TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

652411cd-74bd-48be-a958-76a4693d1922

complete
Chain ID
1
Address
0xf04dbe57bb13bbec98242bf763f74096bfec3279
Block Number
—
Created
Thu, Jan 1, 2026 2:28 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract
Confirmed
1
Validated
1
Source
Bytecode only
Review Backing
Not yet
Best current signal
Untrusted DELEGATECALL target reachable
crit 1 high 0 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
31040 report.consolidate complete 1 / 1 3 months ago
76054 artifact.fetch complete 1 / 3 1 week ago
76055 tool.cast_disasm complete 1 / 3 1 week ago
76056 analysis.bundle complete 1 / 3 1 week ago
76057 capability.graph complete 1 / 3 1 week ago
76058 detector.run complete 1 / 3 1 week ago
76059 validation.fork complete 1 / 3 1 week ago

Artifact

Runtime bytecode: available
Creation TX: —
Deployer: —
Proxy: no
Implementation:
—
Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate
Job Status
complete
Attempts
1 / 1
Findings
0
No findings?
yes
Summary
Read BYTECODE_BUNDLE.txt: runtime bytecode is a standard EIP-1967 beacon proxy (SLOAD beacon slot, STATICCALL implementation(), DELEGATECALL). The proxy itself exposes no direct value transfer or upgrade/write paths; exploitability would depend on the beacon/implementation bytecode which is not provided, so no concrete profit path can be shown from this bytecode alone.
View stderr 
[codex:1213070] OpenAI Codex v0.77.0 (research preview)
[codex:1213070] --------
[codex:1213070] workdir: /tmp/codex-multi-9yqbtvh7
[codex:1213070] model: gpt-5.2-codex
[codex:1213070] provider: openai
[codex:1213070] approval: never
[codex:1213070] sandbox: read-only
[codex:1213070] reasoning effort: xhigh
[codex:1213070] reasoning summaries: auto
[codex:1213070] session id: 019b79f4-37a2-7590-a3a8-8775d6a83020
[codex:1213070] --------
[codex:1213070] user
[codex:1213070] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:1213070] 
[codex:1213070] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:1213070] 
[codex:1213070] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:1213070] - Gas inefficiency, code quality, or best practices
[codex:1213070] - Theoretical vulnerabilities without a clear extraction path
[codex:1213070] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:1213070] - Issues requiring social engineering or off-chain coordination
[codex:1213070] 
[codex:1213070] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:1213070] - CALL/DELEGATECALL with controllable destination or calldata
[codex:1213070] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:1213070] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:1213070] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:1213070] - External calls before state updates (reentrancy)
[codex:1213070] - SELFDESTRUCT with controllable beneficiary
[codex:1213070] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:1213070] 
[codex:1213070] For each finding, you MUST explain:
[codex:1213070] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:1213070] 2. The concrete sequence of transactions to extract value
[codex:1213070] 3. Why you believe this is exploitable (not just suspicious)
[codex:1213070] 
[codex:1213070] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:1213070] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:1213070] 
[codex:1213070] Output MUST be valid JSON matching the provided schema.
[codex:1213070] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:1213070] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:1213070] mcp startup: no servers
[codex:1213070] 
[codex:1213070] thinking
[codex:1213070] **Preparing to read BYTECODE_BUNDLE.txt**
[codex:1213070] exec
[codex:1213070] /bin/bash -lc ls in /tmp/codex-multi-9yqbtvh7 succeeded in 6ms:
[codex:1213070] BYTECODE_BUNDLE.txt
[codex:1213070] codex-output-schema.json
[codex:1213070] 
[codex:1213070] thinking
[codex:1213070] **Reading file contents**
[codex:1213070] exec
[codex:1213070] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-9yqbtvh7 succeeded in 5ms:
[codex:1213070] Runtime bytecode bundle for best-effort auditing.
[codex:1213070] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:1213070] 
[codex:1213070] FILE: runtime_bytecode.hex
[codex:1213070] 0x363d3d373d3d363d602036600436635c60da1b60e01b36527fa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50545afa5036515af43d6000803e604d573d6000fd5b3d6000f3
[codex:1213070] 
[codex:1213070] thinking
[codex:1213070] **Analyzing minimal proxy bytecode**
[codex:1213070] exec
[codex:1213070] /bin/bash -lc "python - <<'PY'
[codex:1213070] code='363d3d373d3d363d602036600436635c60da1b60e01b36527fa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50545afa5036515af43d6000803e604d573d6000fd5b3d6000f3'
[codex:1213070] # simple disassemble
[codex:1213070] ops={
[codex:1213070]     0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:1213070]     0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:1213070]     0x20:'SHA3',
[codex:1213070]     0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:1213070]     0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:1213070]     0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:1213070]     0x5f:'PUSH0',
[codex:1213070]     0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:1213070]     0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:1213070]     0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:1213070]     0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:1213070]     0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:1213070] }
[codex:1213070] 
[codex:1213070] i=0
[codex:1213070] while i<len(code):
[codex:1213070]     op=int(code[i:i+2],16)
[codex:1213070]     name=ops.get(op,'?')
[codex:1213070]     i+=2
[codex:1213070]     if name.startswith('PUSH'):
[codex:1213070]         n=int(name[4:])
[codex:1213070]         data=code[i:i+2*n]
[codex:1213070]         i+=2*n
[codex:1213070]         print(f\"{i//2-1-n:04x}: {name} 0x{data}\")
[codex:1213070]     else:
[codex:1213070]         print(f\"{i//2-1:04x}: {name}\")
[codex:1213070] PY" in /tmp/codex-multi-9yqbtvh7 succeeded in 18ms:
[codex:1213070] 0000: CALLDATASIZE
[codex:1213070] 0001: RETURNDATASIZE
[codex:1213070] 0002: RETURNDATASIZE
[codex:1213070] 0003: CALLDATACOPY
[codex:1213070] 0004: RETURNDATASIZE
[codex:1213070] 0005: RETURNDATASIZE
[codex:1213070] 0006: CALLDATASIZE
[codex:1213070] 0007: RETURNDATASIZE
[codex:1213070] 0008: PUSH1 0x20
[codex:1213070] 000a: CALLDATASIZE
[codex:1213070] 000b: PUSH1 0x04
[codex:1213070] 000d: CALLDATASIZE
[codex:1213070] 000e: PUSH4 0x5c60da1b
[codex:1213070] 0013: PUSH1 0xe0
[codex:1213070] 0015: SHL
[codex:1213070] 0016: CALLDATASIZE
[codex:1213070] 0017: MSTORE
[codex:1213070] 0018: PUSH32 0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50
[codex:1213070] 0039: SLOAD
[codex:1213070] 003a: GAS
[codex:1213070] 
[codex:1213070] thinking
[codex:1213070] **Analyzing beacon proxy bytecode and exploitability**
[codex:1213070] 
[codex:1213070] I'm carefully stepping through the bytecode of a contract that implements an EIP-1967 beacon proxy pattern. It copies calldata, reads a beacon address from a specific storage slot, staticcalls its implementation() function, and delegates calls to that implementation. Since upgrades happen via the beacon contract, and the proxy itself has no direct upgrade mechanism or access control issues visible here, I find no concrete exploitation paths directly in the proxy code. I'll produce a JSON report indicating no findings and include a clear summary reflecting this analysis.
[codex:1213070] codex
[codex:1213070] {"no_findings":true,"summary":"Read BYTECODE_BUNDLE.txt: runtime bytecode is a standard EIP-1967 beacon proxy (SLOAD beacon slot, STATICCALL implementation(), DELEGATECALL). The proxy itself exposes no direct value transfer or upgrade/write paths; exploitability would depend on the beacon/implementation bytecode which is not provided, so no concrete profit path can be shown from this bytecode alone.","findings":[]}
[codex:1213070] tokens used
[codex:1213070] 12,301
[codex:1213070] {"no_findings":true,"summary":"Read BYTECODE_BUNDLE.txt: runtime bytecode is a standard EIP-1967 beacon proxy (SLOAD beacon slot, STATICCALL implementation(), DELEGATECALL). The proxy itself exposes no direct value transfer or upgrade/write paths; exploitability would depend on the beacon/implementation bytecode which is not provided, so no concrete profit path can be shown from this bytecode alone.","findings":[]}
Metadata 
{
    "codex": {
        "ran_at": "2026-01-01T14:28:16.321642+00:00",
        "returncode": 0
    },
    "summary": "Read BYTECODE_BUNDLE.txt: runtime bytecode is a standard EIP-1967 beacon proxy (SLOAD beacon slot, STATICCALL implementation(), DELEGATECALL). The proxy itself exposes no direct value transfer or upgrade/write paths; exploitability would depend on the beacon/implementation bytecode which is not provided, so no concrete profit path can be shown from this bytecode alone.",
    "raw_final": {
        "summary": "Read BYTECODE_BUNDLE.txt: runtime bytecode is a standard EIP-1967 beacon proxy (SLOAD beacon slot, STATICCALL implementation(), DELEGATECALL). The proxy itself exposes no direct value transfer or upgrade/write paths; exploitability would depend on the beacon/implementation bytecode which is not provided, so no concrete profit path can be shown from this bytecode alone.",
        "findings": [],
        "no_findings": true
    },
    "no_findings": true,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
1
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
1
EXT*/BALANCE
0
Total opcodes
39
Flags
delegatecall_present proxy_like_runtime
View cast disassembly output 
00000000: CALLDATASIZE
00000001: RETURNDATASIZE
00000002: RETURNDATASIZE
00000003: CALLDATACOPY
00000004: RETURNDATASIZE
00000005: RETURNDATASIZE
00000006: CALLDATASIZE
00000007: RETURNDATASIZE
00000008: PUSH1 0x20
0000000a: CALLDATASIZE
0000000b: PUSH1 0x04
0000000d: CALLDATASIZE
0000000e: PUSH4 0x5c60da1b
00000013: PUSH1 0xe0
00000015: SHL
00000016: CALLDATASIZE
00000017: MSTORE
00000018: PUSH32 0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50
00000039: SLOAD
0000003a: GAS
0000003b: STATICCALL
0000003c: POP
0000003d: CALLDATASIZE
0000003e: MLOAD
0000003f: GAS
00000040: DELEGATECALL
00000041: RETURNDATASIZE
00000042: PUSH1 0x00
00000044: DUP1
00000045: RETURNDATACOPY
00000046: PUSH1 0x4d
00000048: JUMPI
00000049: RETURNDATASIZE
0000004a: PUSH1 0x00
0000004c: REVERT
0000004d: JUMPDEST
0000004e: RETURNDATASIZE
0000004f: PUSH1 0x00
00000051: RETURN

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
critical upgradeability detector Untrusted DELEGATECALL target reachable 70 yes yes
view
trace_id: 0x9fabcf5030d533d800d16c7c7d9d6eb939d58352e337ff897c0a1aa6cc91fca9
call_targets: 0x01ba5212201a26c9a212f4261e49e7e0b5d61479, 0x8827bb399ae88f357abdde3643db875436d6043a
target_varies: yes
classification: target_varies
validation_json 
{
    "sink": "DELEGATECALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0x9fabcf5030d533d800d16c7c7d9d6eb939d58352e337ff897c0a1aa6cc91fca9",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x01ba5212201a26c9a212f4261e49e7e0b5d61479",
        "0x8827bb399ae88f357abdde3643db875436d6043a"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x",
            "selector": "fallback",
            "calldata_variants": [
                "0x"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 64,
            "opcode": "DELEGATECALL",
            "returndata_checked": null,
            "value_expression_category": "n/a",
            "target_expression_category": "computed"
        }
    ],
    "guards_detected": [],
    "delegatecall_count": 1,
    "untrusted_delegatecall_count": 1
}
medium upgradeability cast DELEGATECALL present 80 no —
view
evidence_json 
{
    "notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
    "delegatecall_count": 1
}
info upgradeability cast Likely proxy-like runtime 60 no —
view
evidence_json 
{
    "notes": "short runtime with SLOAD and DELEGATECALL resembles minimal proxy/upgradeable pattern",
    "sload_count": 1,
    "total_opcodes": 39,
    "delegatecall_count": 1
}