm.txt')
[codex:390600] PY" in /tmp/codex-multi-hun_6o5y exited 1 in 41ms:
[codex:390600] 0000: PUSH1 0x80
[codex:390600] 0002: PUSH1 0x40
[codex:390600] 0004: MSTORE
[codex:390600] 0005: PUSH1 0x04
[codex:390600] 0007: CALLDATASIZE
[codex:390600] 0008: LT
[codex:390600] 0009: PUSH2 0x0083
[codex:390600] 000c: JUMPI
[codex:390600] 000d: PUSH1 0x00
[codex:390600] 000f: CALLDATALOAD
[codex:390600] 0010: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
[codex:390600] 002e: SWAP1
[codex:390600] 002f: DIV
[codex:390600] 0030: PUSH4 0xffffffff
[codex:390600] 0035: AND
[codex:390600] 0036: DUP1
[codex:390600] 0037: PUSH4 0x2079fb9a
[codex:390600] 003c: EQ
[codex:390600] 003d: PUSH2 0x011d
[codex:390600] 0040: JUMPI
[codex:390600]
[codex:390600] thinking
[codex:390600] **Handling read-only sandbox limitations**
[codex:390600] exec
[codex:390600] /bin/bash -lc "python - <<'PY'
[codex:390600] import binascii
[codex:390600] hexdata=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex')[1].split('\\n',1)[1].strip()
[codex:390600] if hexdata.startswith('0x'): hexdata=hexdata[2:]
[codex:390600] code=bytes.fromhex(hexdata)
[codex:390600] opnames = {i: f'PUSH{i-0x5f}' for i in range(0x60,0x80)}
[codex:390600] opnames.update({i: f'DUP{i-0x7f}' for i in range(0x80,0x90)})
[codex:390600] opnames.update({i: f'SWAP{i-0x8f}' for i in range(0x90,0xa0)})
[codex:390600] opnames.update({0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:390600] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:390600] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:390600] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:390600] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:390600] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'})
[codex:390600]
[codex:390600] def disasm_range(start, end):
[codex:390600] pc=0
[codex:390600] out=[]
[codex:390600] while pc < len(code):
[codex:390600] op=code[pc]
[codex:390600] name=opnames.get(op, f'OP{op:02x}')
[codex:390600] if 0x60 <= op <= 0x7f:
[codex:390600] n=op-0x5f
[codex:390600] arg=code[pc+1:pc+1+n]
[codex:390600] line=f'{pc:04x}: {name} 0x{arg.hex()}'
[codex:390600] pc+=1+n
[codex:390600] else:
[codex:390600] line=f'{pc:04x}: {name}'
[codex:390600] pc+=1
[codex:390600] if start <= pc-1 <= end or start <= pc <= end:
[codex:390600] out.append(line)
[codex:390600] return out
[codex:390600]
[codex:390600] # print ranges
[codex:390600] for start,end in [(0x03f0,0x0460),(0x04d0,0x0550),(0x0560,0x0750),(0x0860,0x0a50),(0x0a70,0x0b80),(0x0c60,0x0d80),(0x0d30,0x0e20)]:
[codex:390600] print(f'--- range {start:04x}-{end:04x} ---')
[codex:390600] for line in disasm_range(start,end):
[codex:390600] print(line)
[codex:390600] PY" in /tmp/codex-multi-hun_6o5y succeeded in 44ms:
[codex:390600] --- range 03f0-0460 ---
[codex:390600] 03ef: PUSH1 0x20
[codex:390600] 03f1: ADD
[codex:390600] 03f2: SWAP2
[codex:390600] 03f3: POP
[codex:390600] 03f4: POP
[codex:390600] 03f5: PUSH1 0x40
[codex:390600] 03f7: MLOAD
[codex:390600] 03f8: DUP1
[codex:390600] 03f9: SWAP2
[codex:390600] 03fa: SUB
[codex:390600] 03fb: SWAP1
[codex:390600] 03fc: RETURN
[codex:390600] 03fd: JUMPDEST
[codex:390600] 03fe: PUSH1 0x00
[codex:390600] 0400: DUP2
[codex:390600] 0401: DUP2
[codex:390600] 0402: SLOAD
[codex:390600] 0403: DUP2
[codex:390600] 0404: LT
[codex:390600]
[codex:390600]
[codex:390600]
[codex:390600] thinking
[codex:390600] **Analyzing storage layout and signature verification logic**
[codex:390600] thinking
[codex:390600] **Tracing signature check and nonce verification internals**
[codex:390600]
[codex:390600] This expands on how the recovered signer is used in verification, how the nonce or input passed to 0x0d3c is checked against a stored array to prevent replay, and how timestamp expiry is enforced; I’m parsing the call stack and interaction between these functions to understand the contract’s logic and input handling.
[codex:390600] thinking
[codex:390600] **Examining calldata decoding and hash input construction**
[codex:390600] exec
[codex:390600] /bin/bash -lc "python - <<'PY'
[codex:390600] import binascii
[codex:390600] hexdata=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex')[1].split('\\n',1)[1].strip()
[codex:390600] if hexdata.startswith('0x'): hexdata=hexdata[2:]
[codex:390600] code=bytes.fromhex(hexdata)
[codex:390600]
[codex:390600] opnames = {i: f'PUSH{i-0x5f}' for i in range(0x60,0x80)}
[codex:390600] opnames.update({i: f'DUP{i-0x7f}' for i in range(0x80,0x90)})
[codex:390600] opnames.update({i: f'SWAP{i-0x8f}' for i in range(0x90,0xa0)})
[codex:390600] opnames.update({0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:390600] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:390600] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:390600] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:390600] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:390600] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'})
[codex:390600]
[codex:390600] def disasm_range(start,end):
[codex:390600] pc=0
[codex:390600] out=[]
[codex:390600] while pc < len(code):
[codex:390600] op=code[pc]
[codex:390600] name=opnames.get(op, f'OP{op:02x}')
[codex:390600] if 0x60 <= op <= 0x7f:
[codex:390600] n=op-0x5f
[codex:390600] arg=code[pc+1:pc+1+n]
[codex:390600] line=f'{pc:04x}: {name} 0x{arg.hex()}'
[codex:390600] pc+=1+n
[codex:390600] else:
[codex:390600] line=f'{pc:04x}: {name}'
[codex:390600] pc+=1
[codex:390600] if start <= pc-1 <= end:
[codex:390600] out.append(line)
[codex:390600] return out
[codex:390600]
[codex:390600] for line in disasm_range(0x01fc,0x02da):
[codex:390600] print(line)
[codex:390600] PY" in /tmp/codex-multi-hun_6o5y succeeded in 22ms:
[codex:390600] 01fc: JUMPDEST
[codex:390600] 01fd: PUSH2 0x02da
[codex:390600] 0200: PUSH1 0x04
[codex:390600] 0202: DUP1
[codex:390600] 0203: CALLDATASIZE
[codex:390600] 0204: SUB
[codex:390600] 0205: DUP2
[codex:390600] 0206: ADD
[codex:390600] 0207: SWAP1
[codex:390600] 0208: DUP1
[codex:390600] 0209: DUP1
[codex:390600] 020a: CALLDATALOAD
[codex:390600] 020b: SWAP1
[codex:390600] 020c: PUSH1 0x20
[codex:390600] 020e: ADD
[codex:390600] 020f: SWAP1
[codex:390600] 0210: SWAP3
[codex:390600] 0211: SWAP2
[codex:390600] 0212: SWAP1
[codex:390600] 0213: DUP1
[codex:390600]
[codex:390600] thinking
[codex:390600] **Analyzing function parameters**
[codex:390600] exec
[codex:390600] /bin/bash -lc "python - <<'PY'
[codex:390600] import binascii
[codex:390600] hexdata=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex')[1].split('\\n',1)[1].strip()
[codex:390600] if hexdata.startswith('0x'): hexdata=hexdata[2:]
[codex:390600] code=bytes.fromhex(hexdata)
[codex:390600]
[codex:390600] opnames = {i: f'PUSH{i-0x5f}' for i in range(0x60,0x80)}
[codex:390600] opnames.update({i: f'DUP{i-0x7f}' for i in range(0x80,0x90)})
[codex:390600] opnames.update({i: f'SWAP{i-0x8f}' for i in range(0x90,0xa0)})
[codex:390600] opnames.update({0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:390600] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:390600] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:390600] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:390600] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:390600] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'})
[codex:390600]
[codex:390600] def disasm_range(start,end):
[codex:390600] pc=0
[codex:390600] out=[]
[codex:390600] while pc < len(code):
[codex:390600] op=code[pc]
[codex:390600] name=opnames.get(op, f'OP{op:02x}')
[codex:390600] if 0x60 <= op <= 0x7f:
[codex:390600] n=op-0x5f
[codex:390600] arg=code[pc+1:pc+1+n]
[codex:390600] line=f'{pc:04x}: {name} 0x{arg.hex()}'
[codex:390600] pc+=1+n
[codex:390600] else:
[codex:390600] line=f'{pc:04x}: {name}'
[codex:390600] pc+=1
[codex:390600] if start <= pc-1 <= end:
[codex:390600] out.append(line)
[codex:390600] return out
[codex:390600]
[codex:390600] for line in disasm_range(0x02dc,0x03a2):
[codex:390600] print(line)
[codex:390600] PY" in /tmp/codex-multi-hun_6o5y succeeded in 20ms:
[codex:390600] 02dc: JUMPDEST
[codex:390600] 02dd: CALLVALUE
[codex:390600] 02de: DUP1
[codex:390600] 02df: ISZERO
[codex:390600] 02e0: PUSH2 0x02e8
[codex:390600] 02e3: JUMPI
[codex:390600] 02e4: PUSH1 0x00
[codex:390600] 02e6: DUP1
[codex:390600] 02e7: REVERT
[codex:390600] 02e8: JUMPDEST
[codex:390600] 02e9: POP
[codex:390600] 02ea: PUSH2 0x03a1
[codex:390600] 02ed: PUSH1 0x04
[codex:390600] 02ef: DUP1
[codex:390600] 02f0: CALLDATASIZE
[codex:390600] 02f1: SUB
[codex:390600] 02f2: DUP2
[codex:390600] 02f3: ADD
[codex:390600] 02f4: SWAP1
[codex:390600] 02f5: DUP1
[codex:390600]
[codex:390600] thinking
[codex:390600] **Analyzing function parameters and internal calls**
[codex:390600] exec
[codex:390600] /bin/bash -lc "python - <<'PY'
[codex:390600] import binascii
[codex:390600] hexdata=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex')[1].split('\\n',1)[1].strip()
[codex:390600] if hexdata.startswith('0x'): hexdata=hexdata[2:]
[codex:390600] code=bytes.fromhex(hexdata)
[codex:390600]
[codex:390600] # minimal disasm
[codex:390600] opnames = {i: f'PUSH{i-0x5f}' for i in range(0x60,0x80)}
[codex:390600] opnames.update({i: f'DUP{i-0x7f}' for i in range(0x80,0x90)})
[codex:390600] opnames.update({i: f'SWAP{i-0x8f}' for i in range(0x90,0xa0)})
[codex:390600] # others
[codex:390600] opnames.update({0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:390600] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:390600] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:390600] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:390600] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:390600] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'})
[codex:390600]
[codex:390600] # build map from pc to op info
[codex:390600] ops=[]
[codex:390600] pc=0
[codex:390600] while pc < len(code):
[codex:390600] op=code[pc]
[codex:390600] name=opnames.get(op, f'OP{op:02x}')
[codex:390600] if 0x60 <= op <= 0x7f:
[codex:390600] n=op-0x5f
[codex:390600] arg=code[pc+1:pc+1+n]
[codex:390600] ops.append((pc,name,arg))
[codex:390600] pc+=1+n
[codex:390600] else:
[codex:390600] ops.append((pc,name,None))
[codex:390600] pc+=1
[codex:390600]
[codex:390600] # Build dict for quick access
[codex:390600] opdict = {pc:(name,arg) for pc,name,arg in ops}
[codex:390600]
[codex:390600] # simple stack sim
[codex:390600] start=0x0a97
[codex:390600] end=0x0b41
[codex:390600]
[codex:390600] stack=[\"ret\", \"a1\", \"a2\", \"a3\", \"a4\", \"a5\"] # bottom->top
[codex:390600]
[codex:390600] def push(x):
[codex:390600] stack.append(x)
[codex:390600]
[codex:390600] def pop(n=1):
[codex:390600] for _ in range(n):
[codex:390600] stack.pop()
[codex:390600]
[codex:390600] def dup(n):
[codex:390600] stack.append(stack[-n])
[codex:390600]
[codex:390600] def swap(n):
[codex:390600] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:390600]
[codex:390600] pc=start
[codex:390600] # We'll step through linear until end, ignoring jumps; we'll skip into sub-calls by modeling at JUMP to known functions when preceded by PUSH2 ret.
[codex:390600] # To keep simple, we'll treat JUMP to 0x0c6f,0x043b,0x0d3c as internal call, and simulate return value.
[codex:390600] # We'll proceed sequentially by pc order, not control flow.
[codex:390600]
[codex:390600] # create list of ops within range for sequential iteration
[codex:390600] ops_range=[op for op in ops if start<=op[0]<=end]
[codex:390600]
[codex:390600] # map for quick sequential
[codex:390600] ops_range.sort()
[codex:390600]
[codex:390600] # helper to print stack
[codex:390600]
[codex:390600] def show(pc,name,arg):
[codex:390600] print(f\"{pc:04x} {name} {arg.hex() if arg else ''} | stack: {stack}\")
[codex:390600]
[codex:390600] # We'll interpret only some ops; for unknowns, just approximate stack effect (pop/push).
[codex:390600]
[codex:390600] for pc,name,arg in ops_range:
[codex:390600] # show(pc,name,arg)
[codex:390600] if name.startswith('PUSH'):
[codex:390600] val=int.from_bytes(arg,'big')
[codex:390600] push(f'0x{val:x}')
[codex:390600] elif name.startswith('DUP'):
[codex:390600] n=int(name[3:])
[codex:390600] dup(n)
[codex:390600] elif name.startswith('SWAP'):
[codex:390600] n=int(name[4:])
[codex:390600] swap(n)
[codex:390600] elif name in ('POP',):
[codex:390600] pop(1)
[codex:390600] elif name in ('ISZERO','NOT'):
[codex:390600] pop(1); push(f'{name}({stack.pop() if False else \"tmp\"})') # placeholder
[codex:390600] elif name in ('EQ','LT','GT','AND','OR','XOR','ADD','SUB','MUL','DIV','MOD','SHL','SHR'):
[codex:390600] pop(2); push(f'{name}(...)')
[codex:390600] elif name in ('SLOAD','CALLER','TIMESTAMP','MLOAD','SHA3'):
[codex:390600] # SLOAD pops key -> pushes val
[codex:390600] if name=='SLOAD': pop(1)
[codex:390600] push(f'{name}()')
[codex:390600] elif name=='JUMP':
[codex:390600] # If previous op was PUSH2 ret and current top is dest? But we can't tell.
[codex:390600] # We'll detect calls by destination values: if top is 0x0c6f etc and stack contains return dest below.
[codex:390600] # For now, ignore control flow.
[codex:390600] pass
[codex:390600] elif name=='JUMPI':
[codex:390600] pop(2)
[codex:390600] elif name in ('REVERT','RETURN','STOP'):
[codex:390600] pass
[codex:390600] elif name=='CALL':
[codex:390600] pop(7); push('CALLRET')
[codex:390600] elif name=='SSTORE':
[codex:390600] pop(2)
[codex:390600] elif name=='MSTORE':
[codex:390600] pop(2)
[codex:390600] elif name=='MSTORE8':
[codex:390600] pop(2)
[codex:390600] elif name=='CALLDATACOPY':
[codex:390600] pop(3)
[codex:390600] elif name=='CALLDATALOAD':
[codex:390600] pop(1); push('CALLDATALOAD')
[codex:390600] elif name=='CALLDATASIZE':
[codex:390600] push('CALLDATASIZE')
[codex:390600] elif name=='EXP':
[codex:390600] pop(2); push('EXP')
[codex:390600] else:
[codex:390600] # ignore other ops
[codex:390600] pass
[codex:390600]
[codex:390600] # We didn't model internal calls; above isn't accurate.
[codex:390600] print('final stack size', len(stack))
[codex:390600] print(stack)
[codex:390600] PY" in /tmp/codex-multi-hun_6o5y succeeded in 24ms:
[codex:390600] final stack size 20
[codex:390600] ['ret', 'a1', 'a2', 'a3', 'a4', 'a5', '0x0', '0x0', '0xaa4', 'a2', '0xc6f', '0xac6', 'a4', '0x0', '0x0', '0x0', '0x0', '0xae8', '0x0', '0x0']
[codex:390600]
[codex:390600] thinking
[codex:390600] **Designing a symbolic interpreter for internal calls**
[codex:390600]
[codex:390600] I'm devising a precise simulation for the 0x0a97 region by modeling internal calls via `JUMP` instructions to known addresses as function calls, popping arguments and return addresses from the stack and pushing placeholder results to mimic call/return behavior without executing callee code. This will help accurately track stack state through complex control flow patterns.
[codex:390600] exec
[codex:390600] /bin/bash -lc "python - <<'PY'
[codex:390600] import binascii
[codex:390600] hexdata=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex')[1].split('\\n',1)[1].strip()
[codex:390600] if hexdata.startswith('0x'): hexdata=hexdata[2:]
[codex:390600] code=bytes.fromhex(hexdata)
[codex:390600]
[codex:390600] # disasm
[codex:390600] opnames = {i: f'PUSH{i-0x5f}' for i in range(0x60,0x80)}
[codex:390600] opnames.update({i: f'DUP{i-0x7f}' for i in range(0x80,0x90)})
[codex:390600] opnames.update({i: f'SWAP{i-0x8f}' for i in range(0x90,0xa0)})
[codex:390600] # others
[codex:390600] opnames.update({0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:390600] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:390600] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:390600] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:390600] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:390600] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'})
[codex:390600]
[codex:390600] # build ops list
[codex:390600] ops=[]
[codex:390600] pc=0
[codex:390600] while pc < len(code):
[codex:390600] op=code[pc]
[codex:390600] name=opnames.get(op, f'OP{op:02x}')
[codex:390600] if 0x60 <= op <= 0x7f:
[codex:390600] n=op-0x5f
[codex:390600] arg=code[pc+1:pc+1+n]
[codex:390600] ops.append((pc,name,int.from_bytes(arg,'big')))
[codex:390600] pc+=1+n
[codex:390600] else:
[codex:390600] ops.append((pc,name,None))
[codex:390600] pc+=1
[codex:390600]
[codex:390600] opdict={pc:(name,arg) for pc,name,arg in ops}
[codex:390600]
[codex:390600] start=0x0a97
[codex:390600] end=0x0b41
[codex:390600]
[codex:390600] # create list of pcs in range
[codex:390600] pcs=[pc for pc,_,_ in ops if start<=pc<=end]
[codex:390600] pcs.sort()
[codex:390600]
[codex:390600] # stack with labels
[codex:390600] stack=['ret','a1','a2','a3','a4','a5'] # bottom->top
[codex:390600]
[codex:390600] # define helper functions
[codex:390600]
[codex:390600] def push(x): stack.append(x)
[codex:390600]
[codex:390600] def pop(n=1):
[codex:390600] for _ in range(n):
[codex:390600] stack.pop()
[codex:390600]
[codex:390600] def dup(n): stack.append(stack[-n])
[codex:390600]
[codex:390600] def swap(n): stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:390600]
[codex:390600] def binary(op):
[codex:390600] b=stack.pop(); a=stack.pop(); stack.append(f'{op}({a},{b})')
[codex:390600]
[codex:390600] # function signatures
[codex:390600] # dest: (num_args, return_label)
[codex:390600] func_sigs={0x0c6f:(2,'ecrecover'), 0x043b:(1,'isSigner'), 0x0d3c:(1,None)}
[codex:390600]
[codex:390600] # to control jumps, we will simulate linear order but when encountering JUMP to these destinations, we simulate call by popping dest and args+ret and pushing return value
[codex:390600]
[codex:390600] for pc in pcs:
[codex:390600] name,arg = opdict[pc]
[codex:390600] # print state at key points
[codex:390600] if pc in (0x0a97,0x0aa4,0x0ac6,0x0afc):
[codex:390600] print(f'pc {pc:04x} {name} stack={stack}')
[codex:390600] if name.startswith('PUSH'):
[codex:390600] push(f'0x{arg:x}')
[codex:390600] elif name.startswith('DUP'):
[codex:390600] dup(int(name[3:]))
[codex:390600] elif name.startswith('SWAP'):
[codex:390600] swap(int(name[4:]))
[codex:390600] elif name=='POP':
[codex:390600] pop(1)
[codex:390600] elif name in ('ADD','SUB','MUL','DIV','MOD','EQ','LT','GT','AND','OR','XOR'):
[codex:390600] binary(name)
[codex:390600] elif name=='ISZERO':
[codex:390600] a=stack.pop(); stack.append(f'iszero({a})')
[codex:390600] elif name=='SLOAD':
[codex:390600] a=stack.pop(); stack.append(f'sload({a})')
[codex:390600] elif name=='CALLER':
[codex:390600] push('caller')
[codex:390600] elif name=='TIMESTAMP':
[codex:390600] push('timestamp')
[codex:390600] elif name=='MLOAD':
[codex:390600] a=stack.pop(); stack.append(f'mload({a})')
[codex:390600] elif name=='SHA3':
[codex:390600] a=stack.pop(); b=stack.pop(); stack.append(f'keccak({b},{a})')
[codex:390600] elif name=='JUMPI':
[codex:390600] pop(2)
[codex:390600] elif name=='JUMP':
[codex:390600] # handle internal call if dest is constant on top
[codex:390600] dest = stack[-1]
[codex:390600] if isinstance(dest,str) and dest.startswith('0x'):
[codex:390600] d=int(dest,16)
[codex:390600] if d in func_sigs:
[codex:390600] # pop dest
[codex:390600] stack.pop()
[codex:390600] nargs,retlabel=func_sigs[d]
[codex:390600] # args are on top, ret address below them
[codex:390600] args=[stack.pop() for _ in range(nargs)]
[codex:390600] ret=stack.pop() # return address
[codex:390600] # discard ret, push return value if any
[codex:390600] if retlabel:
[codex:390600] stack.append(f'{retlabel}({\",\".join(reversed(args))})')
[codex:390600] # continue (pc linear)
[codex:390600] else:
[codex:390600] # regular jump: pop dest
[codex:390600] stack.pop()
[codex:390600] else:
[codex:390600] # dynamic jump
[codex:390600] stack.pop()
[codex:390600] elif name in ('REVERT','RETURN','STOP'):
[codex:390600] pass
[codex:390600] elif name in ('SSTORE','MSTORE','MSTORE8'):
[codex:390600] pop(2)
[codex:390600] elif name=='CALLDATACOPY':
[codex:390600] pop(3)
[codex:390600] elif name=='CALLDATALOAD':
[codex:390600] a=stack.pop(); stack.append(f'calldataload({a})')
[codex:390600] elif name=='EXP':
[codex:390600] binary('exp')
[codex:390600] elif name=='CALL':
[codex:390600] pop(7); stack.append('callret')
[codex:390600] else:
[codex:390600] # ignore others
[codex:390600] pass
[codex:390600]
[codex:390600] print('final stack', stack)
[codex:390600] PY" in /tmp/codex-multi-hun_6o5y succeeded in 21ms:
[codex:390600] pc 0a97 JUMPDEST stack=['ret', 'a1', 'a2', 'a3', 'a4', 'a5']
[codex:390600] pc 0aa4 JUMPDEST stack=['ret', 'a1', 'a2', 'a3', 'a4', 'a5', '0x0', '0x0', 'ecrecover(a2,a3)']
[codex:390600] pc 0ac6 JUMPDEST stack=['ret', 'a1', 'a2', 'a3', 'a4', 'a5', '0x0', 'ecrecover(a2,a3)', 'isSigner(a1)']
[codex:390600] pc 0afc JUMPDEST stack=['ret', 'a1', 'a2', 'a3', 'a4', 'a5', '0x0', 'ecrecover(a2,a3)', '0x0', '0x0', '0x0', '0x0', '0x0', '0x0']
[codex:390600] final stack ['ret', 'a1', 'a2', 'a3', 'a4', 'a5', '0x0', 'ecrecover(a2,a3)', '0x0']
[codex:390600]
[codex:390600]
[codex:390600]
[codex:390600]
[codex:390600] thinking
[codex:390600] **Analyzing EVM stack and control flow**
[codex:390600]
[codex:390600] I'm carefully reconstructing the EVM stack changes and jumps to understand the success path logic, tracking DUPs, SWAPs, and calls with precise stack states. This deep dive aims to align symbolic stack states with control flow to clarify how the contract verifies signatures and conditions on the success path.
[codex:390600] thinking
[codex:390600] **Decoding precise stack usage and signature logic**
[codex:390600]
[codex:390600] I’m untangling the exact roles of stack elements and confirming how the code validates the signature by checking booleans, signer addresses, and timestamps. It looks like A1 and recovered addresses are critical, with layered checks enforcing that the recovered signer matches the caller and timing constraints ensure validity. This helps clarify the intended security checks along the success path.
[codex:390600] thinking
[codex:390600] **Analyzing signature and nonce verification logic**
[codex:390600]
[codex:390600] I’m unpacking how the contract enforces authorization using signatures, signer checks, and a sliding nonce window to prevent replay. The nonce management uses a sorted array of recent nonces with bounds, ensuring uniqueness and preventing outdated replays. This highlights strong replay protection and signer validations that the user’s signature and any enabled multi-sig flags require.
[codex:390600] thinking
[codex:390600] **Evaluating potential bypasses and storage protections**
[codex:390600]
[codex:390600] I’m scrutinizing whether any calls can bypass signer checks, if storage can be modified by unauthorized users, and if signature or nonce handling allows replay or misuse. The contract enforces signer validation strictly and restricts state changes to signers, so no straightforward exploit path for outsiders emerges. I’m also checking multi-signature assumptions and whether any subtle bugs could allow a single signer to bypass intended constraints.
[codex:390600] exec
[codex:390600] /bin/bash -lc "python - <<'PY'
[codex:390600] import binascii
[codex:390600] hexdata=open('BYTECODE_BUNDLE.txt').read().split('FILE: runtime_bytecode.hex')[1].split('\\n',1)[1].strip()
[codex:390600] if hexdata.startswith('0x'): hexdata=hexdata[2:]
[codex:390600] code=bytes.fromhex(hexdata)
[codex:390600] ops=[(i,b) for i,b in enumerate(code) if b in (0xf4,0xff,0xf2)]
[codex:390600] print('delegatecall/selfdestruct/callcode op positions:', ops)
[codex:390600] PY" in /tmp/codex-multi-hun_6o5y succeeded in 18ms:
[codex:390600] delegatecall/selfdestruct/callcode op positions: [(49, 255), (50, 255), (51, 255), (52, 255), (101, 244), (191, 255), (192, 255), (193, 255), (194, 255), (195, 255), (196, 255), (197, 255), (198, 255), (199, 255), (200, 255), (201, 255), (202, 255), (203, 255), (204, 255), (205, 255), (206, 255), (207, 255), (208, 255), (209, 255), (210, 255), (213, 255), (214, 255), (215, 255), (216, 255), (217, 255), (218, 255), (219, 255), (220, 255), (221, 255), (222, 255), (223, 255), (224, 255), (225, 255), (226, 255), (227, 255), (228, 255), (229, 255), (230, 255), (231, 255), (232, 255), (335, 255), (336, 255), (337, 255), (338, 255), (339, 255), (340, 255), (341, 255), (342, 255), (343, 255), (344, 255), (345, 255), (346, 255), (347, 255), (348, 255), (349, 255), (350, 255), (351, 255), (352, 255), (353, 255), (354, 255), (357, 255), (358, 255), (359, 255), (360, 255), (361, 255), (362, 255), (363, 255), (364, 255), (365, 255), (366, 255), (367, 255), (368, 255), (369, 255), (370, 255), (371, 255), (372, 255), (373, 255), (374, 255), (375, 255), (376, 255), (423, 255), (424, 255), (425, 255), (426, 255), (427, 255), (428, 255), (429, 255), (430, 255), (431, 255), (432, 255), (433, 255), (434, 255), (435, 255), (436, 255), (437, 255), (438, 255), (439, 255), (440, 255), (441, 255), (442, 255), (624, 255), (625, 255), (626, 255), (627, 255), (628, 255), (629, 255), (630, 255), (631, 255), (632, 255), (633, 255), (634, 255), (635, 255), (636, 255), (637, 255), (638, 255), (639, 255), (640, 255), (641, 255), (642, 255), (643, 255), (791, 255), (792, 255), (793, 255), (794, 255), (795, 255), (796, 255), (797, 255), (798, 255), (799, 255), (800, 255), (801, 255), (802, 255), (803, 255), (804, 255), (805, 255), (806, 255), (807, 255), (808, 255), (809, 255), (810, 255), (823, 255), (824, 255), (825, 255), (826, 255), (827, 255), (828, 255), (829, 255), (830, 255), (831, 255), (832, 255), (833, 255), (834, 255), (835, 255), (836, 255), (837, 255), (838, 255), (839, 255), (840, 255), (841, 255), (842, 255), (1060, 255), (1061, 255), (1062, 255), (1063, 255), (1064, 255), (1065, 255), (1066, 255), (1067, 255), (1068, 255), (1069, 255), (1070, 255), (1071, 255), (1072, 255), (1073, 255), (1074, 255), (1075, 255), (1076, 255), (1077, 255), (1078, 255), (1079, 255), (1107, 255), (1108, 255), (1109, 255), (1110, 255), (1111, 255), (1112, 255), (1113, 255), (1114, 255), (1115, 255), (1116, 255), (1117, 255), (1118, 255), (1119, 255), (1120, 255), (1121, 255), (1122, 255), (1123, 255), (1124, 255), (1125, 255), (1126, 255), (1165, 255), (1166, 255), (1167, 255), (1168, 255), (1169, 255), (1170, 255), (1171, 255), (1172, 255), (1173, 255), (1174, 255), (1175, 255), (1176, 255), (1177, 255), (1178, 255), (1179, 255), (1180, 255), (1181, 255), (1182, 255), (1183, 255), (1184, 255), (1187, 255), (1188, 255), (1189, 255), (1190, 255), (1191, 255), (1192, 255), (1193, 255), (1194, 255), (1195, 255), (1196, 255), (1197, 255), (1198, 255), (1199, 255), (1200, 255), (1201, 255), (1202, 255), (1203, 255), (1204, 255), (1205, 255), (1206, 255), (1260, 242), (1280, 255), (1313, 255), (1333, 255), (1334, 255), (1335, 255), (1336, 255), (1337, 255), (1338, 255), (1339, 255), (1340, 255), (1341, 255), (1342, 255), (1343, 255), (1344, 255), (1345, 255), (1346, 255), (1347, 255), (1348, 255), (1349, 255), (1350, 255), (1351, 255), (1352, 255), (1355, 255), (1356, 255), (1357, 255), (1358, 255), (1359, 255), (1360, 255), (1361, 255), (1362, 255), (1363, 255), (1364, 255), (1365, 255), (1366, 255), (1367, 255), (1368, 255), (1369, 255), (1370, 255), (1371, 255), (1372, 255), (1373, 255), (1374, 255), (1471, 255), (1472, 255), (1473, 255), (1474, 255), (1475, 255), (1476, 255), (1477, 255), (1478, 255), (1479, 255), (1480, 255), (1481, 255), (1482, 255), (1483, 255), (1484, 255), (1485, 255), (1486, 255), (1487, 255), (1488, 255), (1489, 255), (1490, 255), (1493, 255), (1494, 255), (1495, 255), (1496, 255), (1497, 255), (1498, 255), (1499, 255), (1500, 255), (1501, 255), (1502, 255), (1503, 255), (1504, 255), (1505, 255), (1506, 255), (1507, 255), (1508, 255), (1509, 255), (1510, 255), (1511, 255), (1512, 255), (1774, 255), (1775, 255), (1776, 255), (1777, 255), (1778, 255), (1779, 255), (1780, 255), (1781, 255), (1782, 255), (1783, 255), (1784, 255), (1785, 255), (1786, 255), (1787, 255), (1788, 255), (1789, 255), (1790, 255), (1791, 255), (1792, 255), (1793, 255), (1881, 255), (1882, 255), (1883, 255), (1884, 255), (1885, 255), (1886, 255), (1887, 255), (1888, 255), (1889, 255), (1890, 255), (1891, 255), (1892, 255), (1893, 255), (1894, 255), (1895, 255), (1896, 255), (1897, 255), (1898, 255), (1899, 255), (1900, 255), (1903, 255), (1904, 255), (1905, 255), (1906, 255), (1907, 255), (1908, 255), (1909, 255), (1910, 255), (1911, 255), (1912, 255), (1913, 255), (1914, 255), (1915, 255), (1916, 255), (1917, 255), (1918, 255), (1919, 255), (1920, 255), (1921, 255), (1922, 255), (1931, 255), (1932, 255), (1933, 255), (1934, 255), (1935, 255), (1936, 255), (1937, 255), (1938, 255), (1939, 255), (1940, 255), (1941, 255), (1942, 255), (1943, 255), (1944, 255), (1945, 255), (1946, 255), (1947, 255), (1948, 255), (1949, 255), (1950, 255), (1953, 255), (1954, 255), (1955, 255), (1956, 255), (1957, 255), (1958, 255), (1959, 255), (1960, 255), (1961, 255), (1962, 255), (1963, 255), (1964, 255), (1965, 255), (1966, 255), (1967, 255), (1968, 255), (1969, 255), (1970, 255), (1971, 255), (1972, 255), (1981, 255), (1982, 255), (1983, 255), (1984, 255), (1985, 255), (1986, 255), (1987, 255), (1988, 255), (1989, 255), (1990, 255), (1991, 255), (1992, 255), (1993, 255), (1994, 255), (1995, 255), (1996, 255), (1997, 255), (1998, 255), (1999, 255), (2000, 255), (2003, 255), (2004, 255), (2005, 255), (2006, 255), (2007, 255), (2008, 255), (2009, 255), (2010, 255), (2011, 255), (2012, 255), (2013, 255), (2014, 255), (2015, 255), (2016, 255), (2017, 255), (2018, 255), (2019, 255), (2020, 255), (2021, 255), (2022, 255), (2258, 255), (2259, 255), (2260, 255), (2261, 255), (2262, 255), (2263, 255), (2264, 255), (2265, 255), (2266, 255), (2267, 255), (2268, 255), (2269, 255), (2270, 255), (2271, 255), (2272, 255), (2273, 255), (2274, 255), (2275, 255), (2276, 255), (2277, 255), (2280, 255), (2281, 255), (2282, 255), (2283, 255), (2284, 255), (2285, 255), (2286, 255), (2287, 255), (2288, 255), (2289, 255), (2290, 255), (2291, 255), (2292, 255), (2293, 255), (2294, 255), (2295, 255), (2296, 255), (2297, 255), (2298, 255), (2299, 255), (2329, 255), (2330, 255), (2331, 255), (2332, 255), (2333, 255), (2334, 255), (2335, 255), (2336, 255), (2337, 255), (2338, 255), (2339, 255), (2340, 255), (2341, 255), (2342, 255), (2343, 255), (2344, 255), (2345, 255), (2346, 255), (2347, 255), (2348, 255), (2351, 255), (2352, 255), (2353, 255), (2354, 255), (2355, 255), (2356, 255), (2357, 255), (2358, 255), (2359, 255), (2360, 255), (2361, 255), (2362, 255), (2363, 255), (2364, 255), (2365, 255), (2366, 255), (2367, 255), (2368, 255), (2369, 255), (2370, 255), (2547, 255), (2548, 255), (2549, 255), (2550, 255), (2551, 255), (2552, 255), (2553, 255), (2554, 255), (2555, 255), (2556, 255), (2557, 255), (2558, 255), (2559, 255), (2560, 255), (2561, 255), (2562, 255), (2563, 255), (2564, 255), (2565, 255), (2566, 255), (2576, 255), (2577, 255), (2578, 255), (2579, 255), (2707, 255), (2741, 255), (2815, 255), (2816, 255), (2817, 255), (2818, 255), (2819, 255), (2820, 255), (2821, 255), (2822, 255), (2823, 255), (2824, 255), (2825, 255), (2826, 255), (2827, 255), (2828, 255), (2829, 255), (2830, 255), (2831, 255), (2832, 255), (2833, 255), (2834, 255), (2838, 255), (2839, 255), (2840, 255), (2841, 255), (2842, 255), (2843, 255), (2844, 255), (2845, 255), (2846, 255), (2847, 255), (2848, 255), (2849, 255), (2850, 255), (2851, 255), (2852, 255), (2853, 255), (2854, 255), (2855, 255), (2856, 255), (2857, 255), (2900, 255), (2901, 255), (2902, 255), (2903, 255), (2904, 255), (2905, 255), (2906, 255), (2907, 255), (2908, 255), (2909, 255), (2910, 255), (2911, 255), (2912, 255), (2913, 255), (2914, 255), (2915, 255), (2916, 255), (2917, 255), (2918, 255), (2919, 255), (2922, 255), (2923, 255), (2924, 255), (2925, 255), (2926, 255), (2927, 255), (2928, 255), (2929, 255), (2930, 255), (2931, 255), (2932, 255), (2933, 255), (2934, 255), (2935, 255), (2936, 255), (2937, 255), (2938, 255), (2939, 255), (2940, 255), (2941, 255), (3007, 255), (3008, 255), (3009, 255), (3010, 255), (3011, 255), (3012, 255), (3013, 255), (3014, 255), (3015, 255), (3016, 255), (3017, 255), (3018, 255), (3019, 255), (3020, 255), (3021, 255), (3022, 255), (3023, 255), (3024, 255), (3025, 255), (3026, 255), (3027, 255), (3028, 255), (3029, 255), (3030, 255), (3031, 255), (3032, 255), (3033, 255), (3034, 255), (3044, 255), (3045, 255), (3046, 255), (3047, 255), (3048, 255), (3049, 255), (3050, 255), (3051, 255), (3052, 255), (3053, 255), (3054, 255), (3055, 255), (3056, 255), (3057, 255), (3058, 255), (3059, 255), (3060, 255), (3061, 255), (3062, 255), (3063, 255), (3064, 255), (3065, 255), (3066, 255), (3067, 255), (3068, 255), (3069, 255), (3070, 255), (3071, 255), (3090, 255), (3123, 255), (3221, 255), (3234, 255), (3288, 255), (3291, 255), (3641, 242)]
[codex:390600]
[codex:390600] thinking
[codex:390600] **Confirming no exploitable issues found**
[codex:390600] codex
[codex:390600] {"no_findings":true,"summary":"No concrete, exploitable value-extraction path identified from the bytecode; value transfers and state changes are consistently gated by signer checks, and no unprotected delegatecall/selfdestruct/upgrade path is visible.","findings":[]}
[codex:390600] tokens used
[codex:390600] 86,983
[codex:390600] {"no_findings":true,"summary":"No concrete, exploitable value-extraction path identified from the bytecode; value transfers and state changes are consistently gated by signer checks, and no unprotected delegatecall/selfdestruct/upgrade path is visible.","findings":[]}
{
"codex": {
"ran_at": "2026-01-02T01:56:15.684231+00:00",
"returncode": 0
},
"summary": "No concrete, exploitable value-extraction path identified from the bytecode; value transfers and state changes are consistently gated by signer checks, and no unprotected delegatecall/selfdestruct/upgrade path is visible.",
"raw_final": {
"summary": "No concrete, exploitable value-extraction path identified from the bytecode; value transfers and state changes are consistently gated by signer checks, and no unprotected delegatecall/selfdestruct/upgrade path is visible.",
"findings": [],
"no_findings": true
},
"no_findings": true,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x0083 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH29 0x0100000000000000000000000000000000000000000000000000000000 0000002e: SWAP1 0000002f: DIV 00000030: PUSH4 0xffffffff 00000035: AND 00000036: DUP1 00000037: PUSH4 0x2079fb9a 0000003c: EQ 0000003d: PUSH2 0x011d 00000040: JUMPI 00000041: DUP1 00000042: PUSH4 0x7df73e27 00000047: EQ 00000048: PUSH2 0x018a 0000004b: JUMPI 0000004c: DUP1 0000004d: PUSH4 0x959f9114 00000052: EQ 00000053: PUSH2 0x01e5 00000056: JUMPI 00000057: DUP1 00000058: PUSH4 0x97f6c448 0000005d: EQ 0000005e: PUSH2 0x01fc 00000061: JUMPI 00000062: DUP1 00000063: PUSH4 0x98f44b9a 00000068: EQ 00000069: PUSH2 0x02dc 0000006c: JUMPI 0000006d: DUP1 0000006e: PUSH4 0xa0b7967b 00000073: EQ 00000074: PUSH2 0x03a3 00000077: JUMPI 00000078: DUP1 00000079: PUSH4 0xabe3219c 0000007e: EQ 0000007f: PUSH2 0x03ce 00000082: JUMPI 00000083: JUMPDEST 00000084: PUSH1 0x00 00000086: CALLVALUE 00000087: GT 00000088: ISZERO 00000089: PUSH2 0x011b 0000008c: JUMPI 0000008d: PUSH32 0x0113761859388286b05db53a5354f9ae21375ba9131de67113c0964d7bc397b1 000000ae: CALLVALUE 000000af: CALLER 000000b0: PUSH1 0x00 000000b2: CALLDATASIZE 000000b3: PUSH1 0x40 000000b5: MLOAD 000000b6: DUP1 000000b7: DUP6 000000b8: DUP2 000000b9: MSTORE 000000ba: PUSH1 0x20 000000bc: ADD 000000bd: DUP5 000000be: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000d3: AND 000000d4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000e9: AND 000000ea: DUP2 000000eb: MSTORE 000000ec: PUSH1 0x20 000000ee: ADD 000000ef: DUP1 000000f0: PUSH1 0x20 000000f2: ADD 000000f3: DUP3 000000f4: DUP2 000000f5: SUB 000000f6: DUP3 000000f7: MSTORE 000000f8: DUP5 000000f9: DUP5 000000fa: DUP3 000000fb: DUP2 000000fc: DUP2 000000fd: MSTORE 000000fe: PUSH1 0x20 00000100: ADD 00000101: SWAP3 00000102: POP 00000103: DUP1 00000104: DUP3 00000105: DUP5 00000106: CALLDATACOPY 00000107: DUP3 00000108: ADD 00000109: SWAP2 0000010a: POP 0000010b: POP 0000010c: SWAP6 0000010d: POP 0000010e: POP 0000010f: POP 00000110: POP 00000111: POP 00000112: POP 00000113: PUSH1 0x40 00000115: MLOAD 00000116: DUP1 00000117: SWAP2 00000118: SUB 00000119: SWAP1 0000011a: LOG1 0000011b: JUMPDEST 0000011c: STOP 0000011d: JUMPDEST 0000011e: CALLVALUE 0000011f: DUP1 00000120: ISZERO 00000121: PUSH2 0x0129 00000124: JUMPI 00000125: PUSH1 0x00 00000127: DUP1 00000128: REVERT 00000129: JUMPDEST 0000012a: POP 0000012b: PUSH2 0x0148 0000012e: PUSH1 0x04 00000130: DUP1 00000131: CALLDATASIZE 00000132: SUB 00000133: DUP2 00000134: ADD 00000135: SWAP1 00000136: DUP1 00000137: DUP1 00000138: CALLDATALOAD 00000139: SWAP1 0000013a: PUSH1 0x20 0000013c: ADD 0000013d: SWAP1 0000013e: SWAP3 0000013f: SWAP2 00000140: SWAP1 00000141: POP 00000142: POP 00000143: POP 00000144: PUSH2 0x03fd 00000147: JUMP 00000148: JUMPDEST 00000149: PUSH1 0x40 0000014b: MLOAD 0000014c: DUP1 0000014d: DUP3 0000014e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000163: AND 00000164: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000179: AND 0000017a: DUP2 0000017b: MSTORE 0000017c: PUSH1 0x20 0000017e: ADD 0000017f: SWAP2 00000180: POP 00000181: POP 00000182: PUSH1 0x40 00000184: MLOAD 00000185: DUP1 00000186: SWAP2 00000187: SUB 00000188: SWAP1 00000189: RETURN 0000018a: JUMPDEST 0000018b: CALLVALUE 0000018c: DUP1 0000018d: ISZERO 0000018e: PUSH2 0x0196 00000191: JUMPI 00000192: PUSH1 0x00 00000194: DUP1 00000195: REVERT 00000196: JUMPDEST 00000197: POP 00000198: PUSH2 0x01cb 0000019b: PUSH1 0x04 0000019d: DUP1 0000019e: CALLDATASIZE 0000019f: SUB 000001a0: DUP2 000001a1: ADD 000001a2: SWAP1 000001a3: DUP1 000001a4: DUP1 000001a5: CALLDATALOAD 000001a6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000001bb: AND 000001bc: SWAP1 000001bd: PUSH1 0x20 000001bf: ADD 000001c0: SWAP1 000001c1: SWAP3 000001c2: SWAP2 000001c3: SWAP1 000001c4: POP 000001c5: POP 000001c6: POP 000001c7: PUSH2 0x043b 000001ca: JUMP 000001cb: JUMPDEST 000001cc: PUSH1 0x40 000001ce: MLOAD 000001cf: DUP1 000001d0: DUP3 000001d1: ISZERO 000001d2: ISZERO 000001d3: ISZERO 000001d4: ISZERO 000001d5: DUP2 000001d6: MSTORE 000001d7: PUSH1 0x20 000001d9: ADD 000001da: SWAP2 000001db: POP 000001dc: POP 000001dd: PUSH1 0x40 000001df: MLOAD 000001e0: DUP1 000001e1: SWAP2 000001e2: SUB 000001e3: SWAP1 000001e4: RETURN 000001e5: JUMPDEST 000001e6: CALLVALUE 000001e7: DUP1 000001e8: ISZERO 000001e9: PUSH2 0x01f1 000001ec: JUMPI 000001ed: PUSH1 0x00 000001ef: DUP1 000001f0: REVERT 000001f1: JUMPDEST 000001f2: POP 000001f3: PUSH2 0x01fa 000001f6: PUSH2 0x04de 000001f9: JUMP 000001fa: JUMPDEST 000001fb: STOP 000001fc: JUMPDEST 000001fd: PUSH2 0x02da 00000200: PUSH1 0x04 00000202: DUP1 00000203: CALLDATASIZE 00000204: SUB 00000205: DUP2 00000206: ADD 00000207: SWAP1 00000208: DUP1 00000209: DUP1 0000020a: CALLDATALOAD 0000020b: SWAP1 0000020c: PUSH1 0x20 0000020e: ADD 0000020f: SWAP1 00000210: SWAP3 00000211: SWAP2 00000212: SWAP1 00000213: DUP1 00000214: CALLDATALOAD 00000215: SWAP1 00000216: PUSH1 0x20 00000218: ADD 00000219: SWAP1 0000021a: SWAP3 0000021b: SWAP2 0000021c: SWAP1 0000021d: DUP1 0000021e: CALLDATALOAD 0000021f: SWAP1 00000220: PUSH1 0x20 00000222: ADD 00000223: SWAP1 00000224: DUP3 00000225: ADD 00000226: DUP1 00000227: CALLDATALOAD 00000228: SWAP1 00000229: PUSH1 0x20 0000022b: ADD 0000022c: SWAP1 0000022d: DUP1 0000022e: DUP1 0000022f: PUSH1 0x1f 00000231: ADD 00000232: PUSH1 0x20 00000234: DUP1 00000235: SWAP2 00000236: DIV 00000237: MUL 00000238: PUSH1 0x20 0000023a: ADD 0000023b: PUSH1 0x40 0000023d: MLOAD 0000023e: SWAP1 0000023f: DUP2 00000240: ADD 00000241: PUSH1 0x40 00000243: MSTORE 00000244: DUP1 00000245: SWAP4 00000246: SWAP3 00000247: SWAP2 00000248: SWAP1 00000249: DUP2 0000024a: DUP2 0000024b: MSTORE 0000024c: PUSH1 0x20 0000024e: ADD 0000024f: DUP4 00000250: DUP4 00000251: DUP1 00000252: DUP3 00000253: DUP5 00000254: CALLDATACOPY 00000255: DUP3 00000256: ADD 00000257: SWAP2 00000258: POP 00000259: POP 0000025a: POP 0000025b: POP 0000025c: POP 0000025d: POP 0000025e: SWAP2 0000025f: SWAP3 00000260: SWAP2 00000261: SWAP3 00000262: SWAP1 00000263: DUP1 00000264: CALLDATALOAD 00000265: SWAP1 00000266: PUSH1 0x20 00000268: ADD 00000269: SWAP1 0000026a: SWAP3 0000026b: SWAP2 0000026c: SWAP1 0000026d: DUP1 0000026e: CALLDATALOAD 0000026f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000284: AND 00000285: SWAP1 00000286: PUSH1 0x20 00000288: ADD 00000289: SWAP1 0000028a: SWAP3 0000028b: SWAP2 0000028c: SWAP1 0000028d: DUP1 0000028e: CALLDATALOAD 0000028f: SWAP1 00000290: PUSH1 0x20 00000292: ADD 00000293: SWAP1 00000294: DUP3 00000295: ADD 00000296: DUP1 00000297: CALLDATALOAD 00000298: SWAP1 00000299: PUSH1 0x20 0000029b: ADD 0000029c: SWAP1 0000029d: DUP1 0000029e: DUP1 0000029f: PUSH1 0x1f 000002a1: ADD 000002a2: PUSH1 0x20 000002a4: DUP1 000002a5: SWAP2 000002a6: DIV 000002a7: MUL 000002a8: PUSH1 0x20 000002aa: ADD 000002ab: PUSH1 0x40 000002ad: MLOAD 000002ae: SWAP1 000002af: DUP2 000002b0: ADD 000002b1: PUSH1 0x40 000002b3: MSTORE 000002b4: DUP1 000002b5: SWAP4 000002b6: SWAP3 000002b7: SWAP2 000002b8: SWAP1 000002b9: DUP2 000002ba: DUP2 000002bb: MSTORE 000002bc: PUSH1 0x20 000002be: ADD 000002bf: DUP4 000002c0: DUP4 000002c1: DUP1 000002c2: DUP3 000002c3: DUP5 000002c4: CALLDATACOPY 000002c5: DUP3 000002c6: ADD 000002c7: SWAP2 000002c8: POP 000002c9: POP 000002ca: POP 000002cb: POP 000002cc: POP 000002cd: POP 000002ce: SWAP2 000002cf: SWAP3 000002d0: SWAP2 000002d1: SWAP3 000002d2: SWAP1 000002d3: POP 000002d4: POP 000002d5: POP 000002d6: PUSH2 0x0571 000002d9: JUMP 000002da: JUMPDEST 000002db: STOP 000002dc: JUMPDEST 000002dd: CALLVALUE 000002de: DUP1 000002df: ISZERO 000002e0: PUSH2 0x02e8 000002e3: JUMPI 000002e4: PUSH1 0x00 000002e6: DUP1 000002e7: REVERT 000002e8: JUMPDEST 000002e9: POP 000002ea: PUSH2 0x03a1 000002ed: PUSH1 0x04 000002ef: DUP1 000002f0: CALLDATASIZE 000002f1: SUB 000002f2: DUP2 000002f3: ADD 000002f4: SWAP1 000002f5: DUP1 000002f6: DUP1 000002f7: CALLDATALOAD 000002f8: SWAP1 000002f9: PUSH1 0x20 000002fb: ADD 000002fc: SWAP1 000002fd: SWAP3 000002fe: SWAP2 000002ff: SWAP1 00000300: DUP1 00000301: CALLDATALOAD 00000302: SWAP1 00000303: PUSH1 0x20 00000305: ADD 00000306: SWAP1 00000307: SWAP3 00000308: SWAP2 00000309: SWAP1 0000030a: DUP1 0000030b: CALLDATALOAD 0000030c: SWAP1 0000030d: PUSH1 0x20 0000030f: ADD 00000310: SWAP1 00000311: SWAP3 00000312: SWAP2 00000313: SWAP1 00000314: DUP1 00000315: CALLDATALOAD 00000316: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000032b: AND 0000032c: SWAP1 0000032d: PUSH1 0x20 0000032f: ADD 00000330: SWAP1 00000331: SWAP3 00000332: SWAP2 00000333: SWAP1 00000334: DUP1 00000335: CALLDATALOAD 00000336: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000034b: AND 0000034c: SWAP1 0000034d: PUSH1 0x20 0000034f: ADD 00000350: SWAP1 00000351: SWAP3 00000352: SWAP2 00000353: SWAP1 00000354: DUP1 00000355: CALLDATALOAD 00000356: SWAP1 00000357: PUSH1 0x20 00000359: ADD 0000035a: SWAP1 0000035b: DUP3 0000035c: ADD 0000035d: DUP1 0000035e: CALLDATALOAD 0000035f: SWAP1 00000360: PUSH1 0x20 00000362: ADD 00000363: SWAP1 00000364: DUP1 00000365: DUP1 00000366: PUSH1 0x1f 00000368: ADD 00000369: PUSH1 0x20 0000036b: DUP1 0000036c: SWAP2 0000036d: DIV 0000036e: MUL 0000036f: PUSH1 0x20 00000371: ADD 00000372: PUSH1 0x40 00000374: MLOAD 00000375: SWAP1 00000376: DUP2 00000377: ADD 00000378: PUSH1 0x40 0000037a: MSTORE 0000037b: DUP1 0000037c: SWAP4 0000037d: SWAP3 0000037e: SWAP2 0000037f: SWAP1 00000380: DUP2 00000381: DUP2 00000382: MSTORE 00000383: PUSH1 0x20 00000385: ADD 00000386: DUP4 00000387: DUP4 00000388: DUP1 00000389: DUP3 0000038a: DUP5 0000038b: CALLDATACOPY 0000038c: DUP3 0000038d: ADD 0000038e: SWAP2 0000038f: POP 00000390: POP 00000391: POP 00000392: POP 00000393: POP 00000394: POP 00000395: SWAP2 00000396: SWAP3 00000397: SWAP2 00000398: SWAP3 00000399: SWAP1 0000039a: POP 0000039b: POP 0000039c: POP 0000039d: PUSH2 0x0885 000003a0: JUMP 000003a1: JUMPDEST 000003a2: STOP 000003a3: JUMPDEST 000003a4: CALLVALUE 000003a5: DUP1 000003a6: ISZERO 000003a7: PUSH2 0x03af 000003aa: JUMPI 000003ab: PUSH1 0x00 000003ad: DUP1 000003ae: REVERT 000003af: JUMPDEST 000003b0: POP 000003b1: PUSH2 0x03b8 000003b4: PUSH2 0x0a2a 000003b7: JUMP 000003b8: JUMPDEST 000003b9: PUSH1 0x40 000003bb: MLOAD 000003bc: DUP1 000003bd: DUP3 000003be: DUP2 000003bf: MSTORE 000003c0: PUSH1 0x20 000003c2: ADD 000003c3: SWAP2 000003c4: POP 000003c5: POP 000003c6: PUSH1 0x40 000003c8: MLOAD 000003c9: DUP1 000003ca: SWAP2 000003cb: SUB 000003cc: SWAP1 000003cd: RETURN 000003ce: JUMPDEST 000003cf: CALLVALUE 000003d0: DUP1 000003d1: ISZERO 000003d2: PUSH2 0x03da 000003d5: JUMPI 000003d6: PUSH1 0x00 000003d8: DUP1 000003d9: REVERT 000003da: JUMPDEST 000003db: POP 000003dc: PUSH2 0x03e3 000003df: PUSH2 0x0a84 000003e2: JUMP 000003e3: JUMPDEST 000003e4: PUSH1 0x40 000003e6: MLOAD 000003e7: DUP1 000003e8: DUP3 000003e9: ISZERO 000003ea: ISZERO 000003eb: ISZERO 000003ec: ISZERO 000003ed: DUP2 000003ee: MSTORE 000003ef: PUSH1 0x20 000003f1: ADD 000003f2: SWAP2 000003f3: POP 000003f4: POP 000003f5: PUSH1 0x40 000003f7: MLOAD 000003f8: DUP1 000003f9: SWAP2 000003fa: SUB 000003fb: SWAP1 000003fc: RETURN 000003fd: JUMPDEST 000003fe: PUSH1 0x00 00000400: DUP2 00000401: DUP2 00000402: SLOAD 00000403: DUP2 00000404: LT 00000405: ISZERO 00000406: ISZERO 00000407: PUSH2 0x040c 0000040a: JUMPI 0000040b: INVALID 0000040c: JUMPDEST 0000040d: SWAP1 0000040e: PUSH1 0x00 00000410: MSTORE 00000411: PUSH1 0x20 00000413: PUSH1 0x00 00000415: KECCAK256 00000416: ADD 00000417: PUSH1 0x00 00000419: SWAP2 0000041a: POP 0000041b: SLOAD 0000041c: SWAP1 0000041d: PUSH2 0x0100 00000420: EXP 00000421: SWAP1 00000422: DIV 00000423: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000438: AND 00000439: DUP2 0000043a: JUMP 0000043b: JUMPDEST 0000043c: PUSH1 0x00 0000043e: DUP1 0000043f: PUSH1 0x00 00000441: SWAP1 00000442: POP 00000443: JUMPDEST 00000444: PUSH1 0x00 00000446: DUP1 00000447: SLOAD 00000448: SWAP1 00000449: POP 0000044a: DUP2 0000044b: LT 0000044c: ISZERO 0000044d: PUSH2 0x04d3 00000450: JUMPI 00000451: DUP3 00000452: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000467: AND 00000468: PUSH1 0x00 0000046a: DUP3 0000046b: DUP2 0000046c: SLOAD 0000046d: DUP2 0000046e: LT 0000046f: ISZERO 00000470: ISZERO 00000471: PUSH2 0x0476 00000474: JUMPI 00000475: INVALID 00000476: JUMPDEST 00000477: SWAP1 00000478: PUSH1 0x00 0000047a: MSTORE 0000047b: PUSH1 0x20 0000047d: PUSH1 0x00 0000047f: KECCAK256 00000480: ADD 00000481: PUSH1 0x00 00000483: SWAP1 00000484: SLOAD 00000485: SWAP1 00000486: PUSH2 0x0100 00000489: EXP 0000048a: SWAP1 0000048b: DIV 0000048c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000004a1: AND 000004a2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000004b7: AND 000004b8: EQ 000004b9: ISZERO 000004ba: PUSH2 0x04c6 000004bd: JUMPI 000004be: PUSH1 0x01 000004c0: SWAP2 000004c1: POP 000004c2: PUSH2 0x04d8 000004c5: JUMP 000004c6: JUMPDEST 000004c7: DUP1 000004c8: DUP1 000004c9: PUSH1 0x01 000004cb: ADD 000004cc: SWAP2 000004cd: POP 000004ce: POP 000004cf: PUSH2 0x0443 000004d2: JUMP 000004d3: JUMPDEST 000004d4: PUSH1 0x00 000004d6: SWAP2 000004d7: POP 000004d8: JUMPDEST 000004d9: POP 000004da: SWAP2 000004db: SWAP1 000004dc: POP 000004dd: JUMP 000004de: JUMPDEST 000004df: PUSH2 0x04e7 000004e2: CALLER 000004e3: PUSH2 0x043b 000004e6: JUMP 000004e7: JUMPDEST 000004e8: ISZERO 000004e9: ISZERO 000004ea: PUSH2 0x04f2 000004ed: JUMPI 000004ee: PUSH1 0x00 000004f0: DUP1 000004f1: REVERT 000004f2: JUMPDEST 000004f3: PUSH1 0x01 000004f5: DUP1 000004f6: PUSH1 0x00 000004f8: PUSH2 0x0100 000004fb: EXP 000004fc: DUP2 000004fd: SLOAD 000004fe: DUP2 000004ff: PUSH1 0xff 00000501: MUL 00000502: NOT 00000503: AND 00000504: SWAP1 00000505: DUP4 00000506: ISZERO 00000507: ISZERO 00000508: MUL 00000509: OR 0000050a: SWAP1 0000050b: SSTORE 0000050c: POP 0000050d: PUSH32 0xa7dab64e845898e416ea04214ebc8014aa6c3dff511bcd708bbfa64e1559d55e 0000052e: CALLER 0000052f: PUSH1 0x40 00000531: MLOAD 00000532: DUP1 00000533: DUP3 00000534: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000549: AND 0000054a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000055f: AND 00000560: DUP2 00000561: MSTORE 00000562: PUSH1 0x20 00000564: ADD 00000565: SWAP2 00000566: POP 00000567: POP 00000568: PUSH1 0x40 0000056a: MLOAD 0000056b: DUP1 0000056c: SWAP2 0000056d: SUB 0000056e: SWAP1 0000056f: LOG1 00000570: JUMP 00000571: JUMPDEST 00000572: PUSH1 0x00 00000574: DUP1 00000575: PUSH2 0x057d 00000578: CALLER 00000579: PUSH2 0x043b 0000057c: JUMP 0000057d: JUMPDEST 0000057e: ISZERO 0000057f: ISZERO 00000580: PUSH2 0x0588 00000583: JUMPI 00000584: PUSH1 0x00 00000586: DUP1 00000587: REVERT 00000588: JUMPDEST 00000589: DUP4 0000058a: DUP9 0000058b: DUP8 0000058c: DUP10 0000058d: DUP9 0000058e: PUSH1 0x40 00000590: MLOAD 00000591: PUSH1 0x20 00000593: ADD 00000594: DUP1 00000595: DUP1 00000596: PUSH32 0x4554484552000000000000000000000000000000000000000000000000000000 000005b7: DUP2 000005b8: MSTORE 000005b9: POP 000005ba: PUSH1 0x05 000005bc: ADD 000005bd: DUP7 000005be: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005d3: AND 000005d4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005e9: AND 000005ea: PUSH13 0x01000000000000000000000000 000005f8: MUL 000005f9: DUP2 000005fa: MSTORE 000005fb: PUSH1 0x14 000005fd: ADD 000005fe: DUP6 000005ff: DUP2 00000600: MSTORE 00000601: PUSH1 0x20 00000603: ADD 00000604: DUP5 00000605: DUP1 00000606: MLOAD 00000607: SWAP1 00000608: PUSH1 0x20 0000060a: ADD 0000060b: SWAP1 0000060c: DUP1 0000060d: DUP4 0000060e: DUP4 0000060f: JUMPDEST 00000610: PUSH1 0x20 00000612: DUP4 00000613: LT 00000614: ISZERO 00000615: ISZERO 00000616: PUSH2 0x0634 00000619: JUMPI 0000061a: DUP1 0000061b: MLOAD 0000061c: DUP3 0000061d: MSTORE 0000061e: PUSH1 0x20 00000620: DUP3 00000621: ADD 00000622: SWAP2 00000623: POP 00000624: PUSH1 0x20 00000626: DUP2 00000627: ADD 00000628: SWAP1 00000629: POP 0000062a: PUSH1 0x20 0000062c: DUP4 0000062d: SUB 0000062e: SWAP3 0000062f: POP 00000630: PUSH2 0x060f 00000633: JUMP 00000634: JUMPDEST 00000635: PUSH1 0x01 00000637: DUP4 00000638: PUSH1 0x20 0000063a: SUB 0000063b: PUSH2 0x0100 0000063e: EXP 0000063f: SUB 00000640: DUP1 00000641: NOT 00000642: DUP3 00000643: MLOAD 00000644: AND 00000645: DUP2 00000646: DUP5 00000647: MLOAD 00000648: AND 00000649: DUP1 0000064a: DUP3 0000064b: OR 0000064c: DUP6 0000064d: MSTORE 0000064e: POP 0000064f: POP 00000650: POP 00000651: POP 00000652: POP 00000653: POP 00000654: SWAP1 00000655: POP 00000656: ADD 00000657: DUP4 00000658: DUP2 00000659: MSTORE 0000065a: PUSH1 0x20 0000065c: ADD 0000065d: DUP3 0000065e: DUP2 0000065f: MSTORE 00000660: PUSH1 0x20 00000662: ADD 00000663: SWAP6 00000664: POP 00000665: POP 00000666: POP 00000667: POP 00000668: POP 00000669: POP 0000066a: PUSH1 0x40 0000066c: MLOAD 0000066d: PUSH1 0x20 0000066f: DUP2 00000670: DUP4 00000671: SUB 00000672: SUB 00000673: DUP2 00000674: MSTORE 00000675: SWAP1 00000676: PUSH1 0x40 00000678: MSTORE 00000679: PUSH1 0x40 0000067b: MLOAD 0000067c: DUP1 0000067d: DUP3 0000067e: DUP1 0000067f: MLOAD 00000680: SWAP1 00000681: PUSH1 0x20 00000683: ADD 00000684: SWAP1 00000685: DUP1 00000686: DUP4 00000687: DUP4 00000688: JUMPDEST 00000689: PUSH1 0x20 0000068b: DUP4 0000068c: LT 0000068d: ISZERO 0000068e: ISZERO 0000068f: PUSH2 0x06ad 00000692: JUMPI 00000693: DUP1 00000694: MLOAD 00000695: DUP3 00000696: MSTORE 00000697: PUSH1 0x20 00000699: DUP3 0000069a: ADD 0000069b: SWAP2 0000069c: POP 0000069d: PUSH1 0x20 0000069f: DUP2 000006a0: ADD 000006a1: SWAP1 000006a2: POP 000006a3: PUSH1 0x20 000006a5: DUP4 000006a6: SUB 000006a7: SWAP3 000006a8: POP 000006a9: PUSH2 0x0688 000006ac: JUMP 000006ad: JUMPDEST 000006ae: PUSH1 0x01 000006b0: DUP4 000006b1: PUSH1 0x20 000006b3: SUB 000006b4: PUSH2 0x0100 000006b7: EXP 000006b8: SUB 000006b9: DUP1 000006ba: NOT 000006bb: DUP3 000006bc: MLOAD 000006bd: AND 000006be: DUP2 000006bf: DUP5 000006c0: MLOAD 000006c1: AND 000006c2: DUP1 000006c3: DUP3 000006c4: OR 000006c5: DUP6 000006c6: MSTORE 000006c7: POP 000006c8: POP 000006c9: POP 000006ca: POP 000006cb: POP 000006cc: POP 000006cd: SWAP1 000006ce: POP 000006cf: ADD 000006d0: SWAP2 000006d1: POP 000006d2: POP 000006d3: PUSH1 0x40 000006d5: MLOAD 000006d6: DUP1 000006d7: SWAP2 000006d8: SUB 000006d9: SWAP1 000006da: KECCAK256 000006db: SWAP2 000006dc: POP 000006dd: PUSH2 0x06e9 000006e0: DUP5 000006e1: DUP4 000006e2: DUP6 000006e3: DUP11 000006e4: DUP10 000006e5: PUSH2 0x0a97 000006e8: JUMP 000006e9: JUMPDEST 000006ea: SWAP1 000006eb: POP 000006ec: DUP4 000006ed: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000702: AND 00000703: PUSH2 0x08fc 00000706: DUP10 00000707: SWAP1 00000708: DUP2 00000709: ISZERO 0000070a: MUL 0000070b: SWAP1 0000070c: PUSH1 0x40 0000070e: MLOAD 0000070f: PUSH1 0x00 00000711: PUSH1 0x40 00000713: MLOAD 00000714: DUP1 00000715: DUP4 00000716: SUB 00000717: DUP2 00000718: DUP6 00000719: DUP9 0000071a: DUP9 0000071b: CALL 0000071c: SWAP4 0000071d: POP 0000071e: POP 0000071f: POP 00000720: POP 00000721: ISZERO 00000722: ISZERO 00000723: PUSH2 0x072b 00000726: JUMPI 00000727: PUSH1 0x00 00000729: DUP1 0000072a: REVERT 0000072b: JUMPDEST 0000072c: PUSH32 0xd00dde70ab4635be4f88c39a53a7c224c66333926c14ca4f30b9570ccd880ea1 0000074d: CALLER 0000074e: DUP6 0000074f: DUP4 00000750: DUP10 00000751: DUP13 00000752: DUP8 00000753: PUSH1 0x40 00000755: MLOAD 00000756: DUP1 00000757: DUP8 00000758: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000076d: AND 0000076e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000783: AND 00000784: DUP2 00000785: MSTORE 00000786: PUSH1 0x20 00000788: ADD 00000789: DUP7 0000078a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000079f: AND 000007a0: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007b5: AND 000007b6: DUP2 000007b7: MSTORE 000007b8: PUSH1 0x20 000007ba: ADD 000007bb: DUP6 000007bc: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007d1: AND 000007d2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007e7: AND 000007e8: DUP2 000007e9: MSTORE 000007ea: PUSH1 0x20 000007ec: ADD 000007ed: DUP1 000007ee: PUSH1 0x20 000007f0: ADD 000007f1: DUP5 000007f2: DUP2 000007f3: MSTORE 000007f4: PUSH1 0x20 000007f6: ADD 000007f7: DUP4 000007f8: PUSH1 0x00 000007fa: NOT 000007fb: AND 000007fc: PUSH1 0x00 000007fe: NOT 000007ff: AND 00000800: DUP2 00000801: MSTORE 00000802: PUSH1 0x20 00000804: ADD 00000805: DUP3 00000806: DUP2 00000807: SUB 00000808: DUP3 00000809: MSTORE 0000080a: DUP6 0000080b: DUP2 0000080c: DUP2 0000080d: MLOAD 0000080e: DUP2 0000080f: MSTORE 00000810: PUSH1 0x20 00000812: ADD 00000813: SWAP2 00000814: POP 00000815: DUP1 00000816: MLOAD 00000817: SWAP1 00000818: PUSH1 0x20 0000081a: ADD 0000081b: SWAP1 0000081c: DUP1 0000081d: DUP4 0000081e: DUP4 0000081f: PUSH1 0x00 00000821: JUMPDEST 00000822: DUP4 00000823: DUP2 00000824: LT 00000825: ISZERO 00000826: PUSH2 0x083c 00000829: JUMPI 0000082a: DUP1 0000082b: DUP3 0000082c: ADD 0000082d: MLOAD 0000082e: DUP2 0000082f: DUP5 00000830: ADD 00000831: MSTORE 00000832: PUSH1 0x20 00000834: DUP2 00000835: ADD 00000836: SWAP1 00000837: POP 00000838: PUSH2 0x0821 0000083b: JUMP 0000083c: JUMPDEST 0000083d: POP 0000083e: POP 0000083f: POP 00000840: POP 00000841: SWAP1 00000842: POP 00000843: SWAP1 00000844: DUP2 00000845: ADD 00000846: SWAP1 00000847: PUSH1 0x1f 00000849: AND 0000084a: DUP1 0000084b: ISZERO 0000084c: PUSH2 0x0869 0000084f: JUMPI 00000850: DUP1 00000851: DUP3 00000852: SUB 00000853: DUP1 00000854: MLOAD 00000855: PUSH1 0x01 00000857: DUP4 00000858: PUSH1 0x20 0000085a: SUB 0000085b: PUSH2 0x0100 0000085e: EXP 0000085f: SUB 00000860: NOT 00000861: AND 00000862: DUP2 00000863: MSTORE 00000864: PUSH1 0x20 00000866: ADD 00000867: SWAP2 00000868: POP 00000869: JUMPDEST 0000086a: POP 0000086b: SWAP8 0000086c: POP 0000086d: POP 0000086e: POP 0000086f: POP 00000870: POP 00000871: POP 00000872: POP 00000873: POP 00000874: PUSH1 0x40 00000876: MLOAD 00000877: DUP1 00000878: SWAP2 00000879: SUB 0000087a: SWAP1 0000087b: LOG1 0000087c: POP 0000087d: POP 0000087e: POP 0000087f: POP 00000880: POP 00000881: POP 00000882: POP 00000883: POP 00000884: JUMP 00000885: JUMPDEST 00000886: PUSH1 0x00 00000888: PUSH2 0x0890 0000088b: CALLER 0000088c: PUSH2 0x043b 0000088f: JUMP 00000890: JUMPDEST 00000891: ISZERO 00000892: ISZERO 00000893: PUSH2 0x089b 00000896: JUMPI 00000897: PUSH1 0x00 00000899: DUP1 0000089a: REVERT 0000089b: JUMPDEST 0000089c: DUP4 0000089d: DUP8 0000089e: DUP5 0000089f: DUP9 000008a0: DUP9 000008a1: PUSH1 0x40 000008a3: MLOAD 000008a4: PUSH1 0x20 000008a6: ADD 000008a7: DUP1 000008a8: DUP1 000008a9: PUSH32 0x4552433230000000000000000000000000000000000000000000000000000000 000008ca: DUP2 000008cb: MSTORE 000008cc: POP 000008cd: PUSH1 0x05 000008cf: ADD 000008d0: DUP7 000008d1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008e6: AND 000008e7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008fc: AND 000008fd: PUSH13 0x01000000000000000000000000 0000090b: MUL 0000090c: DUP2 0000090d: MSTORE 0000090e: PUSH1 0x14 00000910: ADD 00000911: DUP6 00000912: DUP2 00000913: MSTORE 00000914: PUSH1 0x20 00000916: ADD 00000917: DUP5 00000918: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000092d: AND 0000092e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000943: AND 00000944: PUSH13 0x01000000000000000000000000 00000952: MUL 00000953: DUP2 00000954: MSTORE 00000955: PUSH1 0x14 00000957: ADD 00000958: DUP4 00000959: DUP2 0000095a: MSTORE 0000095b: PUSH1 0x20 0000095d: ADD 0000095e: DUP3 0000095f: DUP2 00000960: MSTORE 00000961: PUSH1 0x20 00000963: ADD 00000964: SWAP6 00000965: POP 00000966: POP 00000967: POP 00000968: POP 00000969: POP 0000096a: POP 0000096b: PUSH1 0x40 0000096d: MLOAD 0000096e: PUSH1 0x20 00000970: DUP2 00000971: DUP4 00000972: SUB 00000973: SUB 00000974: DUP2 00000975: MSTORE 00000976: SWAP1 00000977: PUSH1 0x40 00000979: MSTORE 0000097a: PUSH1 0x40 0000097c: MLOAD 0000097d: DUP1 0000097e: DUP3 0000097f: DUP1 00000980: MLOAD 00000981: SWAP1 00000982: PUSH1 0x20 00000984: ADD 00000985: SWAP1 00000986: DUP1 00000987: DUP4 00000988: DUP4 00000989: JUMPDEST 0000098a: PUSH1 0x20 0000098c: DUP4 0000098d: LT 0000098e: ISZERO 0000098f: ISZERO 00000990: PUSH2 0x09ae 00000993: JUMPI 00000994: DUP1 00000995: MLOAD 00000996: DUP3 00000997: MSTORE 00000998: PUSH1 0x20 0000099a: DUP3 0000099b: ADD 0000099c: SWAP2 0000099d: POP 0000099e: PUSH1 0x20 000009a0: DUP2 000009a1: ADD 000009a2: SWAP1 000009a3: POP 000009a4: PUSH1 0x20 000009a6: DUP4 000009a7: SUB 000009a8: SWAP3 000009a9: POP 000009aa: PUSH2 0x0989 000009ad: JUMP 000009ae: JUMPDEST 000009af: PUSH1 0x01 000009b1: DUP4 000009b2: PUSH1 0x20 000009b4: SUB 000009b5: PUSH2 0x0100 000009b8: EXP 000009b9: SUB 000009ba: DUP1 000009bb: NOT 000009bc: DUP3 000009bd: MLOAD 000009be: AND 000009bf: DUP2 000009c0: DUP5 000009c1: MLOAD 000009c2: AND 000009c3: DUP1 000009c4: DUP3 000009c5: OR 000009c6: DUP6 000009c7: MSTORE 000009c8: POP 000009c9: POP 000009ca: POP 000009cb: POP 000009cc: POP 000009cd: POP 000009ce: SWAP1 000009cf: POP 000009d0: ADD 000009d1: SWAP2 000009d2: POP 000009d3: POP 000009d4: PUSH1 0x40 000009d6: MLOAD 000009d7: DUP1 000009d8: SWAP2 000009d9: SUB 000009da: SWAP1 000009db: KECCAK256 000009dc: SWAP1 000009dd: POP 000009de: PUSH2 0x09ea 000009e1: DUP5 000009e2: DUP3 000009e3: DUP5 000009e4: DUP10 000009e5: DUP10 000009e6: PUSH2 0x0a97 000009e9: JUMP 000009ea: JUMPDEST 000009eb: POP 000009ec: PUSH2 0x0a16 000009ef: DUP5 000009f0: DUP9 000009f1: DUP6 000009f2: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000a07: AND 00000a08: PUSH2 0x0b42 00000a0b: SWAP1 00000a0c: SWAP3 00000a0d: SWAP2 00000a0e: SWAP1 00000a0f: PUSH4 0xffffffff 00000a14: AND 00000a15: JUMP 00000a16: JUMPDEST 00000a17: ISZERO 00000a18: ISZERO 00000a19: PUSH2 0x0a21 00000a1c: JUMPI 00000a1d: PUSH1 0x00 00000a1f: DUP1 00000a20: REVERT 00000a21: JUMPDEST 00000a22: POP 00000a23: POP 00000a24: POP 00000a25: POP 00000a26: POP 00000a27: POP 00000a28: POP 00000a29: JUMP 00000a2a: JUMPDEST 00000a2b: PUSH1 0x00 00000a2d: DUP1 00000a2e: PUSH1 0x00 00000a30: DUP1 00000a31: SWAP2 00000a32: POP 00000a33: PUSH1 0x00 00000a35: SWAP1 00000a36: POP 00000a37: JUMPDEST 00000a38: PUSH1 0x0a 00000a3a: DUP2 00000a3b: LT 00000a3c: ISZERO 00000a3d: PUSH2 0x0a79 00000a40: JUMPI 00000a41: DUP2 00000a42: PUSH1 0x02 00000a44: DUP3 00000a45: PUSH1 0x0a 00000a47: DUP2 00000a48: LT 00000a49: ISZERO 00000a4a: ISZERO 00000a4b: PUSH2 0x0a50 00000a4e: JUMPI 00000a4f: INVALID 00000a50: JUMPDEST 00000a51: ADD 00000a52: SLOAD 00000a53: GT 00000a54: ISZERO 00000a55: PUSH2 0x0a6c 00000a58: JUMPI 00000a59: PUSH1 0x02 00000a5b: DUP2 00000a5c: PUSH1 0x0a 00000a5e: DUP2 00000a5f: LT 00000a60: ISZERO 00000a61: ISZERO 00000a62: PUSH2 0x0a67 00000a65: JUMPI 00000a66: INVALID 00000a67: JUMPDEST 00000a68: ADD 00000a69: SLOAD 00000a6a: SWAP2 00000a6b: POP 00000a6c: JUMPDEST 00000a6d: DUP1 00000a6e: DUP1 00000a6f: PUSH1 0x01 00000a71: ADD 00000a72: SWAP2 00000a73: POP 00000a74: POP 00000a75: PUSH2 0x0a37 00000a78: JUMP 00000a79: JUMPDEST 00000a7a: PUSH1 0x01 00000a7c: DUP3 00000a7d: ADD 00000a7e: SWAP3 00000a7f: POP 00000a80: POP 00000a81: POP 00000a82: SWAP1 00000a83: JUMP 00000a84: JUMPDEST 00000a85: PUSH1 0x01 00000a87: PUSH1 0x00 00000a89: SWAP1 00000a8a: SLOAD 00000a8b: SWAP1 00000a8c: PUSH2 0x0100 00000a8f: EXP 00000a90: SWAP1 00000a91: DIV 00000a92: PUSH1 0xff 00000a94: AND 00000a95: DUP2 00000a96: JUMP 00000a97: JUMPDEST 00000a98: PUSH1 0x00 00000a9a: DUP1 00000a9b: PUSH2 0x0aa4 00000a9e: DUP7 00000a9f: DUP7 00000aa0: PUSH2 0x0c6f 00000aa3: JUMP 00000aa4: JUMPDEST 00000aa5: SWAP1 00000aa6: POP 00000aa7: PUSH1 0x01 00000aa9: PUSH1 0x00 00000aab: SWAP1 00000aac: SLOAD 00000aad: SWAP1 00000aae: PUSH2 0x0100 00000ab1: EXP 00000ab2: SWAP1 00000ab3: DIV 00000ab4: PUSH1 0xff 00000ab6: AND 00000ab7: DUP1 00000ab8: ISZERO 00000ab9: PUSH2 0x0ac8 00000abc: JUMPI 00000abd: POP 00000abe: PUSH2 0x0ac6 00000ac1: DUP8 00000ac2: PUSH2 0x043b 00000ac5: JUMP 00000ac6: JUMPDEST 00000ac7: ISZERO 00000ac8: JUMPDEST 00000ac9: ISZERO 00000aca: PUSH2 0x0ad2 00000acd: JUMPI 00000ace: PUSH1 0x00 00000ad0: DUP1 00000ad1: REVERT 00000ad2: JUMPDEST 00000ad3: TIMESTAMP 00000ad4: DUP5 00000ad5: LT 00000ad6: ISZERO 00000ad7: PUSH2 0x0adf 00000ada: JUMPI 00000adb: PUSH1 0x00 00000add: DUP1 00000ade: REVERT 00000adf: JUMPDEST 00000ae0: PUSH2 0x0ae8 00000ae3: DUP4 00000ae4: PUSH2 0x0d3c 00000ae7: JUMP 00000ae8: JUMPDEST 00000ae9: PUSH2 0x0af1 00000aec: DUP2 00000aed: PUSH2 0x043b 00000af0: JUMP 00000af1: JUMPDEST 00000af2: ISZERO 00000af3: ISZERO 00000af4: PUSH2 0x0afc 00000af7: JUMPI 00000af8: PUSH1 0x00 00000afa: DUP1 00000afb: REVERT 00000afc: JUMPDEST 00000afd: CALLER 00000afe: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000b13: AND 00000b14: DUP2 00000b15: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000b2a: AND 00000b2b: EQ 00000b2c: ISZERO 00000b2d: PUSH2 0x0b35 00000b30: JUMPI 00000b31: PUSH1 0x00 00000b33: DUP1 00000b34: REVERT 00000b35: JUMPDEST 00000b36: DUP1 00000b37: SWAP2 00000b38: POP 00000b39: POP 00000b3a: SWAP6 00000b3b: SWAP5 00000b3c: POP 00000b3d: POP 00000b3e: POP 00000b3f: POP 00000b40: POP 00000b41: JUMP 00000b42: JUMPDEST 00000b43: PUSH1 0x00 00000b45: PUSH1 0x60 00000b47: PUSH1 0x00 00000b49: DUP5 00000b4a: DUP5 00000b4b: PUSH1 0x40 00000b4d: MLOAD 00000b4e: PUSH1 0x24 00000b50: ADD 00000b51: DUP1 00000b52: DUP4 00000b53: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000b68: AND 00000b69: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000b7e: AND 00000b7f: DUP2 00000b80: MSTORE 00000b81: PUSH1 0x20 00000b83: ADD 00000b84: DUP3 00000b85: DUP2 00000b86: MSTORE 00000b87: PUSH1 0x20 00000b89: ADD 00000b8a: SWAP3 00000b8b: POP 00000b8c: POP 00000b8d: POP 00000b8e: PUSH1 0x40 00000b90: MLOAD 00000b91: PUSH1 0x20 00000b93: DUP2 00000b94: DUP4 00000b95: SUB 00000b96: SUB 00000b97: DUP2 00000b98: MSTORE 00000b99: SWAP1 00000b9a: PUSH1 0x40 00000b9c: MSTORE 00000b9d: PUSH32 0xa9059cbb00000000000000000000000000000000000000000000000000000000 00000bbe: PUSH28 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff 00000bdb: NOT 00000bdc: AND 00000bdd: PUSH1 0x20 00000bdf: DUP3 00000be0: ADD 00000be1: DUP1 00000be2: MLOAD 00000be3: PUSH28 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff 00000c00: DUP4 00000c01: DUP2 00000c02: DUP4 00000c03: AND 00000c04: OR 00000c05: DUP4 00000c06: MSTORE 00000c07: POP 00000c08: POP 00000c09: POP 00000c0a: POP 00000c0b: SWAP2 00000c0c: POP 00000c0d: DUP2 00000c0e: MLOAD 00000c0f: SWAP1 00000c10: POP 00000c11: PUSH1 0xff 00000c13: PUSH1 0x00 00000c15: MSTORE 00000c16: PUSH1 0x20 00000c18: PUSH1 0x00 00000c1a: DUP3 00000c1b: PUSH1 0x20 00000c1d: DUP6 00000c1e: ADD 00000c1f: PUSH1 0x00 00000c21: DUP11 00000c22: GAS 00000c23: CALL 00000c24: ISZERO 00000c25: ISZERO 00000c26: PUSH2 0x0c2e 00000c29: JUMPI 00000c2a: PUSH1 0x00 00000c2c: DUP1 00000c2d: REVERT 00000c2e: JUMPDEST 00000c2f: PUSH1 0x00 00000c31: MLOAD 00000c32: PUSH1 0xff 00000c34: DUP2 00000c35: EQ 00000c36: PUSH2 0x0c4e 00000c39: JUMPI 00000c3a: PUSH1 0x01 00000c3c: DUP2 00000c3d: EQ 00000c3e: PUSH2 0x0c57 00000c41: JUMPI 00000c42: PUSH1 0x00 00000c44: DUP2 00000c45: EQ 00000c46: PUSH2 0x0c60 00000c49: JUMPI 00000c4a: PUSH1 0x00 00000c4c: DUP1 00000c4d: REVERT 00000c4e: JUMPDEST 00000c4f: PUSH1 0x01 00000c51: SWAP4 00000c52: POP 00000c53: PUSH2 0x0c65 00000c56: JUMP 00000c57: JUMPDEST 00000c58: PUSH1 0x01 00000c5a: SWAP4 00000c5b: POP 00000c5c: PUSH2 0x0c65 00000c5f: JUMP 00000c60: JUMPDEST 00000c61: PUSH1 0x00 00000c63: SWAP4 00000c64: POP 00000c65: JUMPDEST 00000c66: POP 00000c67: POP 00000c68: POP 00000c69: SWAP4 00000c6a: SWAP3 00000c6b: POP 00000c6c: POP 00000c6d: POP 00000c6e: JUMP 00000c6f: JUMPDEST 00000c70: PUSH1 0x00 00000c72: DUP1 00000c73: PUSH1 0x00 00000c75: DUP1 00000c76: PUSH1 0x41 00000c78: DUP6 00000c79: MLOAD 00000c7a: EQ 00000c7b: ISZERO 00000c7c: ISZERO 00000c7d: PUSH2 0x0c85 00000c80: JUMPI 00000c81: PUSH1 0x00 00000c83: DUP1 00000c84: REVERT 00000c85: JUMPDEST 00000c86: PUSH1 0x20 00000c88: DUP6 00000c89: ADD 00000c8a: MLOAD 00000c8b: SWAP3 00000c8c: POP 00000c8d: PUSH1 0x40 00000c8f: DUP6 00000c90: ADD 00000c91: MLOAD 00000c92: SWAP2 00000c93: POP 00000c94: PUSH1 0xff 00000c96: PUSH1 0x41 00000c98: DUP7 00000c99: ADD 00000c9a: MLOAD 00000c9b: AND 00000c9c: SWAP1 00000c9d: POP 00000c9e: PUSH1 0x1b 00000ca0: DUP2 00000ca1: PUSH1 0xff 00000ca3: AND 00000ca4: LT 00000ca5: ISZERO 00000ca6: PUSH2 0x0cb0 00000ca9: JUMPI 00000caa: PUSH1 0x1b 00000cac: DUP2 00000cad: ADD 00000cae: SWAP1 00000caf: POP 00000cb0: JUMPDEST 00000cb1: PUSH1 0x01 00000cb3: DUP7 00000cb4: DUP3 00000cb5: DUP6 00000cb6: DUP6 00000cb7: PUSH1 0x40 00000cb9: MLOAD 00000cba: PUSH1 0x00 00000cbc: DUP2 00000cbd: MSTORE 00000cbe: PUSH1 0x20 00000cc0: ADD 00000cc1: PUSH1 0x40 00000cc3: MSTORE 00000cc4: PUSH1 0x40 00000cc6: MLOAD 00000cc7: DUP1 00000cc8: DUP6 00000cc9: PUSH1 0x00 00000ccb: NOT 00000ccc: AND 00000ccd: PUSH1 0x00 00000ccf: NOT 00000cd0: AND 00000cd1: DUP2 00000cd2: MSTORE 00000cd3: PUSH1 0x20 00000cd5: ADD 00000cd6: DUP5 00000cd7: PUSH1 0xff 00000cd9: AND 00000cda: PUSH1 0xff 00000cdc: AND 00000cdd: DUP2 00000cde: MSTORE 00000cdf: PUSH1 0x20 00000ce1: ADD 00000ce2: DUP4 00000ce3: PUSH1 0x00 00000ce5: NOT 00000ce6: AND 00000ce7: PUSH1 0x00 00000ce9: NOT 00000cea: AND 00000ceb: DUP2 00000cec: MSTORE 00000ced: PUSH1 0x20 00000cef: ADD 00000cf0: DUP3 00000cf1: PUSH1 0x00 00000cf3: NOT 00000cf4: AND 00000cf5: PUSH1 0x00 00000cf7: NOT 00000cf8: AND 00000cf9: DUP2 00000cfa: MSTORE 00000cfb: PUSH1 0x20 00000cfd: ADD 00000cfe: SWAP5 00000cff: POP 00000d00: POP 00000d01: POP 00000d02: POP 00000d03: POP 00000d04: PUSH1 0x20 00000d06: PUSH1 0x40 00000d08: MLOAD 00000d09: PUSH1 0x20 00000d0b: DUP2 00000d0c: SUB 00000d0d: SWAP1 00000d0e: DUP1 00000d0f: DUP5 00000d10: SUB 00000d11: SWAP1 00000d12: PUSH1 0x00 00000d14: DUP7 00000d15: GAS 00000d16: CALL 00000d17: ISZERO 00000d18: DUP1 00000d19: ISZERO 00000d1a: PUSH2 0x0d27 00000d1d: JUMPI 00000d1e: RETURNDATASIZE 00000d1f: PUSH1 0x00 00000d21: DUP1 00000d22: RETURNDATACOPY 00000d23: RETURNDATASIZE 00000d24: PUSH1 0x00 00000d26: REVERT 00000d27: JUMPDEST 00000d28: POP 00000d29: POP 00000d2a: POP 00000d2b: PUSH1 0x20 00000d2d: PUSH1 0x40 00000d2f: MLOAD 00000d30: SUB 00000d31: MLOAD 00000d32: SWAP4 00000d33: POP 00000d34: POP 00000d35: POP 00000d36: POP 00000d37: SWAP3 00000d38: SWAP2 00000d39: POP 00000d3a: POP 00000d3b: JUMP 00000d3c: JUMPDEST 00000d3d: PUSH1 0x00 00000d3f: DUP1 00000d40: PUSH2 0x0d48 00000d43: CALLER 00000d44: PUSH2 0x043b 00000d47: JUMP 00000d48: JUMPDEST 00000d49: ISZERO 00000d4a: ISZERO 00000d4b: PUSH2 0x0d53 00000d4e: JUMPI 00000d4f: PUSH1 0x00 00000d51: DUP1 00000d52: REVERT 00000d53: JUMPDEST 00000d54: PUSH1 0x00 00000d56: SWAP2 00000d57: POP 00000d58: PUSH1 0x00 00000d5a: SWAP1 00000d5b: POP 00000d5c: JUMPDEST 00000d5d: PUSH1 0x0a 00000d5f: DUP2 00000d60: LT 00000d61: ISZERO 00000d62: PUSH2 0x0dbb 00000d65: JUMPI 00000d66: DUP3 00000d67: PUSH1 0x02 00000d69: DUP3 00000d6a: PUSH1 0x0a 00000d6c: DUP2 00000d6d: LT 00000d6e: ISZERO 00000d6f: ISZERO 00000d70: PUSH2 0x0d75 00000d73: JUMPI 00000d74: INVALID 00000d75: JUMPDEST 00000d76: ADD 00000d77: SLOAD 00000d78: EQ 00000d79: ISZERO 00000d7a: PUSH2 0x0d82 00000d7d: JUMPI 00000d7e: PUSH1 0x00 00000d80: DUP1 00000d81: REVERT 00000d82: JUMPDEST 00000d83: PUSH1 0x02 00000d85: DUP3 00000d86: PUSH1 0x0a 00000d88: DUP2 00000d89: LT 00000d8a: ISZERO 00000d8b: ISZERO 00000d8c: PUSH2 0x0d91 00000d8f: JUMPI 00000d90: INVALID 00000d91: JUMPDEST 00000d92: ADD 00000d93: SLOAD 00000d94: PUSH1 0x02 00000d96: DUP3 00000d97: PUSH1 0x0a 00000d99: DUP2 00000d9a: LT 00000d9b: ISZERO 00000d9c: ISZERO 00000d9d: PUSH2 0x0da2 00000da0: JUMPI 00000da1: INVALID 00000da2: JUMPDEST 00000da3: ADD 00000da4: SLOAD 00000da5: LT 00000da6: ISZERO 00000da7: PUSH2 0x0dae 00000daa: JUMPI 00000dab: DUP1 00000dac: SWAP2 00000dad: POP 00000dae: JUMPDEST 00000daf: DUP1 00000db0: DUP1 00000db1: PUSH1 0x01 00000db3: ADD 00000db4: SWAP2 00000db5: POP 00000db6: POP 00000db7: PUSH2 0x0d5c 00000dba: JUMP 00000dbb: JUMPDEST 00000dbc: PUSH1 0x02 00000dbe: DUP3 00000dbf: PUSH1 0x0a 00000dc1: DUP2 00000dc2: LT 00000dc3: ISZERO 00000dc4: ISZERO 00000dc5: PUSH2 0x0dca 00000dc8: JUMPI 00000dc9: INVALID 00000dca: JUMPDEST 00000dcb: ADD 00000dcc: SLOAD 00000dcd: DUP4 00000dce: LT 00000dcf: ISZERO 00000dd0: PUSH2 0x0dd8 00000dd3: JUMPI 00000dd4: PUSH1 0x00 00000dd6: DUP1 00000dd7: REVERT 00000dd8: JUMPDEST 00000dd9: PUSH2 0x2710 00000ddc: PUSH1 0x02 00000dde: DUP4 00000ddf: PUSH1 0x0a 00000de1: DUP2 00000de2: LT 00000de3: ISZERO 00000de4: ISZERO 00000de5: PUSH2 0x0dea 00000de8: JUMPI 00000de9: INVALID 00000dea: JUMPDEST 00000deb: ADD 00000dec: SLOAD 00000ded: ADD 00000dee: DUP4 00000def: GT 00000df0: ISZERO 00000df1: PUSH2 0x0df9 00000df4: JUMPI 00000df5: PUSH1 0x00 00000df7: DUP1 00000df8: REVERT 00000df9: JUMPDEST 00000dfa: DUP3 00000dfb: PUSH1 0x02 00000dfd: DUP4 00000dfe: PUSH1 0x0a 00000e00: DUP2 00000e01: LT 00000e02: ISZERO 00000e03: ISZERO 00000e04: PUSH2 0x0e09 00000e07: JUMPI 00000e08: INVALID 00000e09: JUMPDEST 00000e0a: ADD 00000e0b: DUP2 00000e0c: SWAP1 00000e0d: SSTORE 00000e0e: POP 00000e0f: POP 00000e10: POP 00000e11: POP 00000e12: JUMP 00000e13: STOP 00000e14: LOG1 00000e15: PUSH6 0x627a7a723058 00000e1c: KECCAK256 00000e1d: UNKNOWN(0xD8) 00000e1e: UNKNOWN(0xF9) 00000e1f: UNKNOWN(0x2F) 00000e20: PUSH2 0x4b75 00000e23: UNKNOWN(0xE7) 00000e24: PUSH20 0xd337885bbc97e998403b7a2fdf83e5e0826716b7 00000e39: CALLCODE 00000e3a: GASPRICE 00000e3b: UNKNOWN(0xF7) 00000e3c: UNKNOWN(0xCF) 00000e3d: STOP 00000e3e: UNKNOWN(0x29)
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | other | detector | Untrusted CALL target/value reachable | 60 | no | no |
viewtrace_id: 0xc167e4b9c38423e616c605f8cc14468e283cfc732a870674058c9077f5e6a77c
call_targets:
0xd793281182a0e3e023116004778f45c29fc14f19
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0xc167e4b9c38423e616c605f8cc14468e283cfc732a870674058c9077f5e6a77c",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xd793281182a0e3e023116004778f45c29fc14f19"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xffffffff",
"selector": "0xffffffff",
"calldata_variants": [
"0xffffffff",
"0xffffffff0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x2079fb9a",
"selector": "0x2079fb9a",
"calldata_variants": [
"0x2079fb9a",
"0x2079fb9a0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7df73e27",
"selector": "0x7df73e27",
"calldata_variants": [
"0x7df73e27",
"0x7df73e270000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x959f9114",
"selector": "0x959f9114",
"calldata_variants": [
"0x959f9114",
"0x959f91140000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x97f6c448",
"selector": "0x97f6c448",
"calldata_variants": [
"0x97f6c448",
"0x97f6c4480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x98f44b9a",
"selector": "0x98f44b9a",
"calldata_variants": [
"0x98f44b9a",
"0x98f44b9a0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xa0b7967b",
"selector": "0xa0b7967b",
"calldata_variants": [
"0xa0b7967b",
"0xa0b7967b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xabe3219c",
"selector": "0xabe3219c",
"calldata_variants": [
"0xabe3219c",
"0xabe3219c0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1819,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 3107,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 3350,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 4,
"guards_detected": [],
"untrusted_call_count": 4
}
|
| high | other | detector | ETH value transfer possible | 55 | no | no |
viewtrace_id: 0xc167e4b9c38423e616c605f8cc14468e283cfc732a870674058c9077f5e6a77c
call_targets:
0xd793281182a0e3e023116004778f45c29fc14f19
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0xc167e4b9c38423e616c605f8cc14468e283cfc732a870674058c9077f5e6a77c",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xd793281182a0e3e023116004778f45c29fc14f19"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xffffffff",
"selector": "0xffffffff",
"calldata_variants": [
"0xffffffff",
"0xffffffff0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x2079fb9a",
"selector": "0x2079fb9a",
"calldata_variants": [
"0x2079fb9a",
"0x2079fb9a0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7df73e27",
"selector": "0x7df73e27",
"calldata_variants": [
"0x7df73e27",
"0x7df73e270000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x959f9114",
"selector": "0x959f9114",
"calldata_variants": [
"0x959f9114",
"0x959f91140000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x97f6c448",
"selector": "0x97f6c448",
"calldata_variants": [
"0x97f6c448",
"0x97f6c4480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x98f44b9a",
"selector": "0x98f44b9a",
"calldata_variants": [
"0x98f44b9a",
"0x98f44b9a0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xa0b7967b",
"selector": "0xa0b7967b",
"calldata_variants": [
"0xa0b7967b",
"0xa0b7967b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xabe3219c",
"selector": "0xabe3219c",
"calldata_variants": [
"0xabe3219c",
"0xabe3219c0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1819,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 3107,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 3350,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 4,
"guards_detected": []
}
|