47476ed3-1130-4cc2-88bc-4e11d7602cbd
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 31642 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 95275 | artifact.fetch | complete | 1 / 3 | 1 week ago |
| 95276 | tool.cast_disasm | complete | 1 / 3 | 1 week ago |
| 95277 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 95278 | capability.graph | complete | 1 / 3 | 1 week ago |
| 95279 | detector.run | complete | 1 / 3 | 1 week ago |
| 95280 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
[codex:363824] OpenAI Codex v0.77.0 (research preview)
[codex:363824] --------
[codex:363824] workdir: /tmp/codex-multi-6rw3ig1e
[codex:363824] model: gpt-5.2-codex
[codex:363824] provider: openai
[codex:363824] approval: never
[codex:363824] sandbox: read-only
[codex:363824] reasoning effort: xhigh
[codex:363824] reasoning summaries: auto
[codex:363824] session id: 019b8bd2-950b-7062-bf42-f2bbb55c8974
[codex:363824] --------
[codex:363824] user
[codex:363824] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:363824]
[codex:363824] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:363824]
[codex:363824] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:363824] - Gas inefficiency, code quality, or best practices
[codex:363824] - Theoretical vulnerabilities without a clear extraction path
[codex:363824] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:363824] - Issues requiring social engineering or off-chain coordination
[codex:363824]
[codex:363824] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:363824] - CALL/DELEGATECALL with controllable destination or calldata
[codex:363824] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:363824] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:363824] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:363824] - External calls before state updates (reentrancy)
[codex:363824] - SELFDESTRUCT with controllable beneficiary
[codex:363824] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:363824]
[codex:363824] For each finding, you MUST explain:
[codex:363824] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:363824] 2. The concrete sequence of transactions to extract value
[codex:363824] 3. Why you believe this is exploitable (not just suspicious)
[codex:363824]
[codex:363824] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:363824] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:363824]
[codex:363824] Output MUST be valid JSON matching the provided schema.
[codex:363824] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:363824] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:363824] mcp startup: no servers
[codex:363824]
[codex:363824] thinking
[codex:363824] **Preparing to read BYTECODE_BUNDLE.txt**
[codex:363824] exec
[codex:363824] /bin/bash -lc ls in /tmp/codex-multi-6rw3ig1e succeeded in 5ms:
[codex:363824] BYTECODE_BUNDLE.txt
[codex:363824] codex-output-schema.json
[codex:363824]
[codex:363824] thinking
[codex:363824] **Reading BYTECODE_BUNDLE.txt**
[codex:363824] exec
[codex:363824] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-6rw3ig1e succeeded in 5ms:
[codex:363824] Runtime bytecode bundle for best-effort auditing.
[codex:363824] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:363824]
[codex:363824] FILE: runtime_bytecode.hex
[codex:363824] 0x60806040526004361061008d576000357c010000000000000000000000000000000000000000000000000000000090048063715018a61161006b578063715018a6146103995780638da5cb5b146103b05780638f32d59b14610407578063f2fde38b146104365761008d565b80633ccfd60b146102da57806354c03ab7146102f15780636f48e79b14610348575b600073ffffffffffffffffffffffffffffffffffffffff163373ffffffffffffffffffffffffffffffffffffffff16141580156100f657503073ffffffffffffffffffffffffffffffffffffffff163373ffffffffffffffffffffffffffffffffffffffff1614155b151561010157600080fd5b600554341480610112575060065434145b8061011e575060075434145b8061012a575060085434145b80610136575060095434145b806101425750600a5434145b8061014e5750600b5434145b8061015a5750600c5434145b806101665750600d5434145b806101725750600e5434145b8061017e5750600f5434145b8061018a575060105434145b80610196575060115434145b806101a2575060125434145b806101ae575060135434145b806101ba575060145434145b806101c6575060155434145b806101d2575060165434145b806101de575060175434145b806101ea575060185434145b806101f6575060195434145b806102025750601a5434145b8061020e5750601b5434145b8061021a5750601c5434145b806102265750601d5434145b806102325750601e5434145b8061023e5750601f5434145b8061024a575060205434145b80610256575060215434145b80610262575060225434145b151561026d57600080fd5b7fdd6c6913dd4f1ff7839115927f06a4bbea5f26a0e88f55c64159155cf9f9f1753334604051808373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020018281526020019250505060405180910390a1005b3480156102e657600080fd5b506102ef610487565b005b3480156102fd57600080fd5b506103066105c0565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b34801561035457600080fd5b506103976004803603602081101561036b57600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff1690602001909291905050506105fd565b005b3480156103a557600080fd5b506103ae610690565b005b3480156103bc57600080fd5b506103c5610764565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b34801561041357600080fd5b5061041c61078e565b604051808215151515815260200191505060405180910390f35b34801561044257600080fd5b506104856004803603602081101561045957600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff1690602001909291905050506107e6565b005b61048f61078e565b151561049a57600080fd5b600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166108fc3073ffffffffffffffffffffffffffffffffffffffff16319081150290604051600060405180830381858888f19350505050158015610519573d6000803e3d6000fd5b507f41caea7d684d5ba5fba1924d54c5169a147971fb5ffdde987624e8bbd450828b600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff163073ffffffffffffffffffffffffffffffffffffffff1631604051808373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020018281526020019250505060405180910390a1565b60006105ca61078e565b15156105d557600080fd5b600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16905090565b61060561078e565b151561061057600080fd5b600073ffffffffffffffffffffffffffffffffffffffff163373ffffffffffffffffffffffffffffffffffffffff161415151561064c57600080fd5b80600360006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555050565b61069861078e565b15156106a357600080fd5b600073ffffffffffffffffffffffffffffffffffffffff16600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff167f8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e060405160405180910390a36000600160006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550565b6000600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16905090565b6000600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff163373ffffffffffffffffffffffffffffffffffffffff1614905090565b6107ee61078e565b15156107f957600080fd5b61080281610805565b50565b600073ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff161415151561084157600080fd5b8073ffffffffffffffffffffffffffffffffffffffff16600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff167f8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e060405160405180910390a380600160006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555050565b6000808314156109145760009050610939565b6000828402905082848281151561092757fe5b0414151561093457600080fd5b809150505b9291505056fea165627a7a723058208e2e1213fa3e5ffba142112e98e66003a7eb8e1589ff81dd860a4cb9e727b1d90029
[codex:363824]
[codex:363824] thinking
[codex:363824] **Decoding bytecode and analyzing functions**
[codex:363824] exec
[codex:363824] /bin/bash -lc "python - <<'PY'
[codex:363824] import re
[codex:363824] from pathlib import Path
[codex:363824] hexdata=Path('BYTECODE_BUNDLE.txt').read_text()
[codex:363824] # extract runtime_bytecode.hex
[codex:363824] m=re.search(r'FILE: runtime_bytecode.hex\\n(0x[0-9a-fA-F]+)', hexdata)
[codex:363824] hexstr=m.group(1)[2:]
[codex:363824]
[codex:363824] # opcode map
[codex:363824] opcodes={
[codex:363824] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:363824] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:363824] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:363824] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:363824] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:363824] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:363824] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:363824] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:363824] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:363824] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:363824] }
[codex:363824]
[codex:363824] b=bytes.fromhex(hexstr)
[codex:363824]
[codex:363824] i=0
[codex:363824] while i < len(b):
[codex:363824] op=b[i]
[codex:363824] name=opcodes.get(op, f'UNKNOWN_{op:02x}')
[codex:363824] if 0x60 <= op <= 0x7f:
[codex:363824] n=op-0x5f
[codex:363824] data=b[i+1:i+1+n]
[codex:363824] print(f\"{i:04x}: {name} 0x{data.hex()}\")
[codex:363824] i+=1+n
[codex:363824] else:
[codex:363824] print(f\"{i:04x}: {name}\")
[codex:363824] i+=1
[codex:363824] PY" in /tmp/codex-multi-6rw3ig1e succeeded in 36ms:
[codex:363824] 0000: PUSH1 0x80
[codex:363824] 0002: PUSH1 0x40
[codex:363824] 0004: MSTORE
[codex:363824] 0005: PUSH1 0x04
[codex:363824] 0007: CALLDATASIZE
[codex:363824] 0008: LT
[codex:363824] 0009: PUSH2 0x008d
[codex:363824] 000c: JUMPI
[codex:363824] 000d: PUSH1 0x00
[codex:363824] 000f: CALLDATALOAD
[codex:363824] 0010: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
[codex:363824] 002e: SWAP1
[codex:363824] 002f: DIV
[codex:363824] 0030: DUP1
[codex:363824] 0031: PUSH4 0x715018a6
[codex:363824] 0036: GT
[codex:363824] 0037: PUSH2 0x006b
[codex:363824] 003a: JUMPI
[codex:363824] 003b: DUP1
[codex:363824] 003c: PUSH4 0x715018a6
[codex:363824]
[codex:363824]
[codex:363824] thinking
[codex:363824] **Analyzing fallback function logic in disassembly**
[codex:363824] thinking
[codex:363824] **Interpreting storage access and owner-related functions**
[codex:363824]
[codex:363824] I'm examining typical Solidity storage reading patterns with shifts and masks, trying to decode how owner and recipient addresses are loaded and verified. I’m verifying owner checks in key functions like renounceOwnership, transferOwnership, setRecipient, and withdraw, confirming they require ownership correctly. I’m also considering the fallback’s role in logging deposits and ensuring no bypass of access controls, while preparing to simulate stack state to understand the low-level call in the withdraw function.
[codex:363824] exec
[codex:363824] /bin/bash -lc "python - <<'PY'
[codex:363824] from pathlib import Path
[codex:363824] import re
[codex:363824]
[codex:363824] hexdata=Path('BYTECODE_BUNDLE.txt').read_text()
[codex:363824] hexstr=re.search(r'FILE: runtime_bytecode.hex\\n(0x[0-9a-fA-F]+)', hexdata).group(1)[2:]
[codex:363824] code=bytes.fromhex(hexstr)
[codex:363824]
[codex:363824] start=0x0487
[codex:363824] end=0x0504 # include CALL at 0x0503
[codex:363824]
[codex:363824] # opcode info
[codex:363824] opcodes={
[codex:363824] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:363824] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:363824] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:363824] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:363824] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:363824] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:363824] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:363824] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:363824] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:363824] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:363824] }
[codex:363824]
[codex:363824] # simple stack interpreter with symbolic values
[codex:363824]
[codex:363824] class Sym:
[codex:363824] def __init__(self, name): self.name=name
[codex:363824] def __repr__(self): return self.name
[codex:363824]
[codex:363824] stack=[]
[codex:363824]
[codex:363824] # helper to pop
[codex:363824]
[codex:363824] def pop(n=1):
[codex:363824] if n==1:
[codex:363824] return stack.pop()
[codex:363824] res=stack[-n:]
[codex:363824] del stack[-n:]
[codex:363824] return res
[codex:363824]
[codex:363824] pc=start
[codex:363824] step=0
[codex:363824] while pc < end:
[codex:363824] op=code[pc]
[codex:363824] name=opcodes.get(op, f'UNKNOWN_{op:02x}')
[codex:363824] pc0=pc
[codex:363824] pc+=1
[codex:363824] arg=None
[codex:363824] if 0x60 <= op <= 0x7f:
[codex:363824] n=op-0x5f
[codex:363824] data=code[pc:pc+n]
[codex:363824] pc+=n
[codex:363824] arg=int.from_bytes(data,'big')
[codex:363824] stack.append(arg)
[codex:363824] elif name.startswith('DUP'):
[codex:363824] idx=int(name[3:])
[codex:363824] stack.append(stack[-idx])
[codex:363824] elif name.startswith('SWAP'):
[codex:363824] idx=int(name[4:])
[codex:363824] stack[-1], stack[-1-idx] = stack[-1-idx], stack[-1]
[codex:363824] elif name=='POP':
[codex:363824] pop()
[codex:363824] elif name=='SLOAD':
[codex:363824] key=pop()
[codex:363824] stack.append(Sym(f'sload({key})'))
[codex:363824] elif name=='ADDRESS':
[codex:363824] stack.append(Sym('address(this)'))
[codex:363824] elif name=='BALANCE':
[codex:363824] addr=pop()
[codex:363824] stack.append(Sym(f'balance({addr})'))
[codex:363824] elif name=='CALLER':
[codex:363824] stack.append(Sym('caller'))
[codex:363824] elif name=='CALLVALUE':
[codex:363824] stack.append(Sym('callvalue'))
[codex:363824] elif name=='MLOAD':
[codex:363824] addr=pop()
[codex:363824] stack.append(Sym(f'mload({addr})'))
[codex:363824] elif name=='MSTORE':
[codex:363824] val, addr = pop(2)
[codex:363824] elif name in ('EQ','AND','OR','XOR','ADD','SUB','MUL','DIV','EXP'):
[codex:363824] b,a=pop(2)
[codex:363824] stack.append(Sym(f'({a} {name} {b})'))
[codex:363824] elif name=='ISZERO':
[codex:363824] a=pop()
[codex:363824] stack.append(Sym(f'"'!{a}'"'))
[codex:363824] elif name=='CALL':
[codex:363824] # do nothing
[codex:363824] break
[codex:363824] elif name=='JUMPDEST':
[codex:363824] pass
[codex:363824] elif name=='JUMP' or name=='JUMPI':
[codex:363824] # ignore control flow
[codex:363824] pass
[codex:363824] else:
[codex:363824] # ignore
[codex:363824] pass
[codex:363824]
[codex:363824] step+=1
[codex:363824] if step>2000:
[codex:363824] break
[codex:363824]
[codex:363824] print('Stack before CALL at 0x0503 (approx):')
[codex:363824] print(stack)
[codex:363824] PY" in /tmp/codex-multi-6rw3ig1e succeeded in 33ms:
[codex:363824] Stack before CALL at 0x0503 (approx):
[codex:363824] [1167, !!1934, 1178, 0, 0, (1461501637330902918203684832716283019655932542975 AND (1461501637330902918203684832716283019655932542975 AND (sload(3) DIV (256 EXP 0)))), (!balance((1461501637330902918203684832716283019655932542975 AND address(this))) MUL 2300), balance((1461501637330902918203684832716283019655932542975 AND address(this))), mload(64), 0, mload(64), (mload(64) SUB mload(64)), mload(64), balance((1461501637330902918203684832716283019655932542975 AND address(this))), (1461501637330902918203684832716283019655932542975 AND (1461501637330902918203684832716283019655932542975 AND (sload(3) DIV (256 EXP 0)))), (!balance((1461501637330902918203684832716283019655932542975 AND address(this))) MUL 2300)]
[codex:363824]
[codex:363824] thinking
[codex:363824] **Reevaluating EVM stack behavior and instruction effects**
[codex:363824]
[codex:363824] I'm inspecting how the interpreter handles stack operations around the CALL instruction and noticing some misinterpretations of instructions like EXP and SWAP1. I want to carefully reconstruct the stack state, verify instruction effects, and consider the role of earlier stack entries and jumps to fully understand the function's behavior. Let's try tracing actual bytecode and stack changes precisely.
[codex:363824] exec
[codex:363824] /bin/bash -lc "python - <<'PY'
[codex:363824] from pathlib import Path
[codex:363824] import re
[codex:363824] hexdata=Path('BYTECODE_BUNDLE.txt').read_text()
[codex:363824] hexstr=re.search(r'FILE: runtime_bytecode.hex\\n(0x[0-9a-fA-F]+)', hexdata).group(1)[2:]
[codex:363824] code=bytes.fromhex(hexstr)
[codex:363824] start=0x0490
[codex:363824] end=0x04b5
[codex:363824] print(code[start:end].hex())
[codex:363824] PY" in /tmp/codex-multi-6rw3ig1e succeeded in 32ms:
[codex:363824] 151561049a57600080fd5b600360009054906101000a900473ffffffffffffffffffffffff
[codex:363824]
[codex:363824]
[codex:363824] thinking
[codex:363824] **Analyzing complex EVM bytecode stack behavior**
[codex:363824] thinking
[codex:363824] **Clarifying operand order for EVM instructions**
[codex:363824]
[codex:363824] I’m sorting out the exact operand order for EVM operations like EXP and DIV, confirming that the top of the stack is the first operand and the next is the second—meaning EXP computes base^exponent with base at the top. This clears up previous confusion and lets me accurately interpret the bytecode stack transformations.
[codex:363824] exec
[codex:363824] /bin/bash -lc "python - <<'PY'
[codex:363824] from pathlib import Path
[codex:363824] import re
[codex:363824]
[codex:363824] hexdata=Path('BYTECODE_BUNDLE.txt').read_text()
[codex:363824] hexstr=re.search(r'FILE: runtime_bytecode.hex\\n(0x[0-9a-fA-F]+)', hexdata).group(1)[2:]
[codex:363824] code=bytes.fromhex(hexstr)
[codex:363824]
[codex:363824] start=0x0487
[codex:363824] end=0x0503
[codex:363824]
[codex:363824] opcodes={
[codex:363824] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:363824] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:363824] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:363824] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:363824] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:363824] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:363824] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:363824] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:363824] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:363824] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:363824] }
[codex:363824]
[codex:363824] class Sym:
[codex:363824] def __init__(self, name): self.name=name
[codex:363824] def __repr__(self): return self.name
[codex:363824]
[codex:363824] stack=[]
[codex:363824]
[codex:363824] def pop(n=1):
[codex:363824] if n==1:
[codex:363824] return stack.pop()
[codex:363824] res=stack[-n:]
[codex:363824] del stack[-n:]
[codex:363824] return res
[codex:363824]
[codex:363824] pc=start
[codex:363824] while pc < end:
[codex:363824] op=code[pc]; pc+=1
[codex:363824] name=opcodes.get(op, f'UNKNOWN_{op:02x}')
[codex:363824] if 0x60 <= op <= 0x7f:
[codex:363824] n=op-0x5f
[codex:363824] data=code[pc:pc+n]; pc+=n
[codex:363824] stack.append(int.from_bytes(data,'big'))
[codex:363824] elif name.startswith('DUP'):
[codex:363824] idx=int(name[3:])
[codex:363824] stack.append(stack[-idx])
[codex:363824] elif name.startswith('SWAP'):
[codex:363824] idx=int(name[4:])
[codex:363824] stack[-1], stack[-1-idx] = stack[-1-idx], stack[-1]
[codex:363824] elif name=='POP':
[codex:363824] pop()
[codex:363824] elif name=='SLOAD':
[codex:363824] key=pop()
[codex:363824] stack.append(Sym(f'sload({key})'))
[codex:363824] elif name=='ADDRESS':
[codex:363824] stack.append(Sym('address(this)'))
[codex:363824] elif name=='BALANCE':
[codex:363824] addr=pop()
[codex:363824] stack.append(Sym(f'balance({addr})'))
[codex:363824] elif name=='CALLER':
[codex:363824] stack.append(Sym('caller'))
[codex:363824] elif name=='CALLVALUE':
[codex:363824] stack.append(Sym('callvalue'))
[codex:363824] elif name=='MLOAD':
[codex:363824] addr=pop()
[codex:363824] stack.append(Sym(f'mload({addr})'))
[codex:363824] elif name=='MSTORE':
[codex:363824] val, addr = pop(2)
[codex:363824] elif name in ('EQ','AND','OR','XOR','ADD','SUB','MUL','DIV','EXP'):
[codex:363824] a,b=pop(2) # a=top, b=next
[codex:363824] stack.append(Sym(f'({a} {name} {b})'))
[codex:363824] elif name=='ISZERO':
[codex:363824] a=pop(); stack.append(Sym(f'"'!{a}'"'))
[codex:363824] elif name=='JUMPDEST':
[codex:363824] pass
[codex:363824] elif name in ('JUMP','JUMPI'):
[codex:363824] # ignore control flow
[codex:363824] pass
[codex:363824] else:
[codex:363824] pass
[codex:363824]
[codex:363824] # show last 12 stack items
[codex:363824] print('Stack before CALL (top last):')
[codex:363824] for i, item in enumerate(stack[-12:], start=len(stack)-12):
[codex:363824] print(i, item)
[codex:363824]
[codex:363824] # show 7 call args if any
[codex:363824] if len(stack) >= 7:
[codex:363824] gas,to,value,in_offset,in_size,out_offset,out_size = stack[-7:]
[codex:363824] print('\\nCALL args:')
[codex:363824] print('gas', gas)
[codex:363824] print('to', to)
[codex:363824] print('value', value)
[codex:363824] print('in_offset', in_offset)
[codex:363824] print('in_size', in_size)
[codex:363824] print('out_offset', out_offset)
[codex:363824] print('out_size', out_size)
[codex:363824] PY" in /tmp/codex-multi-6rw3ig1e succeeded in 28ms:
[codex:363824] Stack before CALL (top last):
[codex:363824] 4 0
[codex:363824] 5 ((((0 EXP 256) DIV sload(3)) AND 1461501637330902918203684832716283019655932542975) AND 1461501637330902918203684832716283019655932542975)
[codex:363824] 6 (2300 MUL !balance((address(this) AND 1461501637330902918203684832716283019655932542975)))
[codex:363824] 7 balance((address(this) AND 1461501637330902918203684832716283019655932542975))
[codex:363824] 8 mload(64)
[codex:363824] 9 0
[codex:363824] 10 mload(64)
[codex:363824] 11 (mload(64) SUB mload(64))
[codex:363824] 12 mload(64)
[codex:363824] 13 balance((address(this) AND 1461501637330902918203684832716283019655932542975))
[codex:363824] 14 ((((0 EXP 256) DIV sload(3)) AND 1461501637330902918203684832716283019655932542975) AND 1461501637330902918203684832716283019655932542975)
[codex:363824] 15 (2300 MUL !balance((address(this) AND 1461501637330902918203684832716283019655932542975)))
[codex:363824]
[codex:363824] CALL args:
[codex:363824] gas 0
[codex:363824] to mload(64)
[codex:363824] value (mload(64) SUB mload(64))
[codex:363824] in_offset mload(64)
[codex:363824] in_size balance((address(this) AND 1461501637330902918203684832716283019655932542975))
[codex:363824]
[codex:363824] thinking
[codex:363824] **Analyzing call and owner check logic**
[codex:363824]
[codex:363824] I'm looking closely at the withdraw call where funds go to slot3 and checking the owner authorization using CALLER versus stored owner. I want to confirm the correct storage slot access and verify no bypass of the onlyOwner check by precisely interpreting the SLOAD and arithmetic sequence around 0x078e. This should help me ensure that only the owner can trigger the withdrawal without risk.
[codex:363824] exec
[codex:363824] /bin/bash -lc "python - <<'PY'
[codex:363824] from pathlib import Path
[codex:363824] import re
[codex:363824]
[codex:363824] hexdata=Path('BYTECODE_BUNDLE.txt').read_text()
[codex:363824] hexstr=re.search(r'FILE: runtime_bytecode.hex\\n(0x[0-9a-fA-F]+)', hexdata).group(1)[2:]
[codex:363824] code=bytes.fromhex(hexstr)
[codex:363824]
[codex:363824] start=0x078e
[codex:363824] end=0x07e6
[codex:363824]
[codex:363824] opcodes={
[codex:363824] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:363824] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:363824] 0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:363824] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:363824] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:363824] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:363824] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:363824] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:363824] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:363824] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:363824] }
[codex:363824]
[codex:363824] class Sym:
[codex:363824] def __init__(self, name): self.name=name
[codex:363824] def __repr__(self): return self.name
[codex:363824]
[codex:363824] stack=[Sym('ret')] # internal functions expect return address on stack
[codex:363824]
[codex:363824] pc=start
[codex:363824] while pc < end:
[codex:363824] op=code[pc]; pc+=1
[codex:363824] name=opcodes.get(op, f'UNKNOWN_{op:02x}')
[codex:363824] if 0x60 <= op <= 0x7f:
[codex:363824] n=op-0x5f
[codex:363824] data=code[pc:pc+n]; pc+=n
[codex:363824] stack.append(int.from_bytes(data,'big'))
[codex:363824] elif name.startswith('DUP'):
[codex:363824] idx=int(name[3:])
[codex:363824] stack.append(stack[-idx])
[codex:363824] elif name.startswith('SWAP'):
[codex:363824] idx=int(name[4:])
[codex:363824] stack[-1], stack[-1-idx] = stack[-1-idx], stack[-1]
[codex:363824] elif name=='POP':
[codex:363824] stack.pop()
[codex:363824] elif name=='SLOAD':
[codex:363824] key=stack.pop(); stack.append(Sym(f'sload({key})'))
[codex:363824] elif name=='CALLER':
[codex:363824] stack.append(Sym('caller'))
[codex:363824] elif name in ('EQ','AND','OR','XOR','ADD','SUB','MUL','DIV','EXP'):
[codex:363824] a=stack.pop(); b=stack.pop(); stack.append(Sym(f'({a} {name} {b})'))
[codex:363824] elif name=='ISZERO':
[codex:363824] a=stack.pop(); stack.append(Sym(f'"'!{a}'"'))
[codex:363824] elif name=='JUMP':
[codex:363824] # end
[codex:363824] break
[codex:363824] elif name=='JUMPDEST':
[codex:363824] pass
[codex:363824] else:
[codex:363824] pass
[codex:363824]
[codex:363824] print(stack)
[codex:363824] PY" in /tmp/codex-multi-6rw3ig1e succeeded in 27ms:
[codex:363824] [((1461501637330902918203684832716283019655932542975 AND caller) EQ (1461501637330902918203684832716283019655932542975 AND (1461501637330902918203684832716283019655932542975 AND (sload(1) DIV (256 EXP 0))))), ret]
[codex:363824]
[codex:363824] thinking
[codex:363824] **Summarizing bytecode security analysis**
[codex:363824] codex
[codex:363824] {"no_findings":true,"summary":"Reviewed the runtime bytecode fully; it implements owner-gated withdrawal/recipient management and a payable fallback that only logs when msg.value matches stored constants. No unprotected value transfers, delegatecalls, selfdestructs, or upgrade paths were found, so there is no concrete exploitable profit path from bytecode alone.","findings":[]}
[codex:363824] tokens used
[codex:363824] 58,534
[codex:363824] {"no_findings":true,"summary":"Reviewed the runtime bytecode fully; it implements owner-gated withdrawal/recipient management and a payable fallback that only logs when msg.value matches stored constants. No unprotected value transfers, delegatecalls, selfdestructs, or upgrade paths were found, so there is no concrete exploitable profit path from bytecode alone.","findings":[]}
{
"codex": {
"ran_at": "2026-01-05T01:51:01.037037+00:00",
"returncode": 0
},
"summary": "Reviewed the runtime bytecode fully; it implements owner-gated withdrawal/recipient management and a payable fallback that only logs when msg.value matches stored constants. No unprotected value transfers, delegatecalls, selfdestructs, or upgrade paths were found, so there is no concrete exploitable profit path from bytecode alone.",
"raw_final": {
"summary": "Reviewed the runtime bytecode fully; it implements owner-gated withdrawal/recipient management and a payable fallback that only logs when msg.value matches stored constants. No unprotected value transfers, delegatecalls, selfdestructs, or upgrade paths were found, so there is no concrete exploitable profit path from bytecode alone.",
"findings": [],
"no_findings": true
},
"no_findings": true,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x008d 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH29 0x0100000000000000000000000000000000000000000000000000000000 0000002e: SWAP1 0000002f: DIV 00000030: DUP1 00000031: PUSH4 0x715018a6 00000036: GT 00000037: PUSH2 0x006b 0000003a: JUMPI 0000003b: DUP1 0000003c: PUSH4 0x715018a6 00000041: EQ 00000042: PUSH2 0x0399 00000045: JUMPI 00000046: DUP1 00000047: PUSH4 0x8da5cb5b 0000004c: EQ 0000004d: PUSH2 0x03b0 00000050: JUMPI 00000051: DUP1 00000052: PUSH4 0x8f32d59b 00000057: EQ 00000058: PUSH2 0x0407 0000005b: JUMPI 0000005c: DUP1 0000005d: PUSH4 0xf2fde38b 00000062: EQ 00000063: PUSH2 0x0436 00000066: JUMPI 00000067: PUSH2 0x008d 0000006a: JUMP 0000006b: JUMPDEST 0000006c: DUP1 0000006d: PUSH4 0x3ccfd60b 00000072: EQ 00000073: PUSH2 0x02da 00000076: JUMPI 00000077: DUP1 00000078: PUSH4 0x54c03ab7 0000007d: EQ 0000007e: PUSH2 0x02f1 00000081: JUMPI 00000082: DUP1 00000083: PUSH4 0x6f48e79b 00000088: EQ 00000089: PUSH2 0x0348 0000008c: JUMPI 0000008d: JUMPDEST 0000008e: PUSH1 0x00 00000090: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000a5: AND 000000a6: CALLER 000000a7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000bc: AND 000000bd: EQ 000000be: ISZERO 000000bf: DUP1 000000c0: ISZERO 000000c1: PUSH2 0x00f6 000000c4: JUMPI 000000c5: POP 000000c6: ADDRESS 000000c7: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000dc: AND 000000dd: CALLER 000000de: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000000f3: AND 000000f4: EQ 000000f5: ISZERO 000000f6: JUMPDEST 000000f7: ISZERO 000000f8: ISZERO 000000f9: PUSH2 0x0101 000000fc: JUMPI 000000fd: PUSH1 0x00 000000ff: DUP1 00000100: REVERT 00000101: JUMPDEST 00000102: PUSH1 0x05 00000104: SLOAD 00000105: CALLVALUE 00000106: EQ 00000107: DUP1 00000108: PUSH2 0x0112 0000010b: JUMPI 0000010c: POP 0000010d: PUSH1 0x06 0000010f: SLOAD 00000110: CALLVALUE 00000111: EQ 00000112: JUMPDEST 00000113: DUP1 00000114: PUSH2 0x011e 00000117: JUMPI 00000118: POP 00000119: PUSH1 0x07 0000011b: SLOAD 0000011c: CALLVALUE 0000011d: EQ 0000011e: JUMPDEST 0000011f: DUP1 00000120: PUSH2 0x012a 00000123: JUMPI 00000124: POP 00000125: PUSH1 0x08 00000127: SLOAD 00000128: CALLVALUE 00000129: EQ 0000012a: JUMPDEST 0000012b: DUP1 0000012c: PUSH2 0x0136 0000012f: JUMPI 00000130: POP 00000131: PUSH1 0x09 00000133: SLOAD 00000134: CALLVALUE 00000135: EQ 00000136: JUMPDEST 00000137: DUP1 00000138: PUSH2 0x0142 0000013b: JUMPI 0000013c: POP 0000013d: PUSH1 0x0a 0000013f: SLOAD 00000140: CALLVALUE 00000141: EQ 00000142: JUMPDEST 00000143: DUP1 00000144: PUSH2 0x014e 00000147: JUMPI 00000148: POP 00000149: PUSH1 0x0b 0000014b: SLOAD 0000014c: CALLVALUE 0000014d: EQ 0000014e: JUMPDEST 0000014f: DUP1 00000150: PUSH2 0x015a 00000153: JUMPI 00000154: POP 00000155: PUSH1 0x0c 00000157: SLOAD 00000158: CALLVALUE 00000159: EQ 0000015a: JUMPDEST 0000015b: DUP1 0000015c: PUSH2 0x0166 0000015f: JUMPI 00000160: POP 00000161: PUSH1 0x0d 00000163: SLOAD 00000164: CALLVALUE 00000165: EQ 00000166: JUMPDEST 00000167: DUP1 00000168: PUSH2 0x0172 0000016b: JUMPI 0000016c: POP 0000016d: PUSH1 0x0e 0000016f: SLOAD 00000170: CALLVALUE 00000171: EQ 00000172: JUMPDEST 00000173: DUP1 00000174: PUSH2 0x017e 00000177: JUMPI 00000178: POP 00000179: PUSH1 0x0f 0000017b: SLOAD 0000017c: CALLVALUE 0000017d: EQ 0000017e: JUMPDEST 0000017f: DUP1 00000180: PUSH2 0x018a 00000183: JUMPI 00000184: POP 00000185: PUSH1 0x10 00000187: SLOAD 00000188: CALLVALUE 00000189: EQ 0000018a: JUMPDEST 0000018b: DUP1 0000018c: PUSH2 0x0196 0000018f: JUMPI 00000190: POP 00000191: PUSH1 0x11 00000193: SLOAD 00000194: CALLVALUE 00000195: EQ 00000196: JUMPDEST 00000197: DUP1 00000198: PUSH2 0x01a2 0000019b: JUMPI 0000019c: POP 0000019d: PUSH1 0x12 0000019f: SLOAD 000001a0: CALLVALUE 000001a1: EQ 000001a2: JUMPDEST 000001a3: DUP1 000001a4: PUSH2 0x01ae 000001a7: JUMPI 000001a8: POP 000001a9: PUSH1 0x13 000001ab: SLOAD 000001ac: CALLVALUE 000001ad: EQ 000001ae: JUMPDEST 000001af: DUP1 000001b0: PUSH2 0x01ba 000001b3: JUMPI 000001b4: POP 000001b5: PUSH1 0x14 000001b7: SLOAD 000001b8: CALLVALUE 000001b9: EQ 000001ba: JUMPDEST 000001bb: DUP1 000001bc: PUSH2 0x01c6 000001bf: JUMPI 000001c0: POP 000001c1: PUSH1 0x15 000001c3: SLOAD 000001c4: CALLVALUE 000001c5: EQ 000001c6: JUMPDEST 000001c7: DUP1 000001c8: PUSH2 0x01d2 000001cb: JUMPI 000001cc: POP 000001cd: PUSH1 0x16 000001cf: SLOAD 000001d0: CALLVALUE 000001d1: EQ 000001d2: JUMPDEST 000001d3: DUP1 000001d4: PUSH2 0x01de 000001d7: JUMPI 000001d8: POP 000001d9: PUSH1 0x17 000001db: SLOAD 000001dc: CALLVALUE 000001dd: EQ 000001de: JUMPDEST 000001df: DUP1 000001e0: PUSH2 0x01ea 000001e3: JUMPI 000001e4: POP 000001e5: PUSH1 0x18 000001e7: SLOAD 000001e8: CALLVALUE 000001e9: EQ 000001ea: JUMPDEST 000001eb: DUP1 000001ec: PUSH2 0x01f6 000001ef: JUMPI 000001f0: POP 000001f1: PUSH1 0x19 000001f3: SLOAD 000001f4: CALLVALUE 000001f5: EQ 000001f6: JUMPDEST 000001f7: DUP1 000001f8: PUSH2 0x0202 000001fb: JUMPI 000001fc: POP 000001fd: PUSH1 0x1a 000001ff: SLOAD 00000200: CALLVALUE 00000201: EQ 00000202: JUMPDEST 00000203: DUP1 00000204: PUSH2 0x020e 00000207: JUMPI 00000208: POP 00000209: PUSH1 0x1b 0000020b: SLOAD 0000020c: CALLVALUE 0000020d: EQ 0000020e: JUMPDEST 0000020f: DUP1 00000210: PUSH2 0x021a 00000213: JUMPI 00000214: POP 00000215: PUSH1 0x1c 00000217: SLOAD 00000218: CALLVALUE 00000219: EQ 0000021a: JUMPDEST 0000021b: DUP1 0000021c: PUSH2 0x0226 0000021f: JUMPI 00000220: POP 00000221: PUSH1 0x1d 00000223: SLOAD 00000224: CALLVALUE 00000225: EQ 00000226: JUMPDEST 00000227: DUP1 00000228: PUSH2 0x0232 0000022b: JUMPI 0000022c: POP 0000022d: PUSH1 0x1e 0000022f: SLOAD 00000230: CALLVALUE 00000231: EQ 00000232: JUMPDEST 00000233: DUP1 00000234: PUSH2 0x023e 00000237: JUMPI 00000238: POP 00000239: PUSH1 0x1f 0000023b: SLOAD 0000023c: CALLVALUE 0000023d: EQ 0000023e: JUMPDEST 0000023f: DUP1 00000240: PUSH2 0x024a 00000243: JUMPI 00000244: POP 00000245: PUSH1 0x20 00000247: SLOAD 00000248: CALLVALUE 00000249: EQ 0000024a: JUMPDEST 0000024b: DUP1 0000024c: PUSH2 0x0256 0000024f: JUMPI 00000250: POP 00000251: PUSH1 0x21 00000253: SLOAD 00000254: CALLVALUE 00000255: EQ 00000256: JUMPDEST 00000257: DUP1 00000258: PUSH2 0x0262 0000025b: JUMPI 0000025c: POP 0000025d: PUSH1 0x22 0000025f: SLOAD 00000260: CALLVALUE 00000261: EQ 00000262: JUMPDEST 00000263: ISZERO 00000264: ISZERO 00000265: PUSH2 0x026d 00000268: JUMPI 00000269: PUSH1 0x00 0000026b: DUP1 0000026c: REVERT 0000026d: JUMPDEST 0000026e: PUSH32 0xdd6c6913dd4f1ff7839115927f06a4bbea5f26a0e88f55c64159155cf9f9f175 0000028f: CALLER 00000290: CALLVALUE 00000291: PUSH1 0x40 00000293: MLOAD 00000294: DUP1 00000295: DUP4 00000296: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002ab: AND 000002ac: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002c1: AND 000002c2: DUP2 000002c3: MSTORE 000002c4: PUSH1 0x20 000002c6: ADD 000002c7: DUP3 000002c8: DUP2 000002c9: MSTORE 000002ca: PUSH1 0x20 000002cc: ADD 000002cd: SWAP3 000002ce: POP 000002cf: POP 000002d0: POP 000002d1: PUSH1 0x40 000002d3: MLOAD 000002d4: DUP1 000002d5: SWAP2 000002d6: SUB 000002d7: SWAP1 000002d8: LOG1 000002d9: STOP 000002da: JUMPDEST 000002db: CALLVALUE 000002dc: DUP1 000002dd: ISZERO 000002de: PUSH2 0x02e6 000002e1: JUMPI 000002e2: PUSH1 0x00 000002e4: DUP1 000002e5: REVERT 000002e6: JUMPDEST 000002e7: POP 000002e8: PUSH2 0x02ef 000002eb: PUSH2 0x0487 000002ee: JUMP 000002ef: JUMPDEST 000002f0: STOP 000002f1: JUMPDEST 000002f2: CALLVALUE 000002f3: DUP1 000002f4: ISZERO 000002f5: PUSH2 0x02fd 000002f8: JUMPI 000002f9: PUSH1 0x00 000002fb: DUP1 000002fc: REVERT 000002fd: JUMPDEST 000002fe: POP 000002ff: PUSH2 0x0306 00000302: PUSH2 0x05c0 00000305: JUMP 00000306: JUMPDEST 00000307: PUSH1 0x40 00000309: MLOAD 0000030a: DUP1 0000030b: DUP3 0000030c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000321: AND 00000322: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000337: AND 00000338: DUP2 00000339: MSTORE 0000033a: PUSH1 0x20 0000033c: ADD 0000033d: SWAP2 0000033e: POP 0000033f: POP 00000340: PUSH1 0x40 00000342: MLOAD 00000343: DUP1 00000344: SWAP2 00000345: SUB 00000346: SWAP1 00000347: RETURN 00000348: JUMPDEST 00000349: CALLVALUE 0000034a: DUP1 0000034b: ISZERO 0000034c: PUSH2 0x0354 0000034f: JUMPI 00000350: PUSH1 0x00 00000352: DUP1 00000353: REVERT 00000354: JUMPDEST 00000355: POP 00000356: PUSH2 0x0397 00000359: PUSH1 0x04 0000035b: DUP1 0000035c: CALLDATASIZE 0000035d: SUB 0000035e: PUSH1 0x20 00000360: DUP2 00000361: LT 00000362: ISZERO 00000363: PUSH2 0x036b 00000366: JUMPI 00000367: PUSH1 0x00 00000369: DUP1 0000036a: REVERT 0000036b: JUMPDEST 0000036c: DUP2 0000036d: ADD 0000036e: SWAP1 0000036f: DUP1 00000370: DUP1 00000371: CALLDATALOAD 00000372: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000387: AND 00000388: SWAP1 00000389: PUSH1 0x20 0000038b: ADD 0000038c: SWAP1 0000038d: SWAP3 0000038e: SWAP2 0000038f: SWAP1 00000390: POP 00000391: POP 00000392: POP 00000393: PUSH2 0x05fd 00000396: JUMP 00000397: JUMPDEST 00000398: STOP 00000399: JUMPDEST 0000039a: CALLVALUE 0000039b: DUP1 0000039c: ISZERO 0000039d: PUSH2 0x03a5 000003a0: JUMPI 000003a1: PUSH1 0x00 000003a3: DUP1 000003a4: REVERT 000003a5: JUMPDEST 000003a6: POP 000003a7: PUSH2 0x03ae 000003aa: PUSH2 0x0690 000003ad: JUMP 000003ae: JUMPDEST 000003af: STOP 000003b0: JUMPDEST 000003b1: CALLVALUE 000003b2: DUP1 000003b3: ISZERO 000003b4: PUSH2 0x03bc 000003b7: JUMPI 000003b8: PUSH1 0x00 000003ba: DUP1 000003bb: REVERT 000003bc: JUMPDEST 000003bd: POP 000003be: PUSH2 0x03c5 000003c1: PUSH2 0x0764 000003c4: JUMP 000003c5: JUMPDEST 000003c6: PUSH1 0x40 000003c8: MLOAD 000003c9: DUP1 000003ca: DUP3 000003cb: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003e0: AND 000003e1: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003f6: AND 000003f7: DUP2 000003f8: MSTORE 000003f9: PUSH1 0x20 000003fb: ADD 000003fc: SWAP2 000003fd: POP 000003fe: POP 000003ff: PUSH1 0x40 00000401: MLOAD 00000402: DUP1 00000403: SWAP2 00000404: SUB 00000405: SWAP1 00000406: RETURN 00000407: JUMPDEST 00000408: CALLVALUE 00000409: DUP1 0000040a: ISZERO 0000040b: PUSH2 0x0413 0000040e: JUMPI 0000040f: PUSH1 0x00 00000411: DUP1 00000412: REVERT 00000413: JUMPDEST 00000414: POP 00000415: PUSH2 0x041c 00000418: PUSH2 0x078e 0000041b: JUMP 0000041c: JUMPDEST 0000041d: PUSH1 0x40 0000041f: MLOAD 00000420: DUP1 00000421: DUP3 00000422: ISZERO 00000423: ISZERO 00000424: ISZERO 00000425: ISZERO 00000426: DUP2 00000427: MSTORE 00000428: PUSH1 0x20 0000042a: ADD 0000042b: SWAP2 0000042c: POP 0000042d: POP 0000042e: PUSH1 0x40 00000430: MLOAD 00000431: DUP1 00000432: SWAP2 00000433: SUB 00000434: SWAP1 00000435: RETURN 00000436: JUMPDEST 00000437: CALLVALUE 00000438: DUP1 00000439: ISZERO 0000043a: PUSH2 0x0442 0000043d: JUMPI 0000043e: PUSH1 0x00 00000440: DUP1 00000441: REVERT 00000442: JUMPDEST 00000443: POP 00000444: PUSH2 0x0485 00000447: PUSH1 0x04 00000449: DUP1 0000044a: CALLDATASIZE 0000044b: SUB 0000044c: PUSH1 0x20 0000044e: DUP2 0000044f: LT 00000450: ISZERO 00000451: PUSH2 0x0459 00000454: JUMPI 00000455: PUSH1 0x00 00000457: DUP1 00000458: REVERT 00000459: JUMPDEST 0000045a: DUP2 0000045b: ADD 0000045c: SWAP1 0000045d: DUP1 0000045e: DUP1 0000045f: CALLDATALOAD 00000460: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000475: AND 00000476: SWAP1 00000477: PUSH1 0x20 00000479: ADD 0000047a: SWAP1 0000047b: SWAP3 0000047c: SWAP2 0000047d: SWAP1 0000047e: POP 0000047f: POP 00000480: POP 00000481: PUSH2 0x07e6 00000484: JUMP 00000485: JUMPDEST 00000486: STOP 00000487: JUMPDEST 00000488: PUSH2 0x048f 0000048b: PUSH2 0x078e 0000048e: JUMP 0000048f: JUMPDEST 00000490: ISZERO 00000491: ISZERO 00000492: PUSH2 0x049a 00000495: JUMPI 00000496: PUSH1 0x00 00000498: DUP1 00000499: REVERT 0000049a: JUMPDEST 0000049b: PUSH1 0x03 0000049d: PUSH1 0x00 0000049f: SWAP1 000004a0: SLOAD 000004a1: SWAP1 000004a2: PUSH2 0x0100 000004a5: EXP 000004a6: SWAP1 000004a7: DIV 000004a8: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000004bd: AND 000004be: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000004d3: AND 000004d4: PUSH2 0x08fc 000004d7: ADDRESS 000004d8: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000004ed: AND 000004ee: BALANCE 000004ef: SWAP1 000004f0: DUP2 000004f1: ISZERO 000004f2: MUL 000004f3: SWAP1 000004f4: PUSH1 0x40 000004f6: MLOAD 000004f7: PUSH1 0x00 000004f9: PUSH1 0x40 000004fb: MLOAD 000004fc: DUP1 000004fd: DUP4 000004fe: SUB 000004ff: DUP2 00000500: DUP6 00000501: DUP9 00000502: DUP9 00000503: CALL 00000504: SWAP4 00000505: POP 00000506: POP 00000507: POP 00000508: POP 00000509: ISZERO 0000050a: DUP1 0000050b: ISZERO 0000050c: PUSH2 0x0519 0000050f: JUMPI 00000510: RETURNDATASIZE 00000511: PUSH1 0x00 00000513: DUP1 00000514: RETURNDATACOPY 00000515: RETURNDATASIZE 00000516: PUSH1 0x00 00000518: REVERT 00000519: JUMPDEST 0000051a: POP 0000051b: PUSH32 0x41caea7d684d5ba5fba1924d54c5169a147971fb5ffdde987624e8bbd450828b 0000053c: PUSH1 0x03 0000053e: PUSH1 0x00 00000540: SWAP1 00000541: SLOAD 00000542: SWAP1 00000543: PUSH2 0x0100 00000546: EXP 00000547: SWAP1 00000548: DIV 00000549: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000055e: AND 0000055f: ADDRESS 00000560: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000575: AND 00000576: BALANCE 00000577: PUSH1 0x40 00000579: MLOAD 0000057a: DUP1 0000057b: DUP4 0000057c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000591: AND 00000592: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005a7: AND 000005a8: DUP2 000005a9: MSTORE 000005aa: PUSH1 0x20 000005ac: ADD 000005ad: DUP3 000005ae: DUP2 000005af: MSTORE 000005b0: PUSH1 0x20 000005b2: ADD 000005b3: SWAP3 000005b4: POP 000005b5: POP 000005b6: POP 000005b7: PUSH1 0x40 000005b9: MLOAD 000005ba: DUP1 000005bb: SWAP2 000005bc: SUB 000005bd: SWAP1 000005be: LOG1 000005bf: JUMP 000005c0: JUMPDEST 000005c1: PUSH1 0x00 000005c3: PUSH2 0x05ca 000005c6: PUSH2 0x078e 000005c9: JUMP 000005ca: JUMPDEST 000005cb: ISZERO 000005cc: ISZERO 000005cd: PUSH2 0x05d5 000005d0: JUMPI 000005d1: PUSH1 0x00 000005d3: DUP1 000005d4: REVERT 000005d5: JUMPDEST 000005d6: PUSH1 0x03 000005d8: PUSH1 0x00 000005da: SWAP1 000005db: SLOAD 000005dc: SWAP1 000005dd: PUSH2 0x0100 000005e0: EXP 000005e1: SWAP1 000005e2: DIV 000005e3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005f8: AND 000005f9: SWAP1 000005fa: POP 000005fb: SWAP1 000005fc: JUMP 000005fd: JUMPDEST 000005fe: PUSH2 0x0605 00000601: PUSH2 0x078e 00000604: JUMP 00000605: JUMPDEST 00000606: ISZERO 00000607: ISZERO 00000608: PUSH2 0x0610 0000060b: JUMPI 0000060c: PUSH1 0x00 0000060e: DUP1 0000060f: REVERT 00000610: JUMPDEST 00000611: PUSH1 0x00 00000613: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000628: AND 00000629: CALLER 0000062a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000063f: AND 00000640: EQ 00000641: ISZERO 00000642: ISZERO 00000643: ISZERO 00000644: PUSH2 0x064c 00000647: JUMPI 00000648: PUSH1 0x00 0000064a: DUP1 0000064b: REVERT 0000064c: JUMPDEST 0000064d: DUP1 0000064e: PUSH1 0x03 00000650: PUSH1 0x00 00000652: PUSH2 0x0100 00000655: EXP 00000656: DUP2 00000657: SLOAD 00000658: DUP2 00000659: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000066e: MUL 0000066f: NOT 00000670: AND 00000671: SWAP1 00000672: DUP4 00000673: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000688: AND 00000689: MUL 0000068a: OR 0000068b: SWAP1 0000068c: SSTORE 0000068d: POP 0000068e: POP 0000068f: JUMP 00000690: JUMPDEST 00000691: PUSH2 0x0698 00000694: PUSH2 0x078e 00000697: JUMP 00000698: JUMPDEST 00000699: ISZERO 0000069a: ISZERO 0000069b: PUSH2 0x06a3 0000069e: JUMPI 0000069f: PUSH1 0x00 000006a1: DUP1 000006a2: REVERT 000006a3: JUMPDEST 000006a4: PUSH1 0x00 000006a6: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006bb: AND 000006bc: PUSH1 0x01 000006be: PUSH1 0x00 000006c0: SWAP1 000006c1: SLOAD 000006c2: SWAP1 000006c3: PUSH2 0x0100 000006c6: EXP 000006c7: SWAP1 000006c8: DIV 000006c9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006de: AND 000006df: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006f4: AND 000006f5: PUSH32 0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0 00000716: PUSH1 0x40 00000718: MLOAD 00000719: PUSH1 0x40 0000071b: MLOAD 0000071c: DUP1 0000071d: SWAP2 0000071e: SUB 0000071f: SWAP1 00000720: LOG3 00000721: PUSH1 0x00 00000723: PUSH1 0x01 00000725: PUSH1 0x00 00000727: PUSH2 0x0100 0000072a: EXP 0000072b: DUP2 0000072c: SLOAD 0000072d: DUP2 0000072e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000743: MUL 00000744: NOT 00000745: AND 00000746: SWAP1 00000747: DUP4 00000748: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000075d: AND 0000075e: MUL 0000075f: OR 00000760: SWAP1 00000761: SSTORE 00000762: POP 00000763: JUMP 00000764: JUMPDEST 00000765: PUSH1 0x00 00000767: PUSH1 0x01 00000769: PUSH1 0x00 0000076b: SWAP1 0000076c: SLOAD 0000076d: SWAP1 0000076e: PUSH2 0x0100 00000771: EXP 00000772: SWAP1 00000773: DIV 00000774: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000789: AND 0000078a: SWAP1 0000078b: POP 0000078c: SWAP1 0000078d: JUMP 0000078e: JUMPDEST 0000078f: PUSH1 0x00 00000791: PUSH1 0x01 00000793: PUSH1 0x00 00000795: SWAP1 00000796: SLOAD 00000797: SWAP1 00000798: PUSH2 0x0100 0000079b: EXP 0000079c: SWAP1 0000079d: DIV 0000079e: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007b3: AND 000007b4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007c9: AND 000007ca: CALLER 000007cb: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007e0: AND 000007e1: EQ 000007e2: SWAP1 000007e3: POP 000007e4: SWAP1 000007e5: JUMP 000007e6: JUMPDEST 000007e7: PUSH2 0x07ee 000007ea: PUSH2 0x078e 000007ed: JUMP 000007ee: JUMPDEST 000007ef: ISZERO 000007f0: ISZERO 000007f1: PUSH2 0x07f9 000007f4: JUMPI 000007f5: PUSH1 0x00 000007f7: DUP1 000007f8: REVERT 000007f9: JUMPDEST 000007fa: PUSH2 0x0802 000007fd: DUP2 000007fe: PUSH2 0x0805 00000801: JUMP 00000802: JUMPDEST 00000803: POP 00000804: JUMP 00000805: JUMPDEST 00000806: PUSH1 0x00 00000808: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000081d: AND 0000081e: DUP2 0000081f: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000834: AND 00000835: EQ 00000836: ISZERO 00000837: ISZERO 00000838: ISZERO 00000839: PUSH2 0x0841 0000083c: JUMPI 0000083d: PUSH1 0x00 0000083f: DUP1 00000840: REVERT 00000841: JUMPDEST 00000842: DUP1 00000843: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000858: AND 00000859: PUSH1 0x01 0000085b: PUSH1 0x00 0000085d: SWAP1 0000085e: SLOAD 0000085f: SWAP1 00000860: PUSH2 0x0100 00000863: EXP 00000864: SWAP1 00000865: DIV 00000866: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000087b: AND 0000087c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000891: AND 00000892: PUSH32 0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0 000008b3: PUSH1 0x40 000008b5: MLOAD 000008b6: PUSH1 0x40 000008b8: MLOAD 000008b9: DUP1 000008ba: SWAP2 000008bb: SUB 000008bc: SWAP1 000008bd: LOG3 000008be: DUP1 000008bf: PUSH1 0x01 000008c1: PUSH1 0x00 000008c3: PUSH2 0x0100 000008c6: EXP 000008c7: DUP2 000008c8: SLOAD 000008c9: DUP2 000008ca: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008df: MUL 000008e0: NOT 000008e1: AND 000008e2: SWAP1 000008e3: DUP4 000008e4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008f9: AND 000008fa: MUL 000008fb: OR 000008fc: SWAP1 000008fd: SSTORE 000008fe: POP 000008ff: POP 00000900: JUMP 00000901: JUMPDEST 00000902: PUSH1 0x00 00000904: DUP1 00000905: DUP4 00000906: EQ 00000907: ISZERO 00000908: PUSH2 0x0914 0000090b: JUMPI 0000090c: PUSH1 0x00 0000090e: SWAP1 0000090f: POP 00000910: PUSH2 0x0939 00000913: JUMP 00000914: JUMPDEST 00000915: PUSH1 0x00 00000917: DUP3 00000918: DUP5 00000919: MUL 0000091a: SWAP1 0000091b: POP 0000091c: DUP3 0000091d: DUP5 0000091e: DUP3 0000091f: DUP2 00000920: ISZERO 00000921: ISZERO 00000922: PUSH2 0x0927 00000925: JUMPI 00000926: INVALID 00000927: JUMPDEST 00000928: DIV 00000929: EQ 0000092a: ISZERO 0000092b: ISZERO 0000092c: PUSH2 0x0934 0000092f: JUMPI 00000930: PUSH1 0x00 00000932: DUP1 00000933: REVERT 00000934: JUMPDEST 00000935: DUP1 00000936: SWAP2 00000937: POP 00000938: POP 00000939: JUMPDEST 0000093a: SWAP3 0000093b: SWAP2 0000093c: POP 0000093d: POP 0000093e: JUMP 0000093f: INVALID 00000940: LOG1 00000941: PUSH6 0x627a7a723058 00000948: KECCAK256 00000949: DUP15 0000094a: UNKNOWN(0x2E) 0000094b: SLT 0000094c: SGT 0000094d: STATICCALL 0000094e: RETURNDATACOPY 0000094f: PUSH0 00000950: UNKNOWN(0xFB) 00000951: LOG1 00000952: TIMESTAMP 00000953: GT 00000954: UNKNOWN(0x2E) 00000955: SWAP9 00000956: UNKNOWN(0xE6) 00000957: PUSH1 0x03 00000959: UNKNOWN(0xA7) 0000095a: UNKNOWN(0xEB) 0000095b: DUP15 0000095c: ISZERO 0000095d: DUP10 0000095e: SELFDESTRUCT 0000095f: DUP2 00000960: UNKNOWN(0xDD) 00000961: DUP7 00000962: EXP 00000963: UNKNOWN(0x4C) 00000964: UNKNOWN(0xB9) 00000965: UNKNOWN(0xE7) 00000966: UNKNOWN(0x27) 00000967: UNKNOWN(0xB1) 00000968: UNKNOWN(0xD9) 00000969: STOP 0000096a: UNKNOWN(0x29)
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | other | cast | SELFDESTRUCT present | 85 | no | — |
viewevidence_json{
"notes": "selfdestruct can remove contract code and send funds; review reachability",
"selfdestruct_count": 1
}
|
| medium | other | detector | Untrusted CALL target/value reachable | 45 | no | no |
viewtrace_id: 0x3d95259c165d2ed2f0c1a3167f0cf46e1834a24b154b1d14d105e97234ea4c79
call_targets:
0xde5120b839e79470f18a86cdc8e78ce48d1b30f3
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x3d95259c165d2ed2f0c1a3167f0cf46e1834a24b154b1d14d105e97234ea4c79",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xde5120b839e79470f18a86cdc8e78ce48d1b30f3"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x715018a6",
"selector": "0x715018a6",
"calldata_variants": [
"0x715018a6",
"0x715018a60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8f32d59b",
"selector": "0x8f32d59b",
"calldata_variants": [
"0x8f32d59b",
"0x8f32d59b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x3ccfd60b",
"selector": "0x3ccfd60b",
"calldata_variants": [
"0x3ccfd60b",
"0x3ccfd60b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x54c03ab7",
"selector": "0x54c03ab7",
"calldata_variants": [
"0x54c03ab7",
"0x54c03ab70000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6f48e79b",
"selector": "0x6f48e79b",
"calldata_variants": [
"0x6f48e79b",
"0x6f48e79b0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1283,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 1,
"guards_detected": [
{
"pc": 166,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 221,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1577,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1994,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
}
],
"untrusted_call_count": 1
}
|
| medium | other | detector | ETH value transfer possible | 40 | no | no |
viewtrace_id: 0x3d95259c165d2ed2f0c1a3167f0cf46e1834a24b154b1d14d105e97234ea4c79
call_targets:
0xde5120b839e79470f18a86cdc8e78ce48d1b30f3
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x3d95259c165d2ed2f0c1a3167f0cf46e1834a24b154b1d14d105e97234ea4c79",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xde5120b839e79470f18a86cdc8e78ce48d1b30f3"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x715018a6",
"selector": "0x715018a6",
"calldata_variants": [
"0x715018a6",
"0x715018a60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8f32d59b",
"selector": "0x8f32d59b",
"calldata_variants": [
"0x8f32d59b",
"0x8f32d59b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x3ccfd60b",
"selector": "0x3ccfd60b",
"calldata_variants": [
"0x3ccfd60b",
"0x3ccfd60b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x54c03ab7",
"selector": "0x54c03ab7",
"calldata_variants": [
"0x54c03ab7",
"0x54c03ab70000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6f48e79b",
"selector": "0x6f48e79b",
"calldata_variants": [
"0x6f48e79b",
"0x6f48e79b0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1283,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 1,
"guards_detected": [
{
"pc": 166,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 221,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1577,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1994,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
}
]
}
|
| medium | other | detector | SELFDESTRUCT reachable | 45 | no | no |
viewtrace_id: 0xc4de7dddaf2f6c106218698d1f5c7a7c10384e5b91e7e99fb74df7d5afc30a01
validation_json{
"sink": "SELFDESTRUCT",
"errors": 0,
"status": "unknown",
"attempts": 14,
"trace_id": "0xc4de7dddaf2f6c106218698d1f5c7a7c10384e5b91e7e99fb74df7d5afc30a01",
"confirmed": false,
"trace_mode": "structLogs",
"call_targets": null,
"matched_probe": null,
"target_varies": null,
"classification": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x715018a6",
"selector": "0x715018a6",
"calldata_variants": [
"0x715018a6",
"0x715018a60000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8f32d59b",
"selector": "0x8f32d59b",
"calldata_variants": [
"0x8f32d59b",
"0x8f32d59b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x3ccfd60b",
"selector": "0x3ccfd60b",
"calldata_variants": [
"0x3ccfd60b",
"0x3ccfd60b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x54c03ab7",
"selector": "0x54c03ab7",
"calldata_variants": [
"0x54c03ab7",
"0x54c03ab70000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6f48e79b",
"selector": "0x6f48e79b",
"calldata_variants": [
"0x6f48e79b",
"0x6f48e79b0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"guards_detected": [
{
"pc": 166,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 221,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1577,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
},
{
"pc": 1994,
"type": "msg_sender_eq_const",
"value": "0xffffffffffffffffffffffffffffffffffffffff"
}
],
"selfdestruct_count": 1
}
|