60de4a72-f6f9-4222-b64c-f6d66382615f
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 31173 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 76852 | artifact.fetch | complete | 1 / 3 | 2 weeks ago |
| 76853 | tool.cast_disasm | complete | 1 / 3 | 2 weeks ago |
| 76854 | analysis.bundle | complete | 1 / 3 | 2 weeks ago |
| 76855 | capability.graph | complete | 1 / 3 | 2 weeks ago |
| 76856 | detector.run | complete | 1 / 3 | 2 weeks ago |
| 76857 | validation.fork | complete | 1 / 3 | 2 weeks ago |
No slither job recorded yet.
[codex:82] OpenAI Codex v0.77.0 (research preview)
[codex:82] --------
[codex:82] workdir: /tmp/codex-multi-4h2xq5fv
[codex:82] model: gpt-5.2-codex
[codex:82] provider: openai
[codex:82] approval: never
[codex:82] sandbox: read-only
[codex:82] reasoning effort: xhigh
[codex:82] reasoning summaries: auto
[codex:82] session id: 019b7c49-3dc0-7431-895b-d4b1b9227932
[codex:82] --------
[codex:82] user
[codex:82] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:82]
[codex:82] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:82]
[codex:82] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:82] - Gas inefficiency, code quality, or best practices
[codex:82] - Theoretical vulnerabilities without a clear extraction path
[codex:82] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:82] - Issues requiring social engineering or off-chain coordination
[codex:82]
[codex:82] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:82] - CALL/DELEGATECALL with controllable destination or calldata
[codex:82] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:82] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:82] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:82] - External calls before state updates (reentrancy)
[codex:82] - SELFDESTRUCT with controllable beneficiary
[codex:82] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:82]
[codex:82] For each finding, you MUST explain:
[codex:82] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:82] 2. The concrete sequence of transactions to extract value
[codex:82] 3. Why you believe this is exploitable (not just suspicious)
[codex:82]
[codex:82] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:82] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:82]
[codex:82] Output MUST be valid JSON matching the provided schema.
[codex:82] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:82] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:82] mcp startup: no servers
[codex:82]
[codex:82] thinking
[codex:82] **Preparing to read instructions**
[codex:82] exec
[codex:82] /bin/bash -lc ls in /tmp/codex-multi-4h2xq5fv succeeded in 5ms:
[codex:82] BYTECODE_BUNDLE.txt
[codex:82] codex-output-schema.json
[codex:82] exec
[codex:82] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-4h2xq5fv succeeded in 5ms:
[codex:82] Runtime bytecode bundle for best-effort auditing.
[codex:82] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:82]
[codex:82] FILE: runtime_bytecode.hex
[codex:82] 0x606060405236156100c45760e060020a6000350463173825d981146101165780632f54bf6e146101715780634123cb6b1461019957806354fd4d50146101a25780635c52c2f5146101af5780637065cb48146101e0578063746c917114610214578063797af6271461021d578063b20d30a914610230578063b61d27f614610264578063b75c7dc614610285578063ba51a6df146102b4578063c2cf7326146102e8578063cbf0b0c014610326578063f00d4b5d1461035a578063f1736d8614610393575b61039d60003411156101145760408051600160a060020a033216815234602082015281517fe1fffcc4923d04b559f4d29a8bfc6cda04eb5b0d3c460751c2402c5c5cc9109c929181900390910190a15b565b61039d6004356000600036436040518084848082843750505090910190815260405190819003602001902090506106b8815b600160a060020a03321660009081526101026020526040812054818082811415610c2e57610d86565b61039f6004355b600160a060020a03811660009081526101026020526040812054115b919050565b61039f60015481565b6103b16101085460ff1681565b61039d6000364360405180848480828437505050909101908152604051908190036020019020905061080981610148565b61039d6004356000364360405180848480828437505050909101908152604051908190036020019020905061063081610148565b61039f60005481565b61039f6004355b600081610a6c81610148565b61039d600435600036436040518084848082843750505090910190815260405190819003602001902090506107fd81610148565b61039f60048035906024803591604435918201910135600061082832610178565b61039d600435600160a060020a033216600090815261010260205260408120549080828114156103c757610446565b61039d6004356000364360405180848480828437505050909101908152604051908190036020019020905061077781610148565b61039f600435602435600082815261010360209081526040808320600160a060020a038516845261010290925282205482818114156107d0576107f4565b61039d6004356000364360405180848480828437505050909101908152604051908190036020019020905061081781610148565b61039d6004356024356000600036436040518084848082843750505090910190815260405190819003602001902090506104d181610148565b61039f6101055481565b005b60408051918252519081900360200190f35b6040805160ff9092168252519081900360200190f35b50506000828152610103602052604081206001810154600284900a9290831611156104465780546001828101805492909101835590839003905560408051600160a060020a03321681526020810186905281517fc7fb647e59b18047309aa15aad418e5d7ca96d173ad704f1031a2c3d7591734b929181900390910190a15b50505050565b600160a060020a03831660028361010081101561000257508301819055600160a060020a03851660008181526101026020908152604080832083905584835291829020869055815192835282019290925281517fb532073b38c83145e3e5135377a08bf9aab55bc0fd7c1179cd4fb995d2a5159c929181900390910190a1505b505050565b15610446576104df83610178565b156104ea57506104cc565b600160a060020a03841660009081526101026020526040812054925082141561051357506104cc565b61044c5b6101045460005b81811015610ed357610104805461010991600091849081101561000257600080516020610f8e83398151915201548252506020918252604081208054600160a060020a0319168155600181018290556002810180548382559083528383209193610f5892601f9290920104810190610a54565b60018054810190819055600160a060020a038316906002906101008110156100025790900160005081905550600160005054610102600050600084600160a060020a03168152602001908152602001600020600050819055507f994a936646fe87ffe4f1e469d3d6aa417d6b855598397f323de5b449f765f0c3826040518082600160a060020a0316815260200191505060405180910390a15b505b50565b1561062b5761063e82610178565b15610649575061062d565b610651610517565b60015460fa90106106665761066461067b565b505b60015460fa9010610591575061062d565b6107355b600060015b600154811015610a68575b600154811080156106ab5750600281610100811015610002570154600014155b15610d8e5760010161068b565b156104cc57600160a060020a0383166000908152610102602052604081205492508214156106e6575061062b565b6001600160005054036000600050541115610701575061062b565b600060028361010081101561000257508301819055600160a060020a03841681526101026020526040812055610677610517565b5060408051600160a060020a038516815290517f58619076adf5bb0943d100ef88d52d7c3fd691b19d3a9071b555b651fbf418da9181900360200190a1505050565b1561062b5760015482111561078c575061062d565b6000829055610799610517565b6040805183815290517facbdb084c721332ac59f9b8e392196c9eb0e4932862da8eb9beaf0dad4f550da9181900360200190a15050565b506001820154600282900a908116600014156107ef57600093506107f4565b600193505b50505092915050565b1561062b575061010555565b1561062d5760006101065550565b1561062b5781600160a060020a0316ff5b15610a445761083c846000610e6832610178565b156108f8577f92ca3a80853e6663fa31fa10b99225f18d4902939b4c53a9caae9043f6efd00432858786866040518086600160a060020a0316815260200185815260200184600160a060020a031681526020018060200182810382528484828181526020019250808284378201915050965050505050505060405180910390a184600160a060020a03168484846040518083838082843750505090810191506000908083038185876185025a03f15060009350610a4492505050565b60003643604051808484808284375050509091019081526040519081900360200190209150610928905081610224565b15801561094b575060008181526101096020526040812054600160a060020a0316145b15610a445760008181526101096020908152604082208054600160a060020a03191688178155600181018790556002018054858255818452928290209092601f01919091048101908490868215610a4c579182015b82811115610a4c5782358260005055916020019190600101906109a0565b50507f1733cbb53659d713b79580f79f3f9ff215f78a7c7aa45890f3b89fc5cddfbf328132868887876040518087815260200186600160a060020a0316815260200185815260200184600160a060020a03168152602001806020018281038252848482818152602001925080828437820191505097505050505050505060405180910390a15b949350505050565b506109be9291505b80821115610a685760008155600101610a54565b5090565b15610c1b5760008381526101096020526040812054600160a060020a031614610c1b5760408051600091909120805460018201546002929092018054600160a060020a0392909216939091819083908015610aec57820191906000526020600020905b815481529060010190602001808311610acf57829003601f168201915b505091505060006040518083038185876185025a03f150505060008481526101096020908152604080519281902080546001820154600160a060020a033281811688529587018b905293860181905292166060850181905260a06080860181815260029390930180549187018290527fe7c957c06e9a662c1a6c77366179f5b702b97651dc28eee7d5bf1dff6e40bb4a975094958a959293909160c083019084908015610bbe57820191906000526020600020905b815481529060010190602001808311610ba157829003601f168201915b5050965050505050505060405180910390a160008381526101096020908152604082208054600160a060020a031916815560018101839055600281018054848255908452828420919392610c2192601f9290920104810190610a54565b50919050565b5050506001915050610194565b60008581526101036020526040812080549093501415610cb6576000805483556001838101919091556101048054918201808255828015829011610c8557818360005260206000209182019101610c859190610a54565b50505060028301819055610104805487929081101561000257600091909152600080516020610f8e83398151915201555b506001810154600283900a90811660001415610d865760408051600160a060020a03321681526020810187905281517fe1c52dc63b719ade82e8bea94cc41a0d5d28e4aaf536adb5e9cccc9ff8c1aeda929181900390910190a1815460019011610d73576000858152610103602052604090206002015461010480549091908110156100025760406000908120600080516020610f8e8339815191529290920181905580825560018083018290556002909201559450610d869050565b8154600019018255600182018054821790555b505050919050565b5b60018054118015610db157506001546002906101008110156100025701546000145b15610dc55760018054600019019055610d8f565b60015481108015610de85750600154600290610100811015610002570154600014155b8015610e0257506002816101008110156100025701546000145b15610e6357600154600290610100811015610002578101549082610100811015610002578101919091558190610102906000908361010081101561000257810154825260209290925260408120929092556001546101008110156100025701555b610680565b156101945761010754610e7e5b62015180420490565b1115610e9757600061010655610e92610e75565b610107555b6101065480830110801590610eb55750610106546101055490830111155b15610ecb57506101068054820190556001610194565b506000610194565b61062b6101045460005b81811015610f635761010480548290811015610002576000918252600080516020610f8e833981519152015414610f5057610104805461010391600091849081101561000257600080516020610f8e83398151915201548252506020919091526040812081815560018101829055600201555b600101610edd565b50505060010161051e565b61010480546000808355919091526104cc90600080516020610f8e83398151915290810190610a5456004c0be60200faa20559308cb7b5a1bb3255c16cb1cab91f525b5ae7a03d02fabe
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing EVM bytecode for exploit patterns**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] # remove non-hex? ensure even
[codex:82] if hexstr.startswith('0x'): hexstr=hexstr[2:]
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] print('len',len(hexstr)//2)
[codex:82] # disassemble
[codex:82] ops = {}
[codex:82] # opcode names
[codex:82] opnames = {
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:82] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] i=0
[codex:82] out=[]
[codex:82] while i<len(data):
[codex:82] op=data[i]
[codex:82] name=opnames.get(op,'UNKNOWN')
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[i+1:i+1+n]
[codex:82] out.append((i, name, imm.hex()))
[codex:82] i+=1+n
[codex:82] else:
[codex:82] out.append((i, name, ''))
[codex:82] i+=1
[codex:82]
[codex:82] # Print locations of CALL, DELEGATECALL, SELFDESTRUCT, CALLCODE
[codex:82] for target in {'CALL','DELEGATECALL','CALLCODE','SELFDESTRUCT','STATICCALL','CREATE','CREATE2'}:
[codex:82] loc=[(i,name,imm) for (i,name,imm) in out if name==target]
[codex:82] if loc:
[codex:82] print(target, 'count', len(loc), 'locs', [hex(i) for i,_,__ in loc])
[codex:82]
[codex:82] # show disassembly around SELFDESTRUCT
[codex:82] self_locs=[i for i,name,_ in out if name=='SELFDESTRUCT']
[codex:82] for loc in self_locs:
[codex:82] start=max(0,loc-20)
[codex:82] seg=[(i,n,imm) for (i,n,imm) in out if start<=i<=loc+5]
[codex:82] print('\\nAround SELFDESTRUCT at',hex(loc))
[codex:82] for i,n,imm in seg:
[codex:82] if imm:
[codex:82] print(hex(i), n, imm)
[codex:82] else:
[codex:82] print(hex(i), n)
[codex:82]
[codex:82] # show disassembly around DELEGATECALL
[codex:82] for loc in [i for i,n,_ in out if n=='DELEGATECALL']:
[codex:82] start=max(0,loc-20)
[codex:82] seg=[(i,n,imm) for (i,n,imm) in out if start<=i<=loc+5]
[codex:82] print('\\nAround DELEGATECALL at',hex(loc))
[codex:82] for i,n,imm in seg:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82]
[codex:82] # show disassembly around CALL with value by scanning preceding push? We'll print surrounding for each CALL.
[codex:82] for loc in [i for i,n,_ in out if n=='CALL']:
[codex:82] start=max(0,loc-15)
[codex:82] seg=[(i,n,imm) for (i,n,imm) in out if start<=i<=loc+5]
[codex:82] print('\\nAround CALL at',hex(loc))
[codex:82] for i,n,imm in seg:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82]
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 44ms:
[codex:82] len 4014
[codex:82] CALL count 2 locs ['0x8ea', '0xb02']
[codex:82] SELFDESTRUCT count 1 locs ['0x827']
[codex:82] STATICCALL count 1 locs ['0xf93']
[codex:82]
[codex:82] Around SELFDESTRUCT at 0x827
[codex:82] 0x814 SSTORE
[codex:82] 0x815 POP
[codex:82] 0x816 JUMP
[codex:82] 0x817 JUMPDEST
[codex:82] 0x818 ISZERO
[codex:82] 0x819 PUSH2 062b
[codex:82] 0x81c JUMPI
[codex:82] 0x81d DUP2
[codex:82] 0x81e PUSH1 01
[codex:82] 0x820 PUSH1 a0
[codex:82] 0x822 PUSH1 02
[codex:82] 0x824 EXP
[codex:82] 0x825 SUB
[codex:82] 0x826 AND
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing contract calls and selfdestruct**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:82] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] # disassemble into list
[codex:82] out=[]
[codex:82] i=0
[codex:82] while i<len(data):
[codex:82] op=data[i]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[i+1:i+1+n]
[codex:82] out.append((i, opnames.get(op), imm.hex()))
[codex:82] i+=1+n
[codex:82] else:
[codex:82] out.append((i, opnames.get(op), ''))
[codex:82] i+=1
[codex:82]
[codex:82] # print segment
[codex:82] start=0x780; end=0x860
[codex:82] for i,n,imm in out:
[codex:82] if start<=i<=end:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 26ms:
[codex:82] 0x780 DUP3
[codex:82] 0x781 GT
[codex:82] 0x782 ISZERO
[codex:82] 0x783 PUSH2 078c
[codex:82] 0x786 JUMPI
[codex:82] 0x787 POP
[codex:82] 0x788 PUSH2 062d
[codex:82] 0x78b JUMP
[codex:82] 0x78c JUMPDEST
[codex:82] 0x78d PUSH1 00
[codex:82] 0x78f DUP3
[codex:82] 0x790 SWAP1
[codex:82] 0x791 SSTORE
[codex:82] 0x792 PUSH2 0799
[codex:82] 0x795 PUSH2 0517
[codex:82] 0x798 JUMP
[codex:82] 0x799 JUMPDEST
[codex:82] 0x79a PUSH1 40
[codex:82] 0x79c DUP1
[codex:82] 0x79d MLOAD
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing selfdestruct authorization checks**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82] opnames={
[codex:82] 0x33:'CALLER',0x32:'ORIGIN'
[codex:82] }
[codex:82] # disassemble with indices for CALLER/ORIGIN
[codex:82] idx=0
[codex:82] outs=[]
[codex:82] while idx<len(data):
[codex:82] op=data[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] idx+=1+n
[codex:82] else:
[codex:82] if op in (0x33,0x32):
[codex:82] outs.append((idx, opnames[op]))
[codex:82] idx+=1
[codex:82]
[codex:82] print('CALLER/ORIGIN locations:')
[codex:82] for i,name in outs:
[codex:82] print(hex(i), name)
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 24ms:
[codex:82] CALLER/ORIGIN locations:
[codex:82] 0xdd ORIGIN
[codex:82] 0x151 ORIGIN
[codex:82] 0x280 ORIGIN
[codex:82] 0x294 ORIGIN
[codex:82] 0x40e ORIGIN
[codex:82] 0x837 ORIGIN
[codex:82] 0x863 ORIGIN
[codex:82] 0x9e3 ORIGIN
[codex:82] 0xb2a ORIGIN
[codex:82] 0xcd9 ORIGIN
[codex:82] 0xf9d ORIGIN
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing ORIGIN-based authorization**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] opnames = {
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:82] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] # disassemble list
[codex:82] out=[]
[codex:82] i=0
[codex:82] while i<len(data):
[codex:82] op=data[i]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[i+1:i+1+n]
[codex:82] out.append((i, opnames.get(op), imm.hex()))
[codex:82] i+=1+n
[codex:82] else:
[codex:82] out.append((i, opnames.get(op), ''))
[codex:82] i+=1
[codex:82]
[codex:82] start=0x820; end=0x900
[codex:82] for i,n,imm in out:
[codex:82] if start<=i<=end:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 26ms:
[codex:82] 0x820 PUSH1 a0
[codex:82] 0x822 PUSH1 02
[codex:82] 0x824 EXP
[codex:82] 0x825 SUB
[codex:82] 0x826 AND
[codex:82] 0x827 SELFDESTRUCT
[codex:82] 0x828 JUMPDEST
[codex:82] 0x829 ISZERO
[codex:82] 0x82a PUSH2 0a44
[codex:82] 0x82d JUMPI
[codex:82] 0x82e PUSH2 083c
[codex:82] 0x831 DUP5
[codex:82] 0x832 PUSH1 00
[codex:82] 0x834 PUSH2 0e68
[codex:82] 0x837 ORIGIN
[codex:82] 0x838 PUSH2 0178
[codex:82] 0x83b JUMP
[codex:82] 0x83c JUMPDEST
[codex:82] 0x83d ISZERO
[codex:82] 0x83e PUSH2 08f8
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing complex contract call structure**
[codex:82]
[codex:82] I'm working through a dense function that looks like a contract proxy or multisig wallet, with low-level CALLs, calldata assembly, and authorization checks using tx.origin and ecrecover. I’m trying to trace how CALL arguments are built and whether there’s an exploitable path allowing unauthorized ETH or token transfers, but it’s tricky without full stack simulation—so I’m focusing on the critical call opcode sections and signature verification patterns to see if an attacker could misuse them.
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82] # disassemble list
[codex:82] out=[]
[codex:82] i=0
[codex:82] while i<len(data):
[codex:82] op=data[i]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[i+1:i+1+n]
[codex:82] out.append((i, opnames.get(op), imm.hex()))
[codex:82] i+=1+n
[codex:82] else:
[codex:82] out.append((i, opnames.get(op), ''))
[codex:82] i+=1
[codex:82]
[codex:82] start=0xf40; end=0xfc0
[codex:82] for i,n,imm in out:
[codex:82] if start<=i<=end:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 27ms:
[codex:82] 0xf40 DUP2
[codex:82] 0xf41 SHA3
[codex:82] 0xf42 DUP2
[codex:82] 0xf43 DUP2
[codex:82] 0xf44 SSTORE
[codex:82] 0xf45 PUSH1 01
[codex:82] 0xf47 DUP2
[codex:82] 0xf48 ADD
[codex:82] 0xf49 DUP3
[codex:82] 0xf4a SWAP1
[codex:82] 0xf4b SSTORE
[codex:82] 0xf4c PUSH1 02
[codex:82] 0xf4e ADD
[codex:82] 0xf4f SSTORE
[codex:82] 0xf50 JUMPDEST
[codex:82] 0xf51 PUSH1 01
[codex:82] 0xf53 ADD
[codex:82] 0xf54 PUSH2 0edd
[codex:82] 0xf57 JUMP
[codex:82] 0xf58 JUMPDEST
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing bytecode dispatch and data boundaries**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] # parse for PUSH4 <selector> ... PUSH2 <dest> JUMPI patterns in first 0x200 bytes
[codex:82] ops=[]
[codex:82] # disassemble with positions
[codex:82] opnames={
[codex:82] 0x14:'EQ',0x57:'JUMPI',0x63:'PUSH4',0x61:'PUSH2',0x5b:'JUMPDEST'
[codex:82] }
[codex:82]
[codex:82] # Basic parse to list opcodes and immediates
[codex:82] ops=[]
[codex:82] i=0
[codex:82] while i<len(data):
[codex:82] op=data[i]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[i+1:i+1+n]
[codex:82] ops.append((i,op,imm))
[codex:82] i+=1+n
[codex:82] else:
[codex:82] ops.append((i,op,b''))
[codex:82] i+=1
[codex:82]
[codex:82] # search for pattern PUSH4 sel ... PUSH2 dest JUMPI
[codex:82] pairs=[]
[codex:82] for idx,(pos,op,imm) in enumerate(ops):
[codex:82] if op==0x63: # PUSH4
[codex:82] sel=imm.hex()
[codex:82] # search forward for PUSH2 then JUMPI before next PUSH4 maybe within 10 ops
[codex:82] for j in range(idx+1, min(len(ops), idx+10)):
[codex:82] if ops[j][1]==0x61 and ops[j+1][1]==0x57:
[codex:82] dest=ops[j][2].hex()
[codex:82] pairs.append((pos,sel,int(dest,16),ops[j+1][0]))
[codex:82] break
[codex:82]
[codex:82] print('selectors found', len(pairs))
[codex:82] for pos,sel,dest,jpos in pairs:
[codex:82] print(hex(pos), sel, '->', hex(dest))
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 29ms:
[codex:82] selectors found 16
[codex:82] 0x14 173825d9 -> 0x116
[codex:82] 0x20 2f54bf6e -> 0x171
[codex:82] 0x2b 4123cb6b -> 0x199
[codex:82] 0x36 54fd4d50 -> 0x1a2
[codex:82] 0x41 5c52c2f5 -> 0x1af
[codex:82] 0x4c 7065cb48 -> 0x1e0
[codex:82] 0x57 746c9171 -> 0x214
[codex:82] 0x62 797af627 -> 0x21d
[codex:82] 0x6d b20d30a9 -> 0x230
[codex:82] 0x78 b61d27f6 -> 0x264
[codex:82] 0x83 b75c7dc6 -> 0x285
[codex:82] 0x8e ba51a6df -> 0x2b4
[codex:82] 0x99 c2cf7326 -> 0x2e8
[codex:82] 0xa4 cbf0b0c0 -> 0x326
[codex:82] 0xaf f00d4b5d -> 0x35a
[codex:82] 0xba f1736d86 -> 0x393
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing function entry points**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:82] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] # disassemble list
[codex:82] out=[]
[codex:82] i=0
[codex:82] while i<len(data):
[codex:82] op=data[i]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[i+1:i+1+n]
[codex:82] out.append((i, opnames.get(op), imm.hex()))
[codex:82] i+=1+n
[codex:82] else:
[codex:82] out.append((i, opnames.get(op), ''))
[codex:82] i+=1
[codex:82]
[codex:82] entries=[0x116,0x171,0x199,0x1a2,0x1af,0x1e0,0x214,0x21d,0x230,0x264,0x285,0x2b4,0x2e8,0x326,0x35a,0x393]
[codex:82]
[codex:82] for e in entries:
[codex:82] print('\\nEntry',hex(e))
[codex:82] for i,n,imm in out:
[codex:82] if e<=i<e+60:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 32ms:
[codex:82]
[codex:82] Entry 0x116
[codex:82] 0x116 JUMPDEST
[codex:82] 0x117 PUSH2 039d
[codex:82] 0x11a PUSH1 04
[codex:82] 0x11c CALLDATALOAD
[codex:82] 0x11d PUSH1 00
[codex:82] 0x11f PUSH1 00
[codex:82] 0x121 CALLDATASIZE
[codex:82] 0x122 NUMBER
[codex:82] 0x123 PUSH1 40
[codex:82] 0x125 MLOAD
[codex:82] 0x126 DUP1
[codex:82] 0x127 DUP5
[codex:82] 0x128 DUP5
[codex:82] 0x129 DUP1
[codex:82] 0x12a DUP3
[codex:82] 0x12b DUP5
[codex:82] 0x12c CALLDATACOPY
[codex:82] 0x12d POP
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing internal function at 0x0148**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:82] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] out=[]
[codex:82] # disassemble list
[codex:82] idx=0
[codex:82] while idx<len(data):
[codex:82] op=data[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[idx+1:idx+1+n]
[codex:82] out.append((idx, opnames.get(op), imm.hex()))
[codex:82] idx+=1+n
[codex:82] else:
[codex:82] out.append((idx, opnames.get(op), ''))
[codex:82] idx+=1
[codex:82]
[codex:82] start=0x140; end=0x1a0
[codex:82] for i,n,imm in out:
[codex:82] if start<=i<=end:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 26ms:
[codex:82] 0x140 SWAP1
[codex:82] 0x141 SHA3
[codex:82] 0x142 SWAP1
[codex:82] 0x143 POP
[codex:82] 0x144 PUSH2 06b8
[codex:82] 0x147 DUP2
[codex:82] 0x148 JUMPDEST
[codex:82] 0x149 PUSH1 01
[codex:82] 0x14b PUSH1 a0
[codex:82] 0x14d PUSH1 02
[codex:82] 0x14f EXP
[codex:82] 0x150 SUB
[codex:82] 0x151 ORIGIN
[codex:82] 0x152 AND
[codex:82] 0x153 PUSH1 00
[codex:82] 0x155 SWAP1
[codex:82] 0x156 DUP2
[codex:82] 0x157 MSTORE
[codex:82] 0x158 PUSH2 0102
[codex:82] 0x15b PUSH1 20
[codex:82]
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing bytecode authorization checks**
[codex:82] thinking
[codex:82] **Tracing stack and call parameters symbolically**
[codex:82]
[codex:82] I’m working through the symbolic stack to figure out how the CALL value and address are passed, especially for the critical call around 0x8ea. By simulating stack changes and tracing parameter order, I want to confirm which arguments reach the internal auth check and how ORIGIN and constants are used in calls. This will help clarify if any exploitable gaps exist in value handling or authorization logic.
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:82] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] out=[]
[codex:82] idx=0
[codex:82] while idx<len(data):
[codex:82] op=data[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[idx+1:idx+1+n]
[codex:82] out.append((idx, opnames.get(op), imm.hex()))
[codex:82] idx+=1+n
[codex:82] else:
[codex:82] out.append((idx, opnames.get(op), ''))
[codex:82] idx+=1
[codex:82]
[codex:82] start=0x260; end=0x286
[codex:82] for i,n,imm in out:
[codex:82] if start<=i<=end:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 26ms:
[codex:82] 0x260 PUSH2 0148
[codex:82] 0x263 JUMP
[codex:82] 0x264 JUMPDEST
[codex:82] 0x265 PUSH2 039f
[codex:82] 0x268 PUSH1 04
[codex:82] 0x26a DUP1
[codex:82] 0x26b CALLDATALOAD
[codex:82] 0x26c SWAP1
[codex:82] 0x26d PUSH1 24
[codex:82] 0x26f DUP1
[codex:82] 0x270 CALLDATALOAD
[codex:82] 0x271 SWAP2
[codex:82] 0x272 PUSH1 44
[codex:82] 0x274 CALLDATALOAD
[codex:82] 0x275 SWAP2
[codex:82] 0x276 DUP3
[codex:82] 0x277 ADD
[codex:82] 0x278 SWAP2
[codex:82] 0x279 ADD
[codex:82] 0x27a CALLDATALOAD
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing stack behavior post-calldata load**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] from collections import deque
[codex:82]
[codex:82] def simulate():
[codex:82] stack=[]
[codex:82] def push(x): stack.append(x)
[codex:82] def pop(): return stack.pop()
[codex:82] # instructions from 0x264 to 0x27b
[codex:82] # 0x264 JUMPDEST
[codex:82] push('ret') # PUSH2 039f
[codex:82] # PUSH1 04, DUP1, CALLDATALOAD
[codex:82] push(4); push(stack[-1]); # DUP1 of 4
[codex:82] # CALLDATALOAD pops offset
[codex:82] offset=pop(); push(f'calldata[{offset}]')
[codex:82] # SWAP1
[codex:82] stack[-1], stack[-2] = stack[-2], stack[-1]
[codex:82] # PUSH1 24 DUP1 CALLDATALOAD
[codex:82] push(0x24); push(stack[-1]); offset=pop(); push(f'calldata[{offset}]')
[codex:82] # SWAP2
[codex:82] stack[-1], stack[-3] = stack[-3], stack[-1]
[codex:82] # PUSH1 44 CALLDATALOAD
[codex:82] push(0x44); offset=pop(); push(f'calldata[{offset}]')
[codex:82] # SWAP2
[codex:82] stack[-1], stack[-3] = stack[-3], stack[-1]
[codex:82] # DUP3
[codex:82] push(stack[-3])
[codex:82] # ADD
[codex:82] a=pop(); b=pop(); push(f'({a}+{b})')
[codex:82] # SWAP2
[codex:82] stack[-1], stack[-3] = stack[-3], stack[-1]
[codex:82] # ADD
[codex:82] a=pop(); b=pop(); push(f'({a}+{b})')
[codex:82] # CALLDATALOAD
[codex:82] offset=pop(); push(f'calldata[{offset}]')
[codex:82] # PUSH1 00
[codex:82] push(0)
[codex:82] # PUSH2 0828
[codex:82] push('ret0828')
[codex:82] # ORIGIN
[codex:82] push('origin')
[codex:82] # PUSH2 0178
[codex:82] push('jmp0178')
[codex:82] # before JUMP, stack
[codex:82] print('stack before JUMP to 0x0178:')
[codex:82] print(stack)
[codex:82]
[codex:82] simulate()
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 19ms:
[codex:82] stack before JUMP to 0x0178:
[codex:82] ['ret', 'calldata[4]', 'calldata[36]', '(calldata[68]+36)', 'calldata[(calldata[68]+4)]', 0, 'ret0828', 'origin', 'jmp0178']
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing stack behavior at jump target**
[codex:82]
[codex:82] I'm verifying the stack contents and offsets around the jump at 0x0178 by simulating opcode effects like DUP1, CALLDATALOAD, and SWAP1. The stack order seems suspicious around the DUP2 at 0x0178, so I'll create a more precise simulator to step through opcodes from 0x264 to 0x284 to ensure correct symbolic stack manipulation and verify if the stack reflects intended values or parameters.
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] # get bytecode slice from 0x264 to 0x284 inclusive
[codex:82] start=0x264; end=0x284
[codex:82] code=data[start:end+1]
[codex:82]
[codex:82] # disassemble with position
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xf1:'CALL',0xf3:'RETURN',0xfa:'STATICCALL',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] # disassemble
[codex:82] ops=[]
[codex:82] idx=0
[codex:82] pos=start
[codex:82] while idx<len(code):
[codex:82] op=code[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=code[idx+1:idx+1+n]
[codex:82] ops.append((pos,op,imm))
[codex:82] idx+=1+n; pos+=1+n
[codex:82] else:
[codex:82] ops.append((pos,op,b''))
[codex:82] idx+=1; pos+=1
[codex:82]
[codex:82] # symbolic execution
[codex:82] stack=[]
[codex:82] # initial stack before entry? function dispatch pushes ret address 0x039f. We'll include it.
[codex:82] stack.append('ret_039f')
[codex:82]
[codex:82] for pos,op,imm in ops:
[codex:82] name=opnames.get(op, hex(op))
[codex:82] if 0x60<=op<=0x7f:
[codex:82] val=int.from_bytes(imm,'big')
[codex:82] stack.append(f'{name}:{val}')
[codex:82] elif 0x80<=op<=0x8f:
[codex:82] n=op-0x7f
[codex:82] stack.append(stack[-n])
[codex:82] elif 0x90<=op<=0x9f:
[codex:82] n=op-0x8f
[codex:82] # swap nth item with top
[codex:82] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:82] elif op==0x35: # CALLDATALOAD
[codex:82] off=stack.pop()
[codex:82] stack.append(f'calldata[{off}]')
[codex:82] elif op==0x01: # ADD
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({a}+{b})')
[codex:82] elif op==0x03: # SUB
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}-{a})')
[codex:82] elif op==0x0a: # EXP
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}**{a})')
[codex:82] elif op==0x16: # AND
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}&{a})')
[codex:82] elif op==0x50: # POP
[codex:82] stack.pop()
[codex:82] elif op==0x56: # JUMP
[codex:82] print('JUMP at',hex(pos),'stack',stack)
[codex:82] else:
[codex:82] # ignore other ops for this region
[codex:82] pass
[codex:82]
[codex:82] print('Final stack before JUMP:', stack)
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 24ms:
[codex:82] JUMP at 0x284 stack ['ret_039f', 'PUSH2:927', 'calldata[PUSH1:4]', 'calldata[PUSH1:36]', '(calldata[PUSH1:68]+PUSH1:36)', 'calldata[(calldata[PUSH1:68]+PUSH1:4)]', 'PUSH1:0', 'PUSH2:2088', 'PUSH2:376']
[codex:82] Final stack before JUMP: ['ret_039f', 'PUSH2:927', 'calldata[PUSH1:4]', 'calldata[PUSH1:36]', '(calldata[PUSH1:68]+PUSH1:36)', 'calldata[(calldata[PUSH1:68]+PUSH1:4)]', 'PUSH1:0', 'PUSH2:2088', 'PUSH2:376']
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing missing ORIGIN handling**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] start=0x264; end=0x284
[codex:82] code=data[start:end+1]
[codex:82]
[codex:82] opnames={
[codex:82] 0x32:'ORIGIN',0x35:'CALLDATALOAD',0x56:'JUMP',0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x01:'ADD',0x03:'SUB',0x0a:'EXP',0x16:'AND',0x50:'POP'
[codex:82] }
[codex:82]
[codex:82] # disassemble
[codex:82] ops=[]
[codex:82] idx=0
[codex:82] pos=start
[codex:82] while idx<len(code):
[codex:82] op=code[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=code[idx+1:idx+1+n]
[codex:82] ops.append((pos,op,imm))
[codex:82] idx+=1+n; pos+=1+n
[codex:82] else:
[codex:82] ops.append((pos,op,b''))
[codex:82] idx+=1; pos+=1
[codex:82]
[codex:82] # symbolic execution
[codex:82] stack=['ret_039f']
[codex:82]
[codex:82] for pos,op,imm in ops:
[codex:82] if 0x60<=op<=0x7f:
[codex:82] val=int.from_bytes(imm,'big')
[codex:82] stack.append(f'{hex(val)}')
[codex:82] elif 0x80<=op<=0x8f:
[codex:82] n=op-0x7f
[codex:82] stack.append(stack[-n])
[codex:82] elif 0x90<=op<=0x9f:
[codex:82] n=op-0x8f
[codex:82] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:82] elif op==0x35:
[codex:82] off=stack.pop(); stack.append(f'calldata[{off}]')
[codex:82] elif op==0x32:
[codex:82] stack.append('origin')
[codex:82] elif op==0x01:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}+{a})')
[codex:82] elif op==0x03:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}-{a})')
[codex:82] elif op==0x0a:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}**{a})')
[codex:82] elif op==0x16:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}&{a})')
[codex:82] elif op==0x50:
[codex:82] stack.pop()
[codex:82] elif op==0x56:
[codex:82] print('JUMP at',hex(pos),'stack',stack)
[codex:82] else:
[codex:82] pass
[codex:82]
[codex:82] print('Final stack before JUMP:', stack)
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 25ms:
[codex:82] JUMP at 0x284 stack ['ret_039f', '0x39f', 'calldata[0x4]', 'calldata[0x24]', '(0x24+calldata[0x44])', 'calldata[(0x4+calldata[0x44])]', '0x0', '0x828', 'origin', '0x178']
[codex:82] Final stack before JUMP: ['ret_039f', '0x39f', 'calldata[0x4]', 'calldata[0x24]', '(0x24+calldata[0x44])', 'calldata[(0x4+calldata[0x44])]', '0x0', '0x828', 'origin', '0x178']
[codex:82]
[codex:82] thinking
[codex:82] **Reevaluating stack initialization**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] start=0x264; end=0x284
[codex:82] code=data[start:end+1]
[codex:82]
[codex:82] # disassemble
[codex:82] ops=[]
[codex:82] idx=0
[codex:82] pos=start
[codex:82] while idx<len(code):
[codex:82] op=code[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=code[idx+1:idx+1+n]
[codex:82] ops.append((pos,op,imm))
[codex:82] idx+=1+n; pos+=1+n
[codex:82] else:
[codex:82] ops.append((pos,op,b''))
[codex:82] idx+=1; pos+=1
[codex:82]
[codex:82] stack=[]
[codex:82]
[codex:82] def push(x): stack.append(x)
[codex:82]
[codex:82] def pop(): return stack.pop()
[codex:82]
[codex:82] for pos,op,imm in ops:
[codex:82] if 0x60<=op<=0x7f:
[codex:82] push(hex(int.from_bytes(imm,'big')))
[codex:82] elif 0x80<=op<=0x8f:
[codex:82] n=op-0x7f
[codex:82] push(stack[-n])
[codex:82] elif 0x90<=op<=0x9f:
[codex:82] n=op-0x8f
[codex:82] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:82] elif op==0x35:
[codex:82] off=pop(); push(f'calldata[{off}]')
[codex:82] elif op==0x32:
[codex:82] push('origin')
[codex:82] elif op==0x01:
[codex:82] a=pop(); b=pop(); push(f'({b}+{a})')
[codex:82] elif op==0x03:
[codex:82] a=pop(); b=pop(); push(f'({b}-{a})')
[codex:82] elif op==0x0a:
[codex:82] a=pop(); b=pop(); push(f'({b}**{a})')
[codex:82] elif op==0x16:
[codex:82] a=pop(); b=pop(); push(f'({b}&{a})')
[codex:82] elif op==0x50:
[codex:82] pop()
[codex:82] elif op==0x56:
[codex:82] print('JUMP at',hex(pos),'stack',stack)
[codex:82]
[codex:82] print('Final stack before JUMP:', stack)
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 24ms:
[codex:82] JUMP at 0x284 stack ['0x39f', 'calldata[0x4]', 'calldata[0x24]', '(0x24+calldata[0x44])', 'calldata[(0x4+calldata[0x44])]', '0x0', '0x828', 'origin', '0x178']
[codex:82] Final stack before JUMP: ['0x39f', 'calldata[0x4]', 'calldata[0x24]', '(0x24+calldata[0x44])', 'calldata[(0x4+calldata[0x44])]', '0x0', '0x828', 'origin', '0x178']
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing stack and call pattern**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] # simulate subroutine at 0x0178
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] start=0x178; end=0x198
[codex:82] code=data[start:end+1]
[codex:82]
[codex:82] # disassemble
[codex:82] ops=[]
[codex:82] idx=0
[codex:82] pos=start
[codex:82] while idx<len(code):
[codex:82] op=code[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=code[idx+1:idx+1+n]
[codex:82] ops.append((pos,op,imm))
[codex:82] idx+=1+n; pos+=1+n
[codex:82] else:
[codex:82] ops.append((pos,op,b''))
[codex:82] idx+=1; pos+=1
[codex:82]
[codex:82] # initial stack: let's assume 4 items bottom->top: s0,s1,s2,s3 (s3 top)
[codex:82] stack=['s0','s1','s2','s3']
[codex:82]
[codex:82] # helper operations
[codex:82]
[codex:82] def push(x): stack.append(x)
[codex:82]
[codex:82] def pop(): return stack.pop()
[codex:82]
[codex:82] for pos,op,imm in ops:
[codex:82] if 0x60<=op<=0x7f:
[codex:82] push(f'const_{int.from_bytes(imm,\"big\")}')
[codex:82] elif 0x80<=op<=0x8f:
[codex:82] n=op-0x7f
[codex:82] push(stack[-n])
[codex:82] elif 0x90<=op<=0x9f:
[codex:82] n=op-0x8f
[codex:82] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:82] elif op==0x35:
[codex:82] off=pop(); push(f'calldata[{off}]')
[codex:82] elif op==0x01:
[codex:82] a=pop(); b=pop(); push(f'({b}+{a})')
[codex:82] elif op==0x03:
[codex:82] a=pop(); b=pop(); push(f'({b}-{a})')
[codex:82] elif op==0x0a:
[codex:82] a=pop(); b=pop(); push(f'({b}**{a})')
[codex:82] elif op==0x16:
[codex:82] a=pop(); b=pop(); push(f'({b}&{a})')
[codex:82] elif op==0x20:
[codex:82] a=pop(); b=pop(); push(f'sha3({b},{a})')
[codex:82] elif op==0x54:
[codex:82] a=pop(); push(f'sload({a})')
[codex:82] elif op==0x11: # GT
[codex:82] a=pop(); b=pop(); push(f'({b}>{a})')
[codex:82] elif op==0x50:
[codex:82] pop()
[codex:82] elif op==0x52:
[codex:82] pop(); pop() # MSTORE pops 2
[codex:82] elif op==0x15: # ISZERO
[codex:82] a=pop(); push(f'"'!{a}'"')
[codex:82] elif op==0x57:
[codex:82] dest=pop(); cond=pop();
[codex:82] # ignore jump
[codex:82] elif op==0x56:
[codex:82] dest=pop();
[codex:82] else:
[codex:82] pass
[codex:82]
[codex:82] print('Final stack at end of 0x0178 block:')
[codex:82] print(stack)
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 26ms:
[codex:82] Final stack at end of 0x0178 block:
[codex:82] ['s0', 's1', '(const_0>sload(sha3(const_64,const_0)))']
[codex:82]
[codex:82] thinking
[codex:82] **Verifying opcode sequence inclusion**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] start=0x178; end=0x198
[codex:82] code=data[start:end+1]
[codex:82]
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',0x20:'SHA3',0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] ops=[]
[codex:82] idx=0
[codex:82] pos=start
[codex:82] while idx<len(code):
[codex:82] op=code[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=code[idx+1:idx+1+n]
[codex:82] ops.append((pos,op,imm))
[codex:82] idx+=1+n; pos+=1+n
[codex:82] else:
[codex:82] ops.append((pos,op,b''))
[codex:82] idx+=1; pos+=1
[codex:82]
[codex:82] stack=['s0','s1','s2','s3']
[codex:82]
[codex:82] for pos,op,imm in ops:
[codex:82] name=opnames.get(op,hex(op))
[codex:82] if 0x60<=op<=0x7f:
[codex:82] stack.append(f'const_{int.from_bytes(imm,\"big\")}')
[codex:82] elif 0x80<=op<=0x8f:
[codex:82] n=op-0x7f
[codex:82] stack.append(stack[-n])
[codex:82] elif 0x90<=op<=0x9f:
[codex:82] n=op-0x8f
[codex:82] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:82] elif op==0x35:
[codex:82] off=stack.pop(); stack.append(f'calldata[{off}]')
[codex:82] elif op==0x01:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}+{a})')
[codex:82] elif op==0x03:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}-{a})')
[codex:82] elif op==0x0a:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}**{a})')
[codex:82] elif op==0x16:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}&{a})')
[codex:82] elif op==0x20:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'sha3({b},{a})')
[codex:82] elif op==0x54:
[codex:82] a=stack.pop(); stack.append(f'sload({a})')
[codex:82] elif op==0x11:
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}>{a})')
[codex:82] elif op==0x50:
[codex:82] stack.pop()
[codex:82] elif op==0x52:
[codex:82] stack.pop(); stack.pop()
[codex:82] elif op==0x15:
[codex:82] a=stack.pop(); stack.append(f'"'!{a}'"')
[codex:82] elif op==0x57:
[codex:82] dest=stack.pop(); cond=stack.pop()
[codex:82] elif op==0x56:
[codex:82] dest=stack.pop()
[codex:82] else:
[codex:82] pass
[codex:82] print(hex(pos), name, '=>', stack)
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 27ms:
[codex:82] 0x178 JUMPDEST => ['s0', 's1', 's2', 's3']
[codex:82] 0x179 PUSH1 => ['s0', 's1', 's2', 's3', 'const_1']
[codex:82] 0x17b PUSH1 => ['s0', 's1', 's2', 's3', 'const_1', 'const_160']
[codex:82] 0x17d PUSH1 => ['s0', 's1', 's2', 's3', 'const_1', 'const_160', 'const_2']
[codex:82] 0x17f EXP => ['s0', 's1', 's2', 's3', 'const_1', '(const_160**const_2)']
[codex:82] 0x180 SUB => ['s0', 's1', 's2', 's3', '(const_1-(const_160**const_2))']
[codex:82] 0x181 DUP2 => ['s0', 's1', 's2', 's3', '(const_1-(const_160**const_2))', 's3']
[codex:82] 0x182 AND => ['s0', 's1', 's2', 's3', '((const_1-(const_160**const_2))&s3)']
[codex:82] 0x183 PUSH1 => ['s0', 's1', 's2', 's3', '((const_1-(const_160**const_2))&s3)', 'const_0']
[codex:82] 0x185 SWAP1 => ['s0', 's1', 's2', 's3', 'const_0', '((const_1-(const_160**const_2))&s3)']
[codex:82] 0x186 DUP2 => ['s0', 's1', 's2', 's3', 'const_0', '((const_1-(const_160**const_2))&s3)', 'const_0']
[codex:82] 0x187 MSTORE => ['s0', 's1', 's2', 's3', 'const_0']
[codex:82] 0x188 PUSH2 => ['s0', 's1', 's2', 's3', 'const_0', 'const_258']
[codex:82] 0x18b PUSH1 => ['s0', 's1', 's2', 's3', 'const_0', 'const_258', 'const_32']
[codex:82] 0x18d MSTORE => ['s0', 's1', 's2', 's3', 'const_0']
[codex:82] 0x18e PUSH1 => ['s0', 's1', 's2', 's3', 'const_0', 'const_64']
[codex:82] 0x190 DUP2 => ['s0', 's1', 's2', 's3', 'const_0', 'const_64', 'const_0']
[codex:82] 0x191 SHA3 => ['s0', 's1', 's2', 's3', 'const_0', 'sha3(const_64,const_0)']
[codex:82] 0x192 SLOAD => ['s0', 's1', 's2', 's3', 'const_0', 'sload(sha3(const_64,const_0))']
[codex:82] 0x193 GT => ['s0', 's1', 's2', 's3', '(const_0>sload(sha3(const_64,const_0)))']
[codex:82]
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing EVM stack and comparison logic**
[codex:82] thinking
[codex:82] **Tracing stack order to verify comparison operands**
[codex:82]
[codex:82] I’m carefully reevaluating the exact stack layout before the GT operation by simulating the instructions step-by-step, aiming to confirm the order of operands so I can understand whether the subroutine correctly checks if sload is greater than zero. This way, I'll clarify if the stack has sload and 0 in the right order for the comparison.
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] start=0x178; end=0x193
[codex:82] code=data[start:end+1]
[codex:82]
[codex:82] ops=[]
[codex:82] idx=0
[codex:82] pos=start
[codex:82] while idx<len(code):
[codex:82] op=code[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=code[idx+1:idx+1+n]
[codex:82] ops.append((pos,op,imm))
[codex:82] idx+=1+n; pos+=1+n
[codex:82] else:
[codex:82] ops.append((pos,op,b''))
[codex:82] idx+=1; pos+=1
[codex:82]
[codex:82] stack=['s0','s1','s2','s3']
[codex:82]
[codex:82] for pos,op,imm in ops:
[codex:82] if 0x60<=op<=0x7f:
[codex:82] stack.append(f'c{int.from_bytes(imm,\"big\")}')
[codex:82] elif 0x80<=op<=0x8f:
[codex:82] n=op-0x7f
[codex:82] stack.append(stack[-n])
[codex:82] elif 0x90<=op<=0x9f:
[codex:82] n=op-0x8f
[codex:82] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:82] elif op==0x0a: # EXP uses base=top, exponent=next? Actually per EVM, it pops base then exponent -> base**exp
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({a}**{b})')
[codex:82] elif op==0x03: # SUB b - a
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}-{a})')
[codex:82] elif op==0x16: # AND
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'({b}&{a})')
[codex:82] elif op==0x52: # MSTORE
[codex:82] stack.pop(); stack.pop()
[codex:82] elif op==0x20: # SHA3
[codex:82] a=stack.pop(); b=stack.pop(); stack.append(f'sha3({b},{a})')
[codex:82] elif op==0x54: # SLOAD
[codex:82] a=stack.pop(); stack.append(f'sload({a})')
[codex:82] # ignore others
[codex:82] if pos==0x192:
[codex:82] print('stack before GT (at 0x192 SLOAD done):', stack)
[codex:82]
[codex:82] print('final stack at 0x193 (before GT) should be above')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 31ms:
[codex:82] stack before GT (at 0x192 SLOAD done): ['s0', 's1', 's2', 's3', 'c0', 'sload(sha3(c64,c0))']
[codex:82] final stack at 0x193 (before GT) should be above
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing EVM stack behavior**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] # simulate subroutine with 5 initial stack items
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] start=0x178; end=0x198
[codex:82] code=data[start:end+1]
[codex:82]
[codex:82] ops=[]
[codex:82] idx=0
[codex:82] pos=start
[codex:82] while idx<len(code):
[codex:82] op=code[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=code[idx+1:idx+1+n]
[codex:82] ops.append((pos,op,imm))
[codex:82] idx+=1+n; pos+=1+n
[codex:82] else:
[codex:82] ops.append((pos,op,b''))
[codex:82] idx+=1; pos+=1
[codex:82]
[codex:82] # define EVM semantics for needed ops
[codex:82]
[codex:82] def simulate(n_items):
[codex:82] stack=[f's{i}' for i in range(n_items)] # s{n-1} top
[codex:82] def pop(): return stack.pop()
[codex:82] def push(x): stack.append(x)
[codex:82] for pos,op,imm in ops:
[codex:82] if 0x60<=op<=0x7f:
[codex:82] push(f'c{int.from_bytes(imm,\"big\")}')
[codex:82] elif 0x80<=op<=0x8f:
[codex:82] n=op-0x7f
[codex:82] push(stack[-n])
[codex:82] elif 0x90<=op<=0x9f:
[codex:82] n=op-0x8f
[codex:82] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:82] elif op==0x0a:
[codex:82] a=pop(); b=pop(); push(f'({a}**{b})')
[codex:82] elif op==0x03:
[codex:82] a=pop(); b=pop(); push(f'({b}-{a})')
[codex:82] elif op==0x16:
[codex:82] a=pop(); b=pop(); push(f'({b}&{a})')
[codex:82] elif op==0x52:
[codex:82] pop(); pop()
[codex:82] elif op==0x20:
[codex:82] a=pop(); b=pop(); push(f'sha3({b},{a})')
[codex:82] elif op==0x54:
[codex:82] a=pop(); push(f'sload({a})')
[codex:82] elif op==0x11:
[codex:82] a=pop(); b=pop(); push(f'({b}>{a})')
[codex:82] elif op==0x50:
[codex:82] pop()
[codex:82] elif op==0x56:
[codex:82] dest=pop()
[codex:82] # ignore others
[codex:82] return stack
[codex:82]
[codex:82] for n in range(3,7):
[codex:82] stack=simulate(n)
[codex:82] print('n',n,'final stack',stack)
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 25ms:
[codex:82] n 3 final stack ['s0', '(c0>sload(sha3(c64,c0)))']
[codex:82] n 4 final stack ['s0', 's1', '(c0>sload(sha3(c64,c0)))']
[codex:82] n 5 final stack ['s0', 's1', 's2', '(c0>sload(sha3(c64,c0)))']
[codex:82] n 6 final stack ['s0', 's1', 's2', 's3', '(c0>sload(sha3(c64,c0)))']
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing stack behavior and authorization checks**
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] opnames={
[codex:82] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:82] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:82] 0x20:'SHA3',
[codex:82] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:82] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:82] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:82] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:82] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:82] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:82] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:82] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:82] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:82] }
[codex:82]
[codex:82] # disassemble full
[codex:82] out=[]
[codex:82] idx=0
[codex:82] while idx<len(data):
[codex:82] op=data[idx]
[codex:82] if 0x60<=op<=0x7f:
[codex:82] n=op-0x5f
[codex:82] imm=data[idx+1:idx+1+n]
[codex:82] out.append((idx, opnames.get(op), imm.hex()))
[codex:82] idx+=1+n
[codex:82] else:
[codex:82] out.append((idx, opnames.get(op), ''))
[codex:82] idx+=1
[codex:82]
[codex:82] start=0x9c0; end=0xb40
[codex:82] for i,n,imm in out:
[codex:82] if start<=i<=end:
[codex:82] print(hex(i), n, imm if imm else '')
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 26ms:
[codex:82] 0x9c0 POP
[codex:82] 0x9c1 PUSH32 1733cbb53659d713b79580f79f3f9ff215f78a7c7aa45890f3b89fc5cddfbf32
[codex:82] 0x9e2 DUP2
[codex:82] 0x9e3 ORIGIN
[codex:82] 0x9e4 DUP7
[codex:82] 0x9e5 DUP9
[codex:82] 0x9e6 DUP8
[codex:82] 0x9e7 DUP8
[codex:82] 0x9e8 PUSH1 40
[codex:82] 0x9ea MLOAD
[codex:82] 0x9eb DUP1
[codex:82] 0x9ec DUP8
[codex:82] 0x9ed DUP2
[codex:82] 0x9ee MSTORE
[codex:82] 0x9ef PUSH1 20
[codex:82] 0x9f1 ADD
[codex:82] 0x9f2 DUP7
[codex:82] 0x9f3 PUSH1 01
[codex:82] 0x9f5 PUSH1 a0
[codex:82] 0x9f7 PUSH1 02
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing access control and storage modifications**
[codex:82]
[codex:82] I'm examining if any function modifies critical storage slots like owners or thresholds without proper authorization, focusing on calls to internal auth at 0x0148 and verifying whether owner checks guard sensitive operations to rule out concrete exploits.
[codex:82] exec
[codex:82] /bin/bash -lc "python3 - <<'PY'
[codex:82] import re
[codex:82] hexstr=open('/tmp/codex-multi-4h2xq5fv/BYTECODE_BUNDLE.txt').read().split('0x',1)[1].split('\\n',1)[0].strip()
[codex:82] hexstr=re.sub(r'["'^0-9a-fA-F]'"','',hexstr)
[codex:82] data=bytes.fromhex(hexstr)
[codex:82]
[codex:82] # find sequences push2 0x0148 then JUMP
[codex:82] # We'll disassemble quickly to list addresses of push2 0x0148 and preceding few bytes
[codex:82] locations=[]
[codex:82] for i in range(len(data)-2):
[codex:82] if data[i]==0x61 and data[i+1]==0x01 and data[i+2]==0x48:
[codex:82] locations.append(i)
[codex:82]
[codex:82] print('push2 0x0148 at', [hex(i) for i in locations])
[codex:82]
[codex:82] # print 6 bytes before each location
[codex:82] for loc in locations:
[codex:82] start=max(0,loc-6); end=loc+3
[codex:82] print(hex(loc), data[start:end].hex())
[codex:82] PY" in /tmp/codex-multi-4h2xq5fv succeeded in 23ms:
[codex:82] push2 0x0148 at ['0x1dc', '0x210', '0x22c', '0x260', '0x2e4', '0x356', '0x38f']
[codex:82] 0x1dc 905061080981610148
[codex:82] 0x210 905061063081610148
[codex:82] 0x22c 0081610a6c81610148
[codex:82] 0x260 90506107fd81610148
[codex:82] 0x2e4 905061077781610148
[codex:82] 0x356 905061081781610148
[codex:82] 0x38f 90506104d181610148
[codex:82]
[codex:82] thinking
[codex:82] **Analyzing contract security and preparing report**
[codex:82]
[codex:82] I'm verifying that all critical functions are protected by owner-only checks, confirming no unprotected selfdestruct or delegatecall and no exploitable external calls without authorization. Since no exploitable paths appear, I'll prepare a JSON report stating no findings with a clear summary of this assessment per the required schema.
[codex:82] codex
[codex:82] {"no_findings":true,"summary":"No concrete, exploitable value-extraction path found in the bytecode bundle. The only visible CALLs and SELFDESTRUCT appear to be gated by tx.origin-based owner mapping checks, so there is no direct attacker-controlled value transfer or destruction path evident from bytecode alone.","findings":[]}
[codex:82] tokens used
[codex:82] 109,666
[codex:82] {"no_findings":true,"summary":"No concrete, exploitable value-extraction path found in the bytecode bundle. The only visible CALLs and SELFDESTRUCT appear to be gated by tx.origin-based owner mapping checks, so there is no direct attacker-controlled value transfer or destruction path evident from bytecode alone.","findings":[]}
{
"codex": {
"ran_at": "2026-01-02T01:30:41.142281+00:00",
"returncode": 0
},
"summary": "No concrete, exploitable value-extraction path found in the bytecode bundle. The only visible CALLs and SELFDESTRUCT appear to be gated by tx.origin-based owner mapping checks, so there is no direct attacker-controlled value transfer or destruction path evident from bytecode alone.",
"raw_final": {
"summary": "No concrete, exploitable value-extraction path found in the bytecode bundle. The only visible CALLs and SELFDESTRUCT appear to be gated by tx.origin-based owner mapping checks, so there is no direct attacker-controlled value transfer or destruction path evident from bytecode alone.",
"findings": [],
"no_findings": true
},
"no_findings": true,
"schema_version": 1
}
00000000: PUSH1 0x60 00000002: PUSH1 0x40 00000004: MSTORE 00000005: CALLDATASIZE 00000006: ISZERO 00000007: PUSH2 0x00c4 0000000a: JUMPI 0000000b: PUSH1 0xe0 0000000d: PUSH1 0x02 0000000f: EXP 00000010: PUSH1 0x00 00000012: CALLDATALOAD 00000013: DIV 00000014: PUSH4 0x173825d9 00000019: DUP2 0000001a: EQ 0000001b: PUSH2 0x0116 0000001e: JUMPI 0000001f: DUP1 00000020: PUSH4 0x2f54bf6e 00000025: EQ 00000026: PUSH2 0x0171 00000029: JUMPI 0000002a: DUP1 0000002b: PUSH4 0x4123cb6b 00000030: EQ 00000031: PUSH2 0x0199 00000034: JUMPI 00000035: DUP1 00000036: PUSH4 0x54fd4d50 0000003b: EQ 0000003c: PUSH2 0x01a2 0000003f: JUMPI 00000040: DUP1 00000041: PUSH4 0x5c52c2f5 00000046: EQ 00000047: PUSH2 0x01af 0000004a: JUMPI 0000004b: DUP1 0000004c: PUSH4 0x7065cb48 00000051: EQ 00000052: PUSH2 0x01e0 00000055: JUMPI 00000056: DUP1 00000057: PUSH4 0x746c9171 0000005c: EQ 0000005d: PUSH2 0x0214 00000060: JUMPI 00000061: DUP1 00000062: PUSH4 0x797af627 00000067: EQ 00000068: PUSH2 0x021d 0000006b: JUMPI 0000006c: DUP1 0000006d: PUSH4 0xb20d30a9 00000072: EQ 00000073: PUSH2 0x0230 00000076: JUMPI 00000077: DUP1 00000078: PUSH4 0xb61d27f6 0000007d: EQ 0000007e: PUSH2 0x0264 00000081: JUMPI 00000082: DUP1 00000083: PUSH4 0xb75c7dc6 00000088: EQ 00000089: PUSH2 0x0285 0000008c: JUMPI 0000008d: DUP1 0000008e: PUSH4 0xba51a6df 00000093: EQ 00000094: PUSH2 0x02b4 00000097: JUMPI 00000098: DUP1 00000099: PUSH4 0xc2cf7326 0000009e: EQ 0000009f: PUSH2 0x02e8 000000a2: JUMPI 000000a3: DUP1 000000a4: PUSH4 0xcbf0b0c0 000000a9: EQ 000000aa: PUSH2 0x0326 000000ad: JUMPI 000000ae: DUP1 000000af: PUSH4 0xf00d4b5d 000000b4: EQ 000000b5: PUSH2 0x035a 000000b8: JUMPI 000000b9: DUP1 000000ba: PUSH4 0xf1736d86 000000bf: EQ 000000c0: PUSH2 0x0393 000000c3: JUMPI 000000c4: JUMPDEST 000000c5: PUSH2 0x039d 000000c8: PUSH1 0x00 000000ca: CALLVALUE 000000cb: GT 000000cc: ISZERO 000000cd: PUSH2 0x0114 000000d0: JUMPI 000000d1: PUSH1 0x40 000000d3: DUP1 000000d4: MLOAD 000000d5: PUSH1 0x01 000000d7: PUSH1 0xa0 000000d9: PUSH1 0x02 000000db: EXP 000000dc: SUB 000000dd: ORIGIN 000000de: AND 000000df: DUP2 000000e0: MSTORE 000000e1: CALLVALUE 000000e2: PUSH1 0x20 000000e4: DUP3 000000e5: ADD 000000e6: MSTORE 000000e7: DUP2 000000e8: MLOAD 000000e9: PUSH32 0xe1fffcc4923d04b559f4d29a8bfc6cda04eb5b0d3c460751c2402c5c5cc9109c 0000010a: SWAP3 0000010b: SWAP2 0000010c: DUP2 0000010d: SWAP1 0000010e: SUB 0000010f: SWAP1 00000110: SWAP2 00000111: ADD 00000112: SWAP1 00000113: LOG1 00000114: JUMPDEST 00000115: JUMP 00000116: JUMPDEST 00000117: PUSH2 0x039d 0000011a: PUSH1 0x04 0000011c: CALLDATALOAD 0000011d: PUSH1 0x00 0000011f: PUSH1 0x00 00000121: CALLDATASIZE 00000122: NUMBER 00000123: PUSH1 0x40 00000125: MLOAD 00000126: DUP1 00000127: DUP5 00000128: DUP5 00000129: DUP1 0000012a: DUP3 0000012b: DUP5 0000012c: CALLDATACOPY 0000012d: POP 0000012e: POP 0000012f: POP 00000130: SWAP1 00000131: SWAP2 00000132: ADD 00000133: SWAP1 00000134: DUP2 00000135: MSTORE 00000136: PUSH1 0x40 00000138: MLOAD 00000139: SWAP1 0000013a: DUP2 0000013b: SWAP1 0000013c: SUB 0000013d: PUSH1 0x20 0000013f: ADD 00000140: SWAP1 00000141: KECCAK256 00000142: SWAP1 00000143: POP 00000144: PUSH2 0x06b8 00000147: DUP2 00000148: JUMPDEST 00000149: PUSH1 0x01 0000014b: PUSH1 0xa0 0000014d: PUSH1 0x02 0000014f: EXP 00000150: SUB 00000151: ORIGIN 00000152: AND 00000153: PUSH1 0x00 00000155: SWAP1 00000156: DUP2 00000157: MSTORE 00000158: PUSH2 0x0102 0000015b: PUSH1 0x20 0000015d: MSTORE 0000015e: PUSH1 0x40 00000160: DUP2 00000161: KECCAK256 00000162: SLOAD 00000163: DUP2 00000164: DUP1 00000165: DUP3 00000166: DUP2 00000167: EQ 00000168: ISZERO 00000169: PUSH2 0x0c2e 0000016c: JUMPI 0000016d: PUSH2 0x0d86 00000170: JUMP 00000171: JUMPDEST 00000172: PUSH2 0x039f 00000175: PUSH1 0x04 00000177: CALLDATALOAD 00000178: JUMPDEST 00000179: PUSH1 0x01 0000017b: PUSH1 0xa0 0000017d: PUSH1 0x02 0000017f: EXP 00000180: SUB 00000181: DUP2 00000182: AND 00000183: PUSH1 0x00 00000185: SWAP1 00000186: DUP2 00000187: MSTORE 00000188: PUSH2 0x0102 0000018b: PUSH1 0x20 0000018d: MSTORE 0000018e: PUSH1 0x40 00000190: DUP2 00000191: KECCAK256 00000192: SLOAD 00000193: GT 00000194: JUMPDEST 00000195: SWAP2 00000196: SWAP1 00000197: POP 00000198: JUMP 00000199: JUMPDEST 0000019a: PUSH2 0x039f 0000019d: PUSH1 0x01 0000019f: SLOAD 000001a0: DUP2 000001a1: JUMP 000001a2: JUMPDEST 000001a3: PUSH2 0x03b1 000001a6: PUSH2 0x0108 000001a9: SLOAD 000001aa: PUSH1 0xff 000001ac: AND 000001ad: DUP2 000001ae: JUMP 000001af: JUMPDEST 000001b0: PUSH2 0x039d 000001b3: PUSH1 0x00 000001b5: CALLDATASIZE 000001b6: NUMBER 000001b7: PUSH1 0x40 000001b9: MLOAD 000001ba: DUP1 000001bb: DUP5 000001bc: DUP5 000001bd: DUP1 000001be: DUP3 000001bf: DUP5 000001c0: CALLDATACOPY 000001c1: POP 000001c2: POP 000001c3: POP 000001c4: SWAP1 000001c5: SWAP2 000001c6: ADD 000001c7: SWAP1 000001c8: DUP2 000001c9: MSTORE 000001ca: PUSH1 0x40 000001cc: MLOAD 000001cd: SWAP1 000001ce: DUP2 000001cf: SWAP1 000001d0: SUB 000001d1: PUSH1 0x20 000001d3: ADD 000001d4: SWAP1 000001d5: KECCAK256 000001d6: SWAP1 000001d7: POP 000001d8: PUSH2 0x0809 000001db: DUP2 000001dc: PUSH2 0x0148 000001df: JUMP 000001e0: JUMPDEST 000001e1: PUSH2 0x039d 000001e4: PUSH1 0x04 000001e6: CALLDATALOAD 000001e7: PUSH1 0x00 000001e9: CALLDATASIZE 000001ea: NUMBER 000001eb: PUSH1 0x40 000001ed: MLOAD 000001ee: DUP1 000001ef: DUP5 000001f0: DUP5 000001f1: DUP1 000001f2: DUP3 000001f3: DUP5 000001f4: CALLDATACOPY 000001f5: POP 000001f6: POP 000001f7: POP 000001f8: SWAP1 000001f9: SWAP2 000001fa: ADD 000001fb: SWAP1 000001fc: DUP2 000001fd: MSTORE 000001fe: PUSH1 0x40 00000200: MLOAD 00000201: SWAP1 00000202: DUP2 00000203: SWAP1 00000204: SUB 00000205: PUSH1 0x20 00000207: ADD 00000208: SWAP1 00000209: KECCAK256 0000020a: SWAP1 0000020b: POP 0000020c: PUSH2 0x0630 0000020f: DUP2 00000210: PUSH2 0x0148 00000213: JUMP 00000214: JUMPDEST 00000215: PUSH2 0x039f 00000218: PUSH1 0x00 0000021a: SLOAD 0000021b: DUP2 0000021c: JUMP 0000021d: JUMPDEST 0000021e: PUSH2 0x039f 00000221: PUSH1 0x04 00000223: CALLDATALOAD 00000224: JUMPDEST 00000225: PUSH1 0x00 00000227: DUP2 00000228: PUSH2 0x0a6c 0000022b: DUP2 0000022c: PUSH2 0x0148 0000022f: JUMP 00000230: JUMPDEST 00000231: PUSH2 0x039d 00000234: PUSH1 0x04 00000236: CALLDATALOAD 00000237: PUSH1 0x00 00000239: CALLDATASIZE 0000023a: NUMBER 0000023b: PUSH1 0x40 0000023d: MLOAD 0000023e: DUP1 0000023f: DUP5 00000240: DUP5 00000241: DUP1 00000242: DUP3 00000243: DUP5 00000244: CALLDATACOPY 00000245: POP 00000246: POP 00000247: POP 00000248: SWAP1 00000249: SWAP2 0000024a: ADD 0000024b: SWAP1 0000024c: DUP2 0000024d: MSTORE 0000024e: PUSH1 0x40 00000250: MLOAD 00000251: SWAP1 00000252: DUP2 00000253: SWAP1 00000254: SUB 00000255: PUSH1 0x20 00000257: ADD 00000258: SWAP1 00000259: KECCAK256 0000025a: SWAP1 0000025b: POP 0000025c: PUSH2 0x07fd 0000025f: DUP2 00000260: PUSH2 0x0148 00000263: JUMP 00000264: JUMPDEST 00000265: PUSH2 0x039f 00000268: PUSH1 0x04 0000026a: DUP1 0000026b: CALLDATALOAD 0000026c: SWAP1 0000026d: PUSH1 0x24 0000026f: DUP1 00000270: CALLDATALOAD 00000271: SWAP2 00000272: PUSH1 0x44 00000274: CALLDATALOAD 00000275: SWAP2 00000276: DUP3 00000277: ADD 00000278: SWAP2 00000279: ADD 0000027a: CALLDATALOAD 0000027b: PUSH1 0x00 0000027d: PUSH2 0x0828 00000280: ORIGIN 00000281: PUSH2 0x0178 00000284: JUMP 00000285: JUMPDEST 00000286: PUSH2 0x039d 00000289: PUSH1 0x04 0000028b: CALLDATALOAD 0000028c: PUSH1 0x01 0000028e: PUSH1 0xa0 00000290: PUSH1 0x02 00000292: EXP 00000293: SUB 00000294: ORIGIN 00000295: AND 00000296: PUSH1 0x00 00000298: SWAP1 00000299: DUP2 0000029a: MSTORE 0000029b: PUSH2 0x0102 0000029e: PUSH1 0x20 000002a0: MSTORE 000002a1: PUSH1 0x40 000002a3: DUP2 000002a4: KECCAK256 000002a5: SLOAD 000002a6: SWAP1 000002a7: DUP1 000002a8: DUP3 000002a9: DUP2 000002aa: EQ 000002ab: ISZERO 000002ac: PUSH2 0x03c7 000002af: JUMPI 000002b0: PUSH2 0x0446 000002b3: JUMP 000002b4: JUMPDEST 000002b5: PUSH2 0x039d 000002b8: PUSH1 0x04 000002ba: CALLDATALOAD 000002bb: PUSH1 0x00 000002bd: CALLDATASIZE 000002be: NUMBER 000002bf: PUSH1 0x40 000002c1: MLOAD 000002c2: DUP1 000002c3: DUP5 000002c4: DUP5 000002c5: DUP1 000002c6: DUP3 000002c7: DUP5 000002c8: CALLDATACOPY 000002c9: POP 000002ca: POP 000002cb: POP 000002cc: SWAP1 000002cd: SWAP2 000002ce: ADD 000002cf: SWAP1 000002d0: DUP2 000002d1: MSTORE 000002d2: PUSH1 0x40 000002d4: MLOAD 000002d5: SWAP1 000002d6: DUP2 000002d7: SWAP1 000002d8: SUB 000002d9: PUSH1 0x20 000002db: ADD 000002dc: SWAP1 000002dd: KECCAK256 000002de: SWAP1 000002df: POP 000002e0: PUSH2 0x0777 000002e3: DUP2 000002e4: PUSH2 0x0148 000002e7: JUMP 000002e8: JUMPDEST 000002e9: PUSH2 0x039f 000002ec: PUSH1 0x04 000002ee: CALLDATALOAD 000002ef: PUSH1 0x24 000002f1: CALLDATALOAD 000002f2: PUSH1 0x00 000002f4: DUP3 000002f5: DUP2 000002f6: MSTORE 000002f7: PUSH2 0x0103 000002fa: PUSH1 0x20 000002fc: SWAP1 000002fd: DUP2 000002fe: MSTORE 000002ff: PUSH1 0x40 00000301: DUP1 00000302: DUP4 00000303: KECCAK256 00000304: PUSH1 0x01 00000306: PUSH1 0xa0 00000308: PUSH1 0x02 0000030a: EXP 0000030b: SUB 0000030c: DUP6 0000030d: AND 0000030e: DUP5 0000030f: MSTORE 00000310: PUSH2 0x0102 00000313: SWAP1 00000314: SWAP3 00000315: MSTORE 00000316: DUP3 00000317: KECCAK256 00000318: SLOAD 00000319: DUP3 0000031a: DUP2 0000031b: DUP2 0000031c: EQ 0000031d: ISZERO 0000031e: PUSH2 0x07d0 00000321: JUMPI 00000322: PUSH2 0x07f4 00000325: JUMP 00000326: JUMPDEST 00000327: PUSH2 0x039d 0000032a: PUSH1 0x04 0000032c: CALLDATALOAD 0000032d: PUSH1 0x00 0000032f: CALLDATASIZE 00000330: NUMBER 00000331: PUSH1 0x40 00000333: MLOAD 00000334: DUP1 00000335: DUP5 00000336: DUP5 00000337: DUP1 00000338: DUP3 00000339: DUP5 0000033a: CALLDATACOPY 0000033b: POP 0000033c: POP 0000033d: POP 0000033e: SWAP1 0000033f: SWAP2 00000340: ADD 00000341: SWAP1 00000342: DUP2 00000343: MSTORE 00000344: PUSH1 0x40 00000346: MLOAD 00000347: SWAP1 00000348: DUP2 00000349: SWAP1 0000034a: SUB 0000034b: PUSH1 0x20 0000034d: ADD 0000034e: SWAP1 0000034f: KECCAK256 00000350: SWAP1 00000351: POP 00000352: PUSH2 0x0817 00000355: DUP2 00000356: PUSH2 0x0148 00000359: JUMP 0000035a: JUMPDEST 0000035b: PUSH2 0x039d 0000035e: PUSH1 0x04 00000360: CALLDATALOAD 00000361: PUSH1 0x24 00000363: CALLDATALOAD 00000364: PUSH1 0x00 00000366: PUSH1 0x00 00000368: CALLDATASIZE 00000369: NUMBER 0000036a: PUSH1 0x40 0000036c: MLOAD 0000036d: DUP1 0000036e: DUP5 0000036f: DUP5 00000370: DUP1 00000371: DUP3 00000372: DUP5 00000373: CALLDATACOPY 00000374: POP 00000375: POP 00000376: POP 00000377: SWAP1 00000378: SWAP2 00000379: ADD 0000037a: SWAP1 0000037b: DUP2 0000037c: MSTORE 0000037d: PUSH1 0x40 0000037f: MLOAD 00000380: SWAP1 00000381: DUP2 00000382: SWAP1 00000383: SUB 00000384: PUSH1 0x20 00000386: ADD 00000387: SWAP1 00000388: KECCAK256 00000389: SWAP1 0000038a: POP 0000038b: PUSH2 0x04d1 0000038e: DUP2 0000038f: PUSH2 0x0148 00000392: JUMP 00000393: JUMPDEST 00000394: PUSH2 0x039f 00000397: PUSH2 0x0105 0000039a: SLOAD 0000039b: DUP2 0000039c: JUMP 0000039d: JUMPDEST 0000039e: STOP 0000039f: JUMPDEST 000003a0: PUSH1 0x40 000003a2: DUP1 000003a3: MLOAD 000003a4: SWAP2 000003a5: DUP3 000003a6: MSTORE 000003a7: MLOAD 000003a8: SWAP1 000003a9: DUP2 000003aa: SWAP1 000003ab: SUB 000003ac: PUSH1 0x20 000003ae: ADD 000003af: SWAP1 000003b0: RETURN 000003b1: JUMPDEST 000003b2: PUSH1 0x40 000003b4: DUP1 000003b5: MLOAD 000003b6: PUSH1 0xff 000003b8: SWAP1 000003b9: SWAP3 000003ba: AND 000003bb: DUP3 000003bc: MSTORE 000003bd: MLOAD 000003be: SWAP1 000003bf: DUP2 000003c0: SWAP1 000003c1: SUB 000003c2: PUSH1 0x20 000003c4: ADD 000003c5: SWAP1 000003c6: RETURN 000003c7: JUMPDEST 000003c8: POP 000003c9: POP 000003ca: PUSH1 0x00 000003cc: DUP3 000003cd: DUP2 000003ce: MSTORE 000003cf: PUSH2 0x0103 000003d2: PUSH1 0x20 000003d4: MSTORE 000003d5: PUSH1 0x40 000003d7: DUP2 000003d8: KECCAK256 000003d9: PUSH1 0x01 000003db: DUP2 000003dc: ADD 000003dd: SLOAD 000003de: PUSH1 0x02 000003e0: DUP5 000003e1: SWAP1 000003e2: EXP 000003e3: SWAP3 000003e4: SWAP1 000003e5: DUP4 000003e6: AND 000003e7: GT 000003e8: ISZERO 000003e9: PUSH2 0x0446 000003ec: JUMPI 000003ed: DUP1 000003ee: SLOAD 000003ef: PUSH1 0x01 000003f1: DUP3 000003f2: DUP2 000003f3: ADD 000003f4: DUP1 000003f5: SLOAD 000003f6: SWAP3 000003f7: SWAP1 000003f8: SWAP2 000003f9: ADD 000003fa: DUP4 000003fb: SSTORE 000003fc: SWAP1 000003fd: DUP4 000003fe: SWAP1 000003ff: SUB 00000400: SWAP1 00000401: SSTORE 00000402: PUSH1 0x40 00000404: DUP1 00000405: MLOAD 00000406: PUSH1 0x01 00000408: PUSH1 0xa0 0000040a: PUSH1 0x02 0000040c: EXP 0000040d: SUB 0000040e: ORIGIN 0000040f: AND 00000410: DUP2 00000411: MSTORE 00000412: PUSH1 0x20 00000414: DUP2 00000415: ADD 00000416: DUP7 00000417: SWAP1 00000418: MSTORE 00000419: DUP2 0000041a: MLOAD 0000041b: PUSH32 0xc7fb647e59b18047309aa15aad418e5d7ca96d173ad704f1031a2c3d7591734b 0000043c: SWAP3 0000043d: SWAP2 0000043e: DUP2 0000043f: SWAP1 00000440: SUB 00000441: SWAP1 00000442: SWAP2 00000443: ADD 00000444: SWAP1 00000445: LOG1 00000446: JUMPDEST 00000447: POP 00000448: POP 00000449: POP 0000044a: POP 0000044b: JUMP 0000044c: JUMPDEST 0000044d: PUSH1 0x01 0000044f: PUSH1 0xa0 00000451: PUSH1 0x02 00000453: EXP 00000454: SUB 00000455: DUP4 00000456: AND 00000457: PUSH1 0x02 00000459: DUP4 0000045a: PUSH2 0x0100 0000045d: DUP2 0000045e: LT 0000045f: ISZERO 00000460: PUSH2 0x0002 00000463: JUMPI 00000464: POP 00000465: DUP4 00000466: ADD 00000467: DUP2 00000468: SWAP1 00000469: SSTORE 0000046a: PUSH1 0x01 0000046c: PUSH1 0xa0 0000046e: PUSH1 0x02 00000470: EXP 00000471: SUB 00000472: DUP6 00000473: AND 00000474: PUSH1 0x00 00000476: DUP2 00000477: DUP2 00000478: MSTORE 00000479: PUSH2 0x0102 0000047c: PUSH1 0x20 0000047e: SWAP1 0000047f: DUP2 00000480: MSTORE 00000481: PUSH1 0x40 00000483: DUP1 00000484: DUP4 00000485: KECCAK256 00000486: DUP4 00000487: SWAP1 00000488: SSTORE 00000489: DUP5 0000048a: DUP4 0000048b: MSTORE 0000048c: SWAP2 0000048d: DUP3 0000048e: SWAP1 0000048f: KECCAK256 00000490: DUP7 00000491: SWAP1 00000492: SSTORE 00000493: DUP2 00000494: MLOAD 00000495: SWAP3 00000496: DUP4 00000497: MSTORE 00000498: DUP3 00000499: ADD 0000049a: SWAP3 0000049b: SWAP1 0000049c: SWAP3 0000049d: MSTORE 0000049e: DUP2 0000049f: MLOAD 000004a0: PUSH32 0xb532073b38c83145e3e5135377a08bf9aab55bc0fd7c1179cd4fb995d2a5159c 000004c1: SWAP3 000004c2: SWAP2 000004c3: DUP2 000004c4: SWAP1 000004c5: SUB 000004c6: SWAP1 000004c7: SWAP2 000004c8: ADD 000004c9: SWAP1 000004ca: LOG1 000004cb: POP 000004cc: JUMPDEST 000004cd: POP 000004ce: POP 000004cf: POP 000004d0: JUMP 000004d1: JUMPDEST 000004d2: ISZERO 000004d3: PUSH2 0x0446 000004d6: JUMPI 000004d7: PUSH2 0x04df 000004da: DUP4 000004db: PUSH2 0x0178 000004de: JUMP 000004df: JUMPDEST 000004e0: ISZERO 000004e1: PUSH2 0x04ea 000004e4: JUMPI 000004e5: POP 000004e6: PUSH2 0x04cc 000004e9: JUMP 000004ea: JUMPDEST 000004eb: PUSH1 0x01 000004ed: PUSH1 0xa0 000004ef: PUSH1 0x02 000004f1: EXP 000004f2: SUB 000004f3: DUP5 000004f4: AND 000004f5: PUSH1 0x00 000004f7: SWAP1 000004f8: DUP2 000004f9: MSTORE 000004fa: PUSH2 0x0102 000004fd: PUSH1 0x20 000004ff: MSTORE 00000500: PUSH1 0x40 00000502: DUP2 00000503: KECCAK256 00000504: SLOAD 00000505: SWAP3 00000506: POP 00000507: DUP3 00000508: EQ 00000509: ISZERO 0000050a: PUSH2 0x0513 0000050d: JUMPI 0000050e: POP 0000050f: PUSH2 0x04cc 00000512: JUMP 00000513: JUMPDEST 00000514: PUSH2 0x044c 00000517: JUMPDEST 00000518: PUSH2 0x0104 0000051b: SLOAD 0000051c: PUSH1 0x00 0000051e: JUMPDEST 0000051f: DUP2 00000520: DUP2 00000521: LT 00000522: ISZERO 00000523: PUSH2 0x0ed3 00000526: JUMPI 00000527: PUSH2 0x0104 0000052a: DUP1 0000052b: SLOAD 0000052c: PUSH2 0x0109 0000052f: SWAP2 00000530: PUSH1 0x00 00000532: SWAP2 00000533: DUP5 00000534: SWAP1 00000535: DUP2 00000536: LT 00000537: ISZERO 00000538: PUSH2 0x0002 0000053b: JUMPI 0000053c: PUSH1 0x00 0000053e: DUP1 0000053f: MLOAD 00000540: PUSH1 0x20 00000542: PUSH2 0x0f8e 00000545: DUP4 00000546: CODECOPY 00000547: DUP2 00000548: MLOAD 00000549: SWAP2 0000054a: MSTORE 0000054b: ADD 0000054c: SLOAD 0000054d: DUP3 0000054e: MSTORE 0000054f: POP 00000550: PUSH1 0x20 00000552: SWAP2 00000553: DUP3 00000554: MSTORE 00000555: PUSH1 0x40 00000557: DUP2 00000558: KECCAK256 00000559: DUP1 0000055a: SLOAD 0000055b: PUSH1 0x01 0000055d: PUSH1 0xa0 0000055f: PUSH1 0x02 00000561: EXP 00000562: SUB 00000563: NOT 00000564: AND 00000565: DUP2 00000566: SSTORE 00000567: PUSH1 0x01 00000569: DUP2 0000056a: ADD 0000056b: DUP3 0000056c: SWAP1 0000056d: SSTORE 0000056e: PUSH1 0x02 00000570: DUP2 00000571: ADD 00000572: DUP1 00000573: SLOAD 00000574: DUP4 00000575: DUP3 00000576: SSTORE 00000577: SWAP1 00000578: DUP4 00000579: MSTORE 0000057a: DUP4 0000057b: DUP4 0000057c: KECCAK256 0000057d: SWAP2 0000057e: SWAP4 0000057f: PUSH2 0x0f58 00000582: SWAP3 00000583: PUSH1 0x1f 00000585: SWAP3 00000586: SWAP1 00000587: SWAP3 00000588: ADD 00000589: DIV 0000058a: DUP2 0000058b: ADD 0000058c: SWAP1 0000058d: PUSH2 0x0a54 00000590: JUMP 00000591: JUMPDEST 00000592: PUSH1 0x01 00000594: DUP1 00000595: SLOAD 00000596: DUP2 00000597: ADD 00000598: SWAP1 00000599: DUP2 0000059a: SWAP1 0000059b: SSTORE 0000059c: PUSH1 0x01 0000059e: PUSH1 0xa0 000005a0: PUSH1 0x02 000005a2: EXP 000005a3: SUB 000005a4: DUP4 000005a5: AND 000005a6: SWAP1 000005a7: PUSH1 0x02 000005a9: SWAP1 000005aa: PUSH2 0x0100 000005ad: DUP2 000005ae: LT 000005af: ISZERO 000005b0: PUSH2 0x0002 000005b3: JUMPI 000005b4: SWAP1 000005b5: SWAP1 000005b6: ADD 000005b7: PUSH1 0x00 000005b9: POP 000005ba: DUP2 000005bb: SWAP1 000005bc: SSTORE 000005bd: POP 000005be: PUSH1 0x01 000005c0: PUSH1 0x00 000005c2: POP 000005c3: SLOAD 000005c4: PUSH2 0x0102 000005c7: PUSH1 0x00 000005c9: POP 000005ca: PUSH1 0x00 000005cc: DUP5 000005cd: PUSH1 0x01 000005cf: PUSH1 0xa0 000005d1: PUSH1 0x02 000005d3: EXP 000005d4: SUB 000005d5: AND 000005d6: DUP2 000005d7: MSTORE 000005d8: PUSH1 0x20 000005da: ADD 000005db: SWAP1 000005dc: DUP2 000005dd: MSTORE 000005de: PUSH1 0x20 000005e0: ADD 000005e1: PUSH1 0x00 000005e3: KECCAK256 000005e4: PUSH1 0x00 000005e6: POP 000005e7: DUP2 000005e8: SWAP1 000005e9: SSTORE 000005ea: POP 000005eb: PUSH32 0x994a936646fe87ffe4f1e469d3d6aa417d6b855598397f323de5b449f765f0c3 0000060c: DUP3 0000060d: PUSH1 0x40 0000060f: MLOAD 00000610: DUP1 00000611: DUP3 00000612: PUSH1 0x01 00000614: PUSH1 0xa0 00000616: PUSH1 0x02 00000618: EXP 00000619: SUB 0000061a: AND 0000061b: DUP2 0000061c: MSTORE 0000061d: PUSH1 0x20 0000061f: ADD 00000620: SWAP2 00000621: POP 00000622: POP 00000623: PUSH1 0x40 00000625: MLOAD 00000626: DUP1 00000627: SWAP2 00000628: SUB 00000629: SWAP1 0000062a: LOG1 0000062b: JUMPDEST 0000062c: POP 0000062d: JUMPDEST 0000062e: POP 0000062f: JUMP 00000630: JUMPDEST 00000631: ISZERO 00000632: PUSH2 0x062b 00000635: JUMPI 00000636: PUSH2 0x063e 00000639: DUP3 0000063a: PUSH2 0x0178 0000063d: JUMP 0000063e: JUMPDEST 0000063f: ISZERO 00000640: PUSH2 0x0649 00000643: JUMPI 00000644: POP 00000645: PUSH2 0x062d 00000648: JUMP 00000649: JUMPDEST 0000064a: PUSH2 0x0651 0000064d: PUSH2 0x0517 00000650: JUMP 00000651: JUMPDEST 00000652: PUSH1 0x01 00000654: SLOAD 00000655: PUSH1 0xfa 00000657: SWAP1 00000658: LT 00000659: PUSH2 0x0666 0000065c: JUMPI 0000065d: PUSH2 0x0664 00000660: PUSH2 0x067b 00000663: JUMP 00000664: JUMPDEST 00000665: POP 00000666: JUMPDEST 00000667: PUSH1 0x01 00000669: SLOAD 0000066a: PUSH1 0xfa 0000066c: SWAP1 0000066d: LT 0000066e: PUSH2 0x0591 00000671: JUMPI 00000672: POP 00000673: PUSH2 0x062d 00000676: JUMP 00000677: JUMPDEST 00000678: PUSH2 0x0735 0000067b: JUMPDEST 0000067c: PUSH1 0x00 0000067e: PUSH1 0x01 00000680: JUMPDEST 00000681: PUSH1 0x01 00000683: SLOAD 00000684: DUP2 00000685: LT 00000686: ISZERO 00000687: PUSH2 0x0a68 0000068a: JUMPI 0000068b: JUMPDEST 0000068c: PUSH1 0x01 0000068e: SLOAD 0000068f: DUP2 00000690: LT 00000691: DUP1 00000692: ISZERO 00000693: PUSH2 0x06ab 00000696: JUMPI 00000697: POP 00000698: PUSH1 0x02 0000069a: DUP2 0000069b: PUSH2 0x0100 0000069e: DUP2 0000069f: LT 000006a0: ISZERO 000006a1: PUSH2 0x0002 000006a4: JUMPI 000006a5: ADD 000006a6: SLOAD 000006a7: PUSH1 0x00 000006a9: EQ 000006aa: ISZERO 000006ab: JUMPDEST 000006ac: ISZERO 000006ad: PUSH2 0x0d8e 000006b0: JUMPI 000006b1: PUSH1 0x01 000006b3: ADD 000006b4: PUSH2 0x068b 000006b7: JUMP 000006b8: JUMPDEST 000006b9: ISZERO 000006ba: PUSH2 0x04cc 000006bd: JUMPI 000006be: PUSH1 0x01 000006c0: PUSH1 0xa0 000006c2: PUSH1 0x02 000006c4: EXP 000006c5: SUB 000006c6: DUP4 000006c7: AND 000006c8: PUSH1 0x00 000006ca: SWAP1 000006cb: DUP2 000006cc: MSTORE 000006cd: PUSH2 0x0102 000006d0: PUSH1 0x20 000006d2: MSTORE 000006d3: PUSH1 0x40 000006d5: DUP2 000006d6: KECCAK256 000006d7: SLOAD 000006d8: SWAP3 000006d9: POP 000006da: DUP3 000006db: EQ 000006dc: ISZERO 000006dd: PUSH2 0x06e6 000006e0: JUMPI 000006e1: POP 000006e2: PUSH2 0x062b 000006e5: JUMP 000006e6: JUMPDEST 000006e7: PUSH1 0x01 000006e9: PUSH1 0x01 000006eb: PUSH1 0x00 000006ed: POP 000006ee: SLOAD 000006ef: SUB 000006f0: PUSH1 0x00 000006f2: PUSH1 0x00 000006f4: POP 000006f5: SLOAD 000006f6: GT 000006f7: ISZERO 000006f8: PUSH2 0x0701 000006fb: JUMPI 000006fc: POP 000006fd: PUSH2 0x062b 00000700: JUMP 00000701: JUMPDEST 00000702: PUSH1 0x00 00000704: PUSH1 0x02 00000706: DUP4 00000707: PUSH2 0x0100 0000070a: DUP2 0000070b: LT 0000070c: ISZERO 0000070d: PUSH2 0x0002 00000710: JUMPI 00000711: POP 00000712: DUP4 00000713: ADD 00000714: DUP2 00000715: SWAP1 00000716: SSTORE 00000717: PUSH1 0x01 00000719: PUSH1 0xa0 0000071b: PUSH1 0x02 0000071d: EXP 0000071e: SUB 0000071f: DUP5 00000720: AND 00000721: DUP2 00000722: MSTORE 00000723: PUSH2 0x0102 00000726: PUSH1 0x20 00000728: MSTORE 00000729: PUSH1 0x40 0000072b: DUP2 0000072c: KECCAK256 0000072d: SSTORE 0000072e: PUSH2 0x0677 00000731: PUSH2 0x0517 00000734: JUMP 00000735: JUMPDEST 00000736: POP 00000737: PUSH1 0x40 00000739: DUP1 0000073a: MLOAD 0000073b: PUSH1 0x01 0000073d: PUSH1 0xa0 0000073f: PUSH1 0x02 00000741: EXP 00000742: SUB 00000743: DUP6 00000744: AND 00000745: DUP2 00000746: MSTORE 00000747: SWAP1 00000748: MLOAD 00000749: PUSH32 0x58619076adf5bb0943d100ef88d52d7c3fd691b19d3a9071b555b651fbf418da 0000076a: SWAP2 0000076b: DUP2 0000076c: SWAP1 0000076d: SUB 0000076e: PUSH1 0x20 00000770: ADD 00000771: SWAP1 00000772: LOG1 00000773: POP 00000774: POP 00000775: POP 00000776: JUMP 00000777: JUMPDEST 00000778: ISZERO 00000779: PUSH2 0x062b 0000077c: JUMPI 0000077d: PUSH1 0x01 0000077f: SLOAD 00000780: DUP3 00000781: GT 00000782: ISZERO 00000783: PUSH2 0x078c 00000786: JUMPI 00000787: POP 00000788: PUSH2 0x062d 0000078b: JUMP 0000078c: JUMPDEST 0000078d: PUSH1 0x00 0000078f: DUP3 00000790: SWAP1 00000791: SSTORE 00000792: PUSH2 0x0799 00000795: PUSH2 0x0517 00000798: JUMP 00000799: JUMPDEST 0000079a: PUSH1 0x40 0000079c: DUP1 0000079d: MLOAD 0000079e: DUP4 0000079f: DUP2 000007a0: MSTORE 000007a1: SWAP1 000007a2: MLOAD 000007a3: PUSH32 0xacbdb084c721332ac59f9b8e392196c9eb0e4932862da8eb9beaf0dad4f550da 000007c4: SWAP2 000007c5: DUP2 000007c6: SWAP1 000007c7: SUB 000007c8: PUSH1 0x20 000007ca: ADD 000007cb: SWAP1 000007cc: LOG1 000007cd: POP 000007ce: POP 000007cf: JUMP 000007d0: JUMPDEST 000007d1: POP 000007d2: PUSH1 0x01 000007d4: DUP3 000007d5: ADD 000007d6: SLOAD 000007d7: PUSH1 0x02 000007d9: DUP3 000007da: SWAP1 000007db: EXP 000007dc: SWAP1 000007dd: DUP2 000007de: AND 000007df: PUSH1 0x00 000007e1: EQ 000007e2: ISZERO 000007e3: PUSH2 0x07ef 000007e6: JUMPI 000007e7: PUSH1 0x00 000007e9: SWAP4 000007ea: POP 000007eb: PUSH2 0x07f4 000007ee: JUMP 000007ef: JUMPDEST 000007f0: PUSH1 0x01 000007f2: SWAP4 000007f3: POP 000007f4: JUMPDEST 000007f5: POP 000007f6: POP 000007f7: POP 000007f8: SWAP3 000007f9: SWAP2 000007fa: POP 000007fb: POP 000007fc: JUMP 000007fd: JUMPDEST 000007fe: ISZERO 000007ff: PUSH2 0x062b 00000802: JUMPI 00000803: POP 00000804: PUSH2 0x0105 00000807: SSTORE 00000808: JUMP 00000809: JUMPDEST 0000080a: ISZERO 0000080b: PUSH2 0x062d 0000080e: JUMPI 0000080f: PUSH1 0x00 00000811: PUSH2 0x0106 00000814: SSTORE 00000815: POP 00000816: JUMP 00000817: JUMPDEST 00000818: ISZERO 00000819: PUSH2 0x062b 0000081c: JUMPI 0000081d: DUP2 0000081e: PUSH1 0x01 00000820: PUSH1 0xa0 00000822: PUSH1 0x02 00000824: EXP 00000825: SUB 00000826: AND 00000827: SELFDESTRUCT 00000828: JUMPDEST 00000829: ISZERO 0000082a: PUSH2 0x0a44 0000082d: JUMPI 0000082e: PUSH2 0x083c 00000831: DUP5 00000832: PUSH1 0x00 00000834: PUSH2 0x0e68 00000837: ORIGIN 00000838: PUSH2 0x0178 0000083b: JUMP 0000083c: JUMPDEST 0000083d: ISZERO 0000083e: PUSH2 0x08f8 00000841: JUMPI 00000842: PUSH32 0x92ca3a80853e6663fa31fa10b99225f18d4902939b4c53a9caae9043f6efd004 00000863: ORIGIN 00000864: DUP6 00000865: DUP8 00000866: DUP7 00000867: DUP7 00000868: PUSH1 0x40 0000086a: MLOAD 0000086b: DUP1 0000086c: DUP7 0000086d: PUSH1 0x01 0000086f: PUSH1 0xa0 00000871: PUSH1 0x02 00000873: EXP 00000874: SUB 00000875: AND 00000876: DUP2 00000877: MSTORE 00000878: PUSH1 0x20 0000087a: ADD 0000087b: DUP6 0000087c: DUP2 0000087d: MSTORE 0000087e: PUSH1 0x20 00000880: ADD 00000881: DUP5 00000882: PUSH1 0x01 00000884: PUSH1 0xa0 00000886: PUSH1 0x02 00000888: EXP 00000889: SUB 0000088a: AND 0000088b: DUP2 0000088c: MSTORE 0000088d: PUSH1 0x20 0000088f: ADD 00000890: DUP1 00000891: PUSH1 0x20 00000893: ADD 00000894: DUP3 00000895: DUP2 00000896: SUB 00000897: DUP3 00000898: MSTORE 00000899: DUP5 0000089a: DUP5 0000089b: DUP3 0000089c: DUP2 0000089d: DUP2 0000089e: MSTORE 0000089f: PUSH1 0x20 000008a1: ADD 000008a2: SWAP3 000008a3: POP 000008a4: DUP1 000008a5: DUP3 000008a6: DUP5 000008a7: CALLDATACOPY 000008a8: DUP3 000008a9: ADD 000008aa: SWAP2 000008ab: POP 000008ac: POP 000008ad: SWAP7 000008ae: POP 000008af: POP 000008b0: POP 000008b1: POP 000008b2: POP 000008b3: POP 000008b4: POP 000008b5: PUSH1 0x40 000008b7: MLOAD 000008b8: DUP1 000008b9: SWAP2 000008ba: SUB 000008bb: SWAP1 000008bc: LOG1 000008bd: DUP5 000008be: PUSH1 0x01 000008c0: PUSH1 0xa0 000008c2: PUSH1 0x02 000008c4: EXP 000008c5: SUB 000008c6: AND 000008c7: DUP5 000008c8: DUP5 000008c9: DUP5 000008ca: PUSH1 0x40 000008cc: MLOAD 000008cd: DUP1 000008ce: DUP4 000008cf: DUP4 000008d0: DUP1 000008d1: DUP3 000008d2: DUP5 000008d3: CALLDATACOPY 000008d4: POP 000008d5: POP 000008d6: POP 000008d7: SWAP1 000008d8: DUP2 000008d9: ADD 000008da: SWAP2 000008db: POP 000008dc: PUSH1 0x00 000008de: SWAP1 000008df: DUP1 000008e0: DUP4 000008e1: SUB 000008e2: DUP2 000008e3: DUP6 000008e4: DUP8 000008e5: PUSH2 0x8502 000008e8: GAS 000008e9: SUB 000008ea: CALL 000008eb: POP 000008ec: PUSH1 0x00 000008ee: SWAP4 000008ef: POP 000008f0: PUSH2 0x0a44 000008f3: SWAP3 000008f4: POP 000008f5: POP 000008f6: POP 000008f7: JUMP 000008f8: JUMPDEST 000008f9: PUSH1 0x00 000008fb: CALLDATASIZE 000008fc: NUMBER 000008fd: PUSH1 0x40 000008ff: MLOAD 00000900: DUP1 00000901: DUP5 00000902: DUP5 00000903: DUP1 00000904: DUP3 00000905: DUP5 00000906: CALLDATACOPY 00000907: POP 00000908: POP 00000909: POP 0000090a: SWAP1 0000090b: SWAP2 0000090c: ADD 0000090d: SWAP1 0000090e: DUP2 0000090f: MSTORE 00000910: PUSH1 0x40 00000912: MLOAD 00000913: SWAP1 00000914: DUP2 00000915: SWAP1 00000916: SUB 00000917: PUSH1 0x20 00000919: ADD 0000091a: SWAP1 0000091b: KECCAK256 0000091c: SWAP2 0000091d: POP 0000091e: PUSH2 0x0928 00000921: SWAP1 00000922: POP 00000923: DUP2 00000924: PUSH2 0x0224 00000927: JUMP 00000928: JUMPDEST 00000929: ISZERO 0000092a: DUP1 0000092b: ISZERO 0000092c: PUSH2 0x094b 0000092f: JUMPI 00000930: POP 00000931: PUSH1 0x00 00000933: DUP2 00000934: DUP2 00000935: MSTORE 00000936: PUSH2 0x0109 00000939: PUSH1 0x20 0000093b: MSTORE 0000093c: PUSH1 0x40 0000093e: DUP2 0000093f: KECCAK256 00000940: SLOAD 00000941: PUSH1 0x01 00000943: PUSH1 0xa0 00000945: PUSH1 0x02 00000947: EXP 00000948: SUB 00000949: AND 0000094a: EQ 0000094b: JUMPDEST 0000094c: ISZERO 0000094d: PUSH2 0x0a44 00000950: JUMPI 00000951: PUSH1 0x00 00000953: DUP2 00000954: DUP2 00000955: MSTORE 00000956: PUSH2 0x0109 00000959: PUSH1 0x20 0000095b: SWAP1 0000095c: DUP2 0000095d: MSTORE 0000095e: PUSH1 0x40 00000960: DUP3 00000961: KECCAK256 00000962: DUP1 00000963: SLOAD 00000964: PUSH1 0x01 00000966: PUSH1 0xa0 00000968: PUSH1 0x02 0000096a: EXP 0000096b: SUB 0000096c: NOT 0000096d: AND 0000096e: DUP9 0000096f: OR 00000970: DUP2 00000971: SSTORE 00000972: PUSH1 0x01 00000974: DUP2 00000975: ADD 00000976: DUP8 00000977: SWAP1 00000978: SSTORE 00000979: PUSH1 0x02 0000097b: ADD 0000097c: DUP1 0000097d: SLOAD 0000097e: DUP6 0000097f: DUP3 00000980: SSTORE 00000981: DUP2 00000982: DUP5 00000983: MSTORE 00000984: SWAP3 00000985: DUP3 00000986: SWAP1 00000987: KECCAK256 00000988: SWAP1 00000989: SWAP3 0000098a: PUSH1 0x1f 0000098c: ADD 0000098d: SWAP2 0000098e: SWAP1 0000098f: SWAP2 00000990: DIV 00000991: DUP2 00000992: ADD 00000993: SWAP1 00000994: DUP5 00000995: SWAP1 00000996: DUP7 00000997: DUP3 00000998: ISZERO 00000999: PUSH2 0x0a4c 0000099c: JUMPI 0000099d: SWAP2 0000099e: DUP3 0000099f: ADD 000009a0: JUMPDEST 000009a1: DUP3 000009a2: DUP2 000009a3: GT 000009a4: ISZERO 000009a5: PUSH2 0x0a4c 000009a8: JUMPI 000009a9: DUP3 000009aa: CALLDATALOAD 000009ab: DUP3 000009ac: PUSH1 0x00 000009ae: POP 000009af: SSTORE 000009b0: SWAP2 000009b1: PUSH1 0x20 000009b3: ADD 000009b4: SWAP2 000009b5: SWAP1 000009b6: PUSH1 0x01 000009b8: ADD 000009b9: SWAP1 000009ba: PUSH2 0x09a0 000009bd: JUMP 000009be: JUMPDEST 000009bf: POP 000009c0: POP 000009c1: PUSH32 0x1733cbb53659d713b79580f79f3f9ff215f78a7c7aa45890f3b89fc5cddfbf32 000009e2: DUP2 000009e3: ORIGIN 000009e4: DUP7 000009e5: DUP9 000009e6: DUP8 000009e7: DUP8 000009e8: PUSH1 0x40 000009ea: MLOAD 000009eb: DUP1 000009ec: DUP8 000009ed: DUP2 000009ee: MSTORE 000009ef: PUSH1 0x20 000009f1: ADD 000009f2: DUP7 000009f3: PUSH1 0x01 000009f5: PUSH1 0xa0 000009f7: PUSH1 0x02 000009f9: EXP 000009fa: SUB 000009fb: AND 000009fc: DUP2 000009fd: MSTORE 000009fe: PUSH1 0x20 00000a00: ADD 00000a01: DUP6 00000a02: DUP2 00000a03: MSTORE 00000a04: PUSH1 0x20 00000a06: ADD 00000a07: DUP5 00000a08: PUSH1 0x01 00000a0a: PUSH1 0xa0 00000a0c: PUSH1 0x02 00000a0e: EXP 00000a0f: SUB 00000a10: AND 00000a11: DUP2 00000a12: MSTORE 00000a13: PUSH1 0x20 00000a15: ADD 00000a16: DUP1 00000a17: PUSH1 0x20 00000a19: ADD 00000a1a: DUP3 00000a1b: DUP2 00000a1c: SUB 00000a1d: DUP3 00000a1e: MSTORE 00000a1f: DUP5 00000a20: DUP5 00000a21: DUP3 00000a22: DUP2 00000a23: DUP2 00000a24: MSTORE 00000a25: PUSH1 0x20 00000a27: ADD 00000a28: SWAP3 00000a29: POP 00000a2a: DUP1 00000a2b: DUP3 00000a2c: DUP5 00000a2d: CALLDATACOPY 00000a2e: DUP3 00000a2f: ADD 00000a30: SWAP2 00000a31: POP 00000a32: POP 00000a33: SWAP8 00000a34: POP 00000a35: POP 00000a36: POP 00000a37: POP 00000a38: POP 00000a39: POP 00000a3a: POP 00000a3b: POP 00000a3c: PUSH1 0x40 00000a3e: MLOAD 00000a3f: DUP1 00000a40: SWAP2 00000a41: SUB 00000a42: SWAP1 00000a43: LOG1 00000a44: JUMPDEST 00000a45: SWAP5 00000a46: SWAP4 00000a47: POP 00000a48: POP 00000a49: POP 00000a4a: POP 00000a4b: JUMP 00000a4c: JUMPDEST 00000a4d: POP 00000a4e: PUSH2 0x09be 00000a51: SWAP3 00000a52: SWAP2 00000a53: POP 00000a54: JUMPDEST 00000a55: DUP1 00000a56: DUP3 00000a57: GT 00000a58: ISZERO 00000a59: PUSH2 0x0a68 00000a5c: JUMPI 00000a5d: PUSH1 0x00 00000a5f: DUP2 00000a60: SSTORE 00000a61: PUSH1 0x01 00000a63: ADD 00000a64: PUSH2 0x0a54 00000a67: JUMP 00000a68: JUMPDEST 00000a69: POP 00000a6a: SWAP1 00000a6b: JUMP 00000a6c: JUMPDEST 00000a6d: ISZERO 00000a6e: PUSH2 0x0c1b 00000a71: JUMPI 00000a72: PUSH1 0x00 00000a74: DUP4 00000a75: DUP2 00000a76: MSTORE 00000a77: PUSH2 0x0109 00000a7a: PUSH1 0x20 00000a7c: MSTORE 00000a7d: PUSH1 0x40 00000a7f: DUP2 00000a80: KECCAK256 00000a81: SLOAD 00000a82: PUSH1 0x01 00000a84: PUSH1 0xa0 00000a86: PUSH1 0x02 00000a88: EXP 00000a89: SUB 00000a8a: AND 00000a8b: EQ 00000a8c: PUSH2 0x0c1b 00000a8f: JUMPI 00000a90: PUSH1 0x40 00000a92: DUP1 00000a93: MLOAD 00000a94: PUSH1 0x00 00000a96: SWAP2 00000a97: SWAP1 00000a98: SWAP2 00000a99: KECCAK256 00000a9a: DUP1 00000a9b: SLOAD 00000a9c: PUSH1 0x01 00000a9e: DUP3 00000a9f: ADD 00000aa0: SLOAD 00000aa1: PUSH1 0x02 00000aa3: SWAP3 00000aa4: SWAP1 00000aa5: SWAP3 00000aa6: ADD 00000aa7: DUP1 00000aa8: SLOAD 00000aa9: PUSH1 0x01 00000aab: PUSH1 0xa0 00000aad: PUSH1 0x02 00000aaf: EXP 00000ab0: SUB 00000ab1: SWAP3 00000ab2: SWAP1 00000ab3: SWAP3 00000ab4: AND 00000ab5: SWAP4 00000ab6: SWAP1 00000ab7: SWAP2 00000ab8: DUP2 00000ab9: SWAP1 00000aba: DUP4 00000abb: SWAP1 00000abc: DUP1 00000abd: ISZERO 00000abe: PUSH2 0x0aec 00000ac1: JUMPI 00000ac2: DUP3 00000ac3: ADD 00000ac4: SWAP2 00000ac5: SWAP1 00000ac6: PUSH1 0x00 00000ac8: MSTORE 00000ac9: PUSH1 0x20 00000acb: PUSH1 0x00 00000acd: KECCAK256 00000ace: SWAP1 00000acf: JUMPDEST 00000ad0: DUP2 00000ad1: SLOAD 00000ad2: DUP2 00000ad3: MSTORE 00000ad4: SWAP1 00000ad5: PUSH1 0x01 00000ad7: ADD 00000ad8: SWAP1 00000ad9: PUSH1 0x20 00000adb: ADD 00000adc: DUP1 00000add: DUP4 00000ade: GT 00000adf: PUSH2 0x0acf 00000ae2: JUMPI 00000ae3: DUP3 00000ae4: SWAP1 00000ae5: SUB 00000ae6: PUSH1 0x1f 00000ae8: AND 00000ae9: DUP3 00000aea: ADD 00000aeb: SWAP2 00000aec: JUMPDEST 00000aed: POP 00000aee: POP 00000aef: SWAP2 00000af0: POP 00000af1: POP 00000af2: PUSH1 0x00 00000af4: PUSH1 0x40 00000af6: MLOAD 00000af7: DUP1 00000af8: DUP4 00000af9: SUB 00000afa: DUP2 00000afb: DUP6 00000afc: DUP8 00000afd: PUSH2 0x8502 00000b00: GAS 00000b01: SUB 00000b02: CALL 00000b03: POP 00000b04: POP 00000b05: POP 00000b06: PUSH1 0x00 00000b08: DUP5 00000b09: DUP2 00000b0a: MSTORE 00000b0b: PUSH2 0x0109 00000b0e: PUSH1 0x20 00000b10: SWAP1 00000b11: DUP2 00000b12: MSTORE 00000b13: PUSH1 0x40 00000b15: DUP1 00000b16: MLOAD 00000b17: SWAP3 00000b18: DUP2 00000b19: SWAP1 00000b1a: KECCAK256 00000b1b: DUP1 00000b1c: SLOAD 00000b1d: PUSH1 0x01 00000b1f: DUP3 00000b20: ADD 00000b21: SLOAD 00000b22: PUSH1 0x01 00000b24: PUSH1 0xa0 00000b26: PUSH1 0x02 00000b28: EXP 00000b29: SUB 00000b2a: ORIGIN 00000b2b: DUP2 00000b2c: DUP2 00000b2d: AND 00000b2e: DUP9 00000b2f: MSTORE 00000b30: SWAP6 00000b31: DUP8 00000b32: ADD 00000b33: DUP12 00000b34: SWAP1 00000b35: MSTORE 00000b36: SWAP4 00000b37: DUP7 00000b38: ADD 00000b39: DUP2 00000b3a: SWAP1 00000b3b: MSTORE 00000b3c: SWAP3 00000b3d: AND 00000b3e: PUSH1 0x60 00000b40: DUP6 00000b41: ADD 00000b42: DUP2 00000b43: SWAP1 00000b44: MSTORE 00000b45: PUSH1 0xa0 00000b47: PUSH1 0x80 00000b49: DUP7 00000b4a: ADD 00000b4b: DUP2 00000b4c: DUP2 00000b4d: MSTORE 00000b4e: PUSH1 0x02 00000b50: SWAP4 00000b51: SWAP1 00000b52: SWAP4 00000b53: ADD 00000b54: DUP1 00000b55: SLOAD 00000b56: SWAP2 00000b57: DUP8 00000b58: ADD 00000b59: DUP3 00000b5a: SWAP1 00000b5b: MSTORE 00000b5c: PUSH32 0xe7c957c06e9a662c1a6c77366179f5b702b97651dc28eee7d5bf1dff6e40bb4a 00000b7d: SWAP8 00000b7e: POP 00000b7f: SWAP5 00000b80: SWAP6 00000b81: DUP11 00000b82: SWAP6 00000b83: SWAP3 00000b84: SWAP4 00000b85: SWAP1 00000b86: SWAP2 00000b87: PUSH1 0xc0 00000b89: DUP4 00000b8a: ADD 00000b8b: SWAP1 00000b8c: DUP5 00000b8d: SWAP1 00000b8e: DUP1 00000b8f: ISZERO 00000b90: PUSH2 0x0bbe 00000b93: JUMPI 00000b94: DUP3 00000b95: ADD 00000b96: SWAP2 00000b97: SWAP1 00000b98: PUSH1 0x00 00000b9a: MSTORE 00000b9b: PUSH1 0x20 00000b9d: PUSH1 0x00 00000b9f: KECCAK256 00000ba0: SWAP1 00000ba1: JUMPDEST 00000ba2: DUP2 00000ba3: SLOAD 00000ba4: DUP2 00000ba5: MSTORE 00000ba6: SWAP1 00000ba7: PUSH1 0x01 00000ba9: ADD 00000baa: SWAP1 00000bab: PUSH1 0x20 00000bad: ADD 00000bae: DUP1 00000baf: DUP4 00000bb0: GT 00000bb1: PUSH2 0x0ba1 00000bb4: JUMPI 00000bb5: DUP3 00000bb6: SWAP1 00000bb7: SUB 00000bb8: PUSH1 0x1f 00000bba: AND 00000bbb: DUP3 00000bbc: ADD 00000bbd: SWAP2 00000bbe: JUMPDEST 00000bbf: POP 00000bc0: POP 00000bc1: SWAP7 00000bc2: POP 00000bc3: POP 00000bc4: POP 00000bc5: POP 00000bc6: POP 00000bc7: POP 00000bc8: POP 00000bc9: PUSH1 0x40 00000bcb: MLOAD 00000bcc: DUP1 00000bcd: SWAP2 00000bce: SUB 00000bcf: SWAP1 00000bd0: LOG1 00000bd1: PUSH1 0x00 00000bd3: DUP4 00000bd4: DUP2 00000bd5: MSTORE 00000bd6: PUSH2 0x0109 00000bd9: PUSH1 0x20 00000bdb: SWAP1 00000bdc: DUP2 00000bdd: MSTORE 00000bde: PUSH1 0x40 00000be0: DUP3 00000be1: KECCAK256 00000be2: DUP1 00000be3: SLOAD 00000be4: PUSH1 0x01 00000be6: PUSH1 0xa0 00000be8: PUSH1 0x02 00000bea: EXP 00000beb: SUB 00000bec: NOT 00000bed: AND 00000bee: DUP2 00000bef: SSTORE 00000bf0: PUSH1 0x01 00000bf2: DUP2 00000bf3: ADD 00000bf4: DUP4 00000bf5: SWAP1 00000bf6: SSTORE 00000bf7: PUSH1 0x02 00000bf9: DUP2 00000bfa: ADD 00000bfb: DUP1 00000bfc: SLOAD 00000bfd: DUP5 00000bfe: DUP3 00000bff: SSTORE 00000c00: SWAP1 00000c01: DUP5 00000c02: MSTORE 00000c03: DUP3 00000c04: DUP5 00000c05: KECCAK256 00000c06: SWAP2 00000c07: SWAP4 00000c08: SWAP3 00000c09: PUSH2 0x0c21 00000c0c: SWAP3 00000c0d: PUSH1 0x1f 00000c0f: SWAP3 00000c10: SWAP1 00000c11: SWAP3 00000c12: ADD 00000c13: DIV 00000c14: DUP2 00000c15: ADD 00000c16: SWAP1 00000c17: PUSH2 0x0a54 00000c1a: JUMP 00000c1b: JUMPDEST 00000c1c: POP 00000c1d: SWAP2 00000c1e: SWAP1 00000c1f: POP 00000c20: JUMP 00000c21: JUMPDEST 00000c22: POP 00000c23: POP 00000c24: POP 00000c25: PUSH1 0x01 00000c27: SWAP2 00000c28: POP 00000c29: POP 00000c2a: PUSH2 0x0194 00000c2d: JUMP 00000c2e: JUMPDEST 00000c2f: PUSH1 0x00 00000c31: DUP6 00000c32: DUP2 00000c33: MSTORE 00000c34: PUSH2 0x0103 00000c37: PUSH1 0x20 00000c39: MSTORE 00000c3a: PUSH1 0x40 00000c3c: DUP2 00000c3d: KECCAK256 00000c3e: DUP1 00000c3f: SLOAD 00000c40: SWAP1 00000c41: SWAP4 00000c42: POP 00000c43: EQ 00000c44: ISZERO 00000c45: PUSH2 0x0cb6 00000c48: JUMPI 00000c49: PUSH1 0x00 00000c4b: DUP1 00000c4c: SLOAD 00000c4d: DUP4 00000c4e: SSTORE 00000c4f: PUSH1 0x01 00000c51: DUP4 00000c52: DUP2 00000c53: ADD 00000c54: SWAP2 00000c55: SWAP1 00000c56: SWAP2 00000c57: SSTORE 00000c58: PUSH2 0x0104 00000c5b: DUP1 00000c5c: SLOAD 00000c5d: SWAP2 00000c5e: DUP3 00000c5f: ADD 00000c60: DUP1 00000c61: DUP3 00000c62: SSTORE 00000c63: DUP3 00000c64: DUP1 00000c65: ISZERO 00000c66: DUP3 00000c67: SWAP1 00000c68: GT 00000c69: PUSH2 0x0c85 00000c6c: JUMPI 00000c6d: DUP2 00000c6e: DUP4 00000c6f: PUSH1 0x00 00000c71: MSTORE 00000c72: PUSH1 0x20 00000c74: PUSH1 0x00 00000c76: KECCAK256 00000c77: SWAP2 00000c78: DUP3 00000c79: ADD 00000c7a: SWAP2 00000c7b: ADD 00000c7c: PUSH2 0x0c85 00000c7f: SWAP2 00000c80: SWAP1 00000c81: PUSH2 0x0a54 00000c84: JUMP 00000c85: JUMPDEST 00000c86: POP 00000c87: POP 00000c88: POP 00000c89: PUSH1 0x02 00000c8b: DUP4 00000c8c: ADD 00000c8d: DUP2 00000c8e: SWAP1 00000c8f: SSTORE 00000c90: PUSH2 0x0104 00000c93: DUP1 00000c94: SLOAD 00000c95: DUP8 00000c96: SWAP3 00000c97: SWAP1 00000c98: DUP2 00000c99: LT 00000c9a: ISZERO 00000c9b: PUSH2 0x0002 00000c9e: JUMPI 00000c9f: PUSH1 0x00 00000ca1: SWAP2 00000ca2: SWAP1 00000ca3: SWAP2 00000ca4: MSTORE 00000ca5: PUSH1 0x00 00000ca7: DUP1 00000ca8: MLOAD 00000ca9: PUSH1 0x20 00000cab: PUSH2 0x0f8e 00000cae: DUP4 00000caf: CODECOPY 00000cb0: DUP2 00000cb1: MLOAD 00000cb2: SWAP2 00000cb3: MSTORE 00000cb4: ADD 00000cb5: SSTORE 00000cb6: JUMPDEST 00000cb7: POP 00000cb8: PUSH1 0x01 00000cba: DUP2 00000cbb: ADD 00000cbc: SLOAD 00000cbd: PUSH1 0x02 00000cbf: DUP4 00000cc0: SWAP1 00000cc1: EXP 00000cc2: SWAP1 00000cc3: DUP2 00000cc4: AND 00000cc5: PUSH1 0x00 00000cc7: EQ 00000cc8: ISZERO 00000cc9: PUSH2 0x0d86 00000ccc: JUMPI 00000ccd: PUSH1 0x40 00000ccf: DUP1 00000cd0: MLOAD 00000cd1: PUSH1 0x01 00000cd3: PUSH1 0xa0 00000cd5: PUSH1 0x02 00000cd7: EXP 00000cd8: SUB 00000cd9: ORIGIN 00000cda: AND 00000cdb: DUP2 00000cdc: MSTORE 00000cdd: PUSH1 0x20 00000cdf: DUP2 00000ce0: ADD 00000ce1: DUP8 00000ce2: SWAP1 00000ce3: MSTORE 00000ce4: DUP2 00000ce5: MLOAD 00000ce6: PUSH32 0xe1c52dc63b719ade82e8bea94cc41a0d5d28e4aaf536adb5e9cccc9ff8c1aeda 00000d07: SWAP3 00000d08: SWAP2 00000d09: DUP2 00000d0a: SWAP1 00000d0b: SUB 00000d0c: SWAP1 00000d0d: SWAP2 00000d0e: ADD 00000d0f: SWAP1 00000d10: LOG1 00000d11: DUP2 00000d12: SLOAD 00000d13: PUSH1 0x01 00000d15: SWAP1 00000d16: GT 00000d17: PUSH2 0x0d73 00000d1a: JUMPI 00000d1b: PUSH1 0x00 00000d1d: DUP6 00000d1e: DUP2 00000d1f: MSTORE 00000d20: PUSH2 0x0103 00000d23: PUSH1 0x20 00000d25: MSTORE 00000d26: PUSH1 0x40 00000d28: SWAP1 00000d29: KECCAK256 00000d2a: PUSH1 0x02 00000d2c: ADD 00000d2d: SLOAD 00000d2e: PUSH2 0x0104 00000d31: DUP1 00000d32: SLOAD 00000d33: SWAP1 00000d34: SWAP2 00000d35: SWAP1 00000d36: DUP2 00000d37: LT 00000d38: ISZERO 00000d39: PUSH2 0x0002 00000d3c: JUMPI 00000d3d: PUSH1 0x40 00000d3f: PUSH1 0x00 00000d41: SWAP1 00000d42: DUP2 00000d43: KECCAK256 00000d44: PUSH1 0x00 00000d46: DUP1 00000d47: MLOAD 00000d48: PUSH1 0x20 00000d4a: PUSH2 0x0f8e 00000d4d: DUP4 00000d4e: CODECOPY 00000d4f: DUP2 00000d50: MLOAD 00000d51: SWAP2 00000d52: MSTORE 00000d53: SWAP3 00000d54: SWAP1 00000d55: SWAP3 00000d56: ADD 00000d57: DUP2 00000d58: SWAP1 00000d59: SSTORE 00000d5a: DUP1 00000d5b: DUP3 00000d5c: SSTORE 00000d5d: PUSH1 0x01 00000d5f: DUP1 00000d60: DUP4 00000d61: ADD 00000d62: DUP3 00000d63: SWAP1 00000d64: SSTORE 00000d65: PUSH1 0x02 00000d67: SWAP1 00000d68: SWAP3 00000d69: ADD 00000d6a: SSTORE 00000d6b: SWAP5 00000d6c: POP 00000d6d: PUSH2 0x0d86 00000d70: SWAP1 00000d71: POP 00000d72: JUMP 00000d73: JUMPDEST 00000d74: DUP2 00000d75: SLOAD 00000d76: PUSH1 0x00 00000d78: NOT 00000d79: ADD 00000d7a: DUP3 00000d7b: SSTORE 00000d7c: PUSH1 0x01 00000d7e: DUP3 00000d7f: ADD 00000d80: DUP1 00000d81: SLOAD 00000d82: DUP3 00000d83: OR 00000d84: SWAP1 00000d85: SSTORE 00000d86: JUMPDEST 00000d87: POP 00000d88: POP 00000d89: POP 00000d8a: SWAP2 00000d8b: SWAP1 00000d8c: POP 00000d8d: JUMP 00000d8e: JUMPDEST 00000d8f: JUMPDEST 00000d90: PUSH1 0x01 00000d92: DUP1 00000d93: SLOAD 00000d94: GT 00000d95: DUP1 00000d96: ISZERO 00000d97: PUSH2 0x0db1 00000d9a: JUMPI 00000d9b: POP 00000d9c: PUSH1 0x01 00000d9e: SLOAD 00000d9f: PUSH1 0x02 00000da1: SWAP1 00000da2: PUSH2 0x0100 00000da5: DUP2 00000da6: LT 00000da7: ISZERO 00000da8: PUSH2 0x0002 00000dab: JUMPI 00000dac: ADD 00000dad: SLOAD 00000dae: PUSH1 0x00 00000db0: EQ 00000db1: JUMPDEST 00000db2: ISZERO 00000db3: PUSH2 0x0dc5 00000db6: JUMPI 00000db7: PUSH1 0x01 00000db9: DUP1 00000dba: SLOAD 00000dbb: PUSH1 0x00 00000dbd: NOT 00000dbe: ADD 00000dbf: SWAP1 00000dc0: SSTORE 00000dc1: PUSH2 0x0d8f 00000dc4: JUMP 00000dc5: JUMPDEST 00000dc6: PUSH1 0x01 00000dc8: SLOAD 00000dc9: DUP2 00000dca: LT 00000dcb: DUP1 00000dcc: ISZERO 00000dcd: PUSH2 0x0de8 00000dd0: JUMPI 00000dd1: POP 00000dd2: PUSH1 0x01 00000dd4: SLOAD 00000dd5: PUSH1 0x02 00000dd7: SWAP1 00000dd8: PUSH2 0x0100 00000ddb: DUP2 00000ddc: LT 00000ddd: ISZERO 00000dde: PUSH2 0x0002 00000de1: JUMPI 00000de2: ADD 00000de3: SLOAD 00000de4: PUSH1 0x00 00000de6: EQ 00000de7: ISZERO 00000de8: JUMPDEST 00000de9: DUP1 00000dea: ISZERO 00000deb: PUSH2 0x0e02 00000dee: JUMPI 00000def: POP 00000df0: PUSH1 0x02 00000df2: DUP2 00000df3: PUSH2 0x0100 00000df6: DUP2 00000df7: LT 00000df8: ISZERO 00000df9: PUSH2 0x0002 00000dfc: JUMPI 00000dfd: ADD 00000dfe: SLOAD 00000dff: PUSH1 0x00 00000e01: EQ 00000e02: JUMPDEST 00000e03: ISZERO 00000e04: PUSH2 0x0e63 00000e07: JUMPI 00000e08: PUSH1 0x01 00000e0a: SLOAD 00000e0b: PUSH1 0x02 00000e0d: SWAP1 00000e0e: PUSH2 0x0100 00000e11: DUP2 00000e12: LT 00000e13: ISZERO 00000e14: PUSH2 0x0002 00000e17: JUMPI 00000e18: DUP2 00000e19: ADD 00000e1a: SLOAD 00000e1b: SWAP1 00000e1c: DUP3 00000e1d: PUSH2 0x0100 00000e20: DUP2 00000e21: LT 00000e22: ISZERO 00000e23: PUSH2 0x0002 00000e26: JUMPI 00000e27: DUP2 00000e28: ADD 00000e29: SWAP2 00000e2a: SWAP1 00000e2b: SWAP2 00000e2c: SSTORE 00000e2d: DUP2 00000e2e: SWAP1 00000e2f: PUSH2 0x0102 00000e32: SWAP1 00000e33: PUSH1 0x00 00000e35: SWAP1 00000e36: DUP4 00000e37: PUSH2 0x0100 00000e3a: DUP2 00000e3b: LT 00000e3c: ISZERO 00000e3d: PUSH2 0x0002 00000e40: JUMPI 00000e41: DUP2 00000e42: ADD 00000e43: SLOAD 00000e44: DUP3 00000e45: MSTORE 00000e46: PUSH1 0x20 00000e48: SWAP3 00000e49: SWAP1 00000e4a: SWAP3 00000e4b: MSTORE 00000e4c: PUSH1 0x40 00000e4e: DUP2 00000e4f: KECCAK256 00000e50: SWAP3 00000e51: SWAP1 00000e52: SWAP3 00000e53: SSTORE 00000e54: PUSH1 0x01 00000e56: SLOAD 00000e57: PUSH2 0x0100 00000e5a: DUP2 00000e5b: LT 00000e5c: ISZERO 00000e5d: PUSH2 0x0002 00000e60: JUMPI 00000e61: ADD 00000e62: SSTORE 00000e63: JUMPDEST 00000e64: PUSH2 0x0680 00000e67: JUMP 00000e68: JUMPDEST 00000e69: ISZERO 00000e6a: PUSH2 0x0194 00000e6d: JUMPI 00000e6e: PUSH2 0x0107 00000e71: SLOAD 00000e72: PUSH2 0x0e7e 00000e75: JUMPDEST 00000e76: PUSH3 0x015180 00000e7a: TIMESTAMP 00000e7b: DIV 00000e7c: SWAP1 00000e7d: JUMP 00000e7e: JUMPDEST 00000e7f: GT 00000e80: ISZERO 00000e81: PUSH2 0x0e97 00000e84: JUMPI 00000e85: PUSH1 0x00 00000e87: PUSH2 0x0106 00000e8a: SSTORE 00000e8b: PUSH2 0x0e92 00000e8e: PUSH2 0x0e75 00000e91: JUMP 00000e92: JUMPDEST 00000e93: PUSH2 0x0107 00000e96: SSTORE 00000e97: JUMPDEST 00000e98: PUSH2 0x0106 00000e9b: SLOAD 00000e9c: DUP1 00000e9d: DUP4 00000e9e: ADD 00000e9f: LT 00000ea0: DUP1 00000ea1: ISZERO 00000ea2: SWAP1 00000ea3: PUSH2 0x0eb5 00000ea6: JUMPI 00000ea7: POP 00000ea8: PUSH2 0x0106 00000eab: SLOAD 00000eac: PUSH2 0x0105 00000eaf: SLOAD 00000eb0: SWAP1 00000eb1: DUP4 00000eb2: ADD 00000eb3: GT 00000eb4: ISZERO 00000eb5: JUMPDEST 00000eb6: ISZERO 00000eb7: PUSH2 0x0ecb 00000eba: JUMPI 00000ebb: POP 00000ebc: PUSH2 0x0106 00000ebf: DUP1 00000ec0: SLOAD 00000ec1: DUP3 00000ec2: ADD 00000ec3: SWAP1 00000ec4: SSTORE 00000ec5: PUSH1 0x01 00000ec7: PUSH2 0x0194 00000eca: JUMP 00000ecb: JUMPDEST 00000ecc: POP 00000ecd: PUSH1 0x00 00000ecf: PUSH2 0x0194 00000ed2: JUMP 00000ed3: JUMPDEST 00000ed4: PUSH2 0x062b 00000ed7: PUSH2 0x0104 00000eda: SLOAD 00000edb: PUSH1 0x00 00000edd: JUMPDEST 00000ede: DUP2 00000edf: DUP2 00000ee0: LT 00000ee1: ISZERO 00000ee2: PUSH2 0x0f63 00000ee5: JUMPI 00000ee6: PUSH2 0x0104 00000ee9: DUP1 00000eea: SLOAD 00000eeb: DUP3 00000eec: SWAP1 00000eed: DUP2 00000eee: LT 00000eef: ISZERO 00000ef0: PUSH2 0x0002 00000ef3: JUMPI 00000ef4: PUSH1 0x00 00000ef6: SWAP2 00000ef7: DUP3 00000ef8: MSTORE 00000ef9: PUSH1 0x00 00000efb: DUP1 00000efc: MLOAD 00000efd: PUSH1 0x20 00000eff: PUSH2 0x0f8e 00000f02: DUP4 00000f03: CODECOPY 00000f04: DUP2 00000f05: MLOAD 00000f06: SWAP2 00000f07: MSTORE 00000f08: ADD 00000f09: SLOAD 00000f0a: EQ 00000f0b: PUSH2 0x0f50 00000f0e: JUMPI 00000f0f: PUSH2 0x0104 00000f12: DUP1 00000f13: SLOAD 00000f14: PUSH2 0x0103 00000f17: SWAP2 00000f18: PUSH1 0x00 00000f1a: SWAP2 00000f1b: DUP5 00000f1c: SWAP1 00000f1d: DUP2 00000f1e: LT 00000f1f: ISZERO 00000f20: PUSH2 0x0002 00000f23: JUMPI 00000f24: PUSH1 0x00 00000f26: DUP1 00000f27: MLOAD 00000f28: PUSH1 0x20 00000f2a: PUSH2 0x0f8e 00000f2d: DUP4 00000f2e: CODECOPY 00000f2f: DUP2 00000f30: MLOAD 00000f31: SWAP2 00000f32: MSTORE 00000f33: ADD 00000f34: SLOAD 00000f35: DUP3 00000f36: MSTORE 00000f37: POP 00000f38: PUSH1 0x20 00000f3a: SWAP2 00000f3b: SWAP1 00000f3c: SWAP2 00000f3d: MSTORE 00000f3e: PUSH1 0x40 00000f40: DUP2 00000f41: KECCAK256 00000f42: DUP2 00000f43: DUP2 00000f44: SSTORE 00000f45: PUSH1 0x01 00000f47: DUP2 00000f48: ADD 00000f49: DUP3 00000f4a: SWAP1 00000f4b: SSTORE 00000f4c: PUSH1 0x02 00000f4e: ADD 00000f4f: SSTORE 00000f50: JUMPDEST 00000f51: PUSH1 0x01 00000f53: ADD 00000f54: PUSH2 0x0edd 00000f57: JUMP 00000f58: JUMPDEST 00000f59: POP 00000f5a: POP 00000f5b: POP 00000f5c: PUSH1 0x01 00000f5e: ADD 00000f5f: PUSH2 0x051e 00000f62: JUMP 00000f63: JUMPDEST 00000f64: PUSH2 0x0104 00000f67: DUP1 00000f68: SLOAD 00000f69: PUSH1 0x00 00000f6b: DUP1 00000f6c: DUP4 00000f6d: SSTORE 00000f6e: SWAP2 00000f6f: SWAP1 00000f70: SWAP2 00000f71: MSTORE 00000f72: PUSH2 0x04cc 00000f75: SWAP1 00000f76: PUSH1 0x00 00000f78: DUP1 00000f79: MLOAD 00000f7a: PUSH1 0x20 00000f7c: PUSH2 0x0f8e 00000f7f: DUP4 00000f80: CODECOPY 00000f81: DUP2 00000f82: MLOAD 00000f83: SWAP2 00000f84: MSTORE 00000f85: SWAP1 00000f86: DUP2 00000f87: ADD 00000f88: SWAP1 00000f89: PUSH2 0x0a54 00000f8c: JUMP 00000f8d: STOP 00000f8e: UNKNOWN(0x4C) 00000f8f: SIGNEXTEND 00000f90: UNKNOWN(0xE6) 00000f91: MUL 00000f92: STOP 00000f93: STATICCALL 00000f94: LOG2 00000f95: SDIV 00000f96: MSIZE 00000f97: ADDRESS 00000f98: DUP13 00000f99: UNKNOWN(0xB7) 00000f9a: UNKNOWN(0xB5) 00000f9b: LOG1 00000f9c: UNKNOWN(0xBB) 00000f9d: ORIGIN 00000f9e: SSTORE 00000f9f: UNKNOWN(0xC1) 00000fa0: PUSH13 0xb1cab91f525b5ae7a03d02fabe
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | other | cast | SELFDESTRUCT present | 85 | no | — |
viewevidence_json{
"notes": "selfdestruct can remove contract code and send funds; review reachability",
"selfdestruct_count": 1
}
|
| high | auth | detector | Authorization based on tx.origin | 70 | no | — |
viewvalidation_json{
"reason": "missing sink mapping",
"status": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x173825d9",
"selector": "0x173825d9",
"calldata_variants": [
"0x173825d9",
"0x173825d90000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x2f54bf6e",
"selector": "0x2f54bf6e",
"calldata_variants": [
"0x2f54bf6e",
"0x2f54bf6e0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4123cb6b",
"selector": "0x4123cb6b",
"calldata_variants": [
"0x4123cb6b",
"0x4123cb6b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x54fd4d50",
"selector": "0x54fd4d50",
"calldata_variants": [
"0x54fd4d50",
"0x54fd4d500000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5c52c2f5",
"selector": "0x5c52c2f5",
"calldata_variants": [
"0x5c52c2f5",
"0x5c52c2f50000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7065cb48",
"selector": "0x7065cb48",
"calldata_variants": [
"0x7065cb48",
"0x7065cb480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x746c9171",
"selector": "0x746c9171",
"calldata_variants": [
"0x746c9171",
"0x746c91710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x797af627",
"selector": "0x797af627",
"calldata_variants": [
"0x797af627",
"0x797af6270000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"guards_detected": [
{
"pc": 221,
"type": "tx_origin_used"
},
{
"pc": 337,
"type": "tx_origin_used"
},
{
"pc": 640,
"type": "tx_origin_used"
},
{
"pc": 660,
"type": "tx_origin_used"
},
{
"pc": 1038,
"type": "tx_origin_used"
},
{
"pc": 2103,
"type": "tx_origin_used"
},
{
"pc": 2147,
"type": "tx_origin_used"
},
{
"pc": 2531,
"type": "tx_origin_used"
},
{
"pc": 2858,
"type": "tx_origin_used"
},
{
"pc": 3289,
"type": "tx_origin_used"
},
{
"pc": 3997,
"type": "tx_origin_used"
}
]
}
|
| medium | other | detector | Untrusted CALL target/value reachable | 45 | no | no |
viewtrace_id: 0x0234a9af2f6972a5f9ef23be3282f3a5adb81cf520144e1d366fd5f65c518a32
call_targets:
0xfe8ad7dd2f564a877cc23feea6c0a9cc2e783715
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x0234a9af2f6972a5f9ef23be3282f3a5adb81cf520144e1d366fd5f65c518a32",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xfe8ad7dd2f564a877cc23feea6c0a9cc2e783715"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x173825d9",
"selector": "0x173825d9",
"calldata_variants": [
"0x173825d9",
"0x173825d90000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x2f54bf6e",
"selector": "0x2f54bf6e",
"calldata_variants": [
"0x2f54bf6e",
"0x2f54bf6e0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4123cb6b",
"selector": "0x4123cb6b",
"calldata_variants": [
"0x4123cb6b",
"0x4123cb6b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x54fd4d50",
"selector": "0x54fd4d50",
"calldata_variants": [
"0x54fd4d50",
"0x54fd4d500000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5c52c2f5",
"selector": "0x5c52c2f5",
"calldata_variants": [
"0x5c52c2f5",
"0x5c52c2f50000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7065cb48",
"selector": "0x7065cb48",
"calldata_variants": [
"0x7065cb48",
"0x7065cb480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x746c9171",
"selector": "0x746c9171",
"calldata_variants": [
"0x746c9171",
"0x746c91710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x797af627",
"selector": "0x797af627",
"calldata_variants": [
"0x797af627",
"0x797af6270000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 2282,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 2818,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 2,
"guards_detected": [
{
"pc": 221,
"type": "tx_origin_used"
},
{
"pc": 337,
"type": "tx_origin_used"
},
{
"pc": 640,
"type": "tx_origin_used"
},
{
"pc": 660,
"type": "tx_origin_used"
},
{
"pc": 1038,
"type": "tx_origin_used"
},
{
"pc": 2103,
"type": "tx_origin_used"
},
{
"pc": 2147,
"type": "tx_origin_used"
},
{
"pc": 2531,
"type": "tx_origin_used"
},
{
"pc": 2858,
"type": "tx_origin_used"
},
{
"pc": 3289,
"type": "tx_origin_used"
},
{
"pc": 3997,
"type": "tx_origin_used"
}
],
"untrusted_call_count": 2
}
|
| medium | other | detector | ETH value transfer possible | 40 | no | no |
viewtrace_id: 0x0234a9af2f6972a5f9ef23be3282f3a5adb81cf520144e1d366fd5f65c518a32
call_targets:
0xfe8ad7dd2f564a877cc23feea6c0a9cc2e783715
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x0234a9af2f6972a5f9ef23be3282f3a5adb81cf520144e1d366fd5f65c518a32",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xfe8ad7dd2f564a877cc23feea6c0a9cc2e783715"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x173825d9",
"selector": "0x173825d9",
"calldata_variants": [
"0x173825d9",
"0x173825d90000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x2f54bf6e",
"selector": "0x2f54bf6e",
"calldata_variants": [
"0x2f54bf6e",
"0x2f54bf6e0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4123cb6b",
"selector": "0x4123cb6b",
"calldata_variants": [
"0x4123cb6b",
"0x4123cb6b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x54fd4d50",
"selector": "0x54fd4d50",
"calldata_variants": [
"0x54fd4d50",
"0x54fd4d500000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5c52c2f5",
"selector": "0x5c52c2f5",
"calldata_variants": [
"0x5c52c2f5",
"0x5c52c2f50000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7065cb48",
"selector": "0x7065cb48",
"calldata_variants": [
"0x7065cb48",
"0x7065cb480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x746c9171",
"selector": "0x746c9171",
"calldata_variants": [
"0x746c9171",
"0x746c91710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x797af627",
"selector": "0x797af627",
"calldata_variants": [
"0x797af627",
"0x797af6270000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 2282,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 2818,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 2,
"guards_detected": [
{
"pc": 221,
"type": "tx_origin_used"
},
{
"pc": 337,
"type": "tx_origin_used"
},
{
"pc": 640,
"type": "tx_origin_used"
},
{
"pc": 660,
"type": "tx_origin_used"
},
{
"pc": 1038,
"type": "tx_origin_used"
},
{
"pc": 2103,
"type": "tx_origin_used"
},
{
"pc": 2147,
"type": "tx_origin_used"
},
{
"pc": 2531,
"type": "tx_origin_used"
},
{
"pc": 2858,
"type": "tx_origin_used"
},
{
"pc": 3289,
"type": "tx_origin_used"
},
{
"pc": 3997,
"type": "tx_origin_used"
}
]
}
|
| medium | other | detector | SELFDESTRUCT reachable | 45 | no | no |
viewtrace_id: 0xeea7791e0db9cacdb322752888b4926806d664982767b898368eddcd1ad64528
validation_json{
"sink": "SELFDESTRUCT",
"errors": 0,
"status": "unknown",
"attempts": 32,
"trace_id": "0xeea7791e0db9cacdb322752888b4926806d664982767b898368eddcd1ad64528",
"confirmed": false,
"trace_mode": "structLogs",
"call_targets": null,
"matched_probe": null,
"target_varies": null,
"classification": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x173825d9",
"selector": "0x173825d9",
"calldata_variants": [
"0x173825d9",
"0x173825d90000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x2f54bf6e",
"selector": "0x2f54bf6e",
"calldata_variants": [
"0x2f54bf6e",
"0x2f54bf6e0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x4123cb6b",
"selector": "0x4123cb6b",
"calldata_variants": [
"0x4123cb6b",
"0x4123cb6b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x54fd4d50",
"selector": "0x54fd4d50",
"calldata_variants": [
"0x54fd4d50",
"0x54fd4d500000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5c52c2f5",
"selector": "0x5c52c2f5",
"calldata_variants": [
"0x5c52c2f5",
"0x5c52c2f50000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x7065cb48",
"selector": "0x7065cb48",
"calldata_variants": [
"0x7065cb48",
"0x7065cb480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x746c9171",
"selector": "0x746c9171",
"calldata_variants": [
"0x746c9171",
"0x746c91710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x797af627",
"selector": "0x797af627",
"calldata_variants": [
"0x797af627",
"0x797af6270000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"guards_detected": [
{
"pc": 221,
"type": "tx_origin_used"
},
{
"pc": 337,
"type": "tx_origin_used"
},
{
"pc": 640,
"type": "tx_origin_used"
},
{
"pc": 660,
"type": "tx_origin_used"
},
{
"pc": 1038,
"type": "tx_origin_used"
},
{
"pc": 2103,
"type": "tx_origin_used"
},
{
"pc": 2147,
"type": "tx_origin_used"
},
{
"pc": 2531,
"type": "tx_origin_used"
},
{
"pc": 2858,
"type": "tx_origin_used"
},
{
"pc": 3289,
"type": "tx_origin_used"
},
{
"pc": 3997,
"type": "tx_origin_used"
}
],
"selfdestruct_count": 1
}
|