Analysis Run

77d05a5a-96cc-4851-93ca-4afdd2641fb1

failed

Chain ID

1

Address

0x9b340732d76513087bdbbc5965e5d6f9643f3857

Block Number

—

Created

Mon, Jan 5, 2026 2:04 AM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Verified

Review Backing

Not yet

Best current signal

Untrusted DELEGATECALL target reachable

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
31648	report.consolidate	complete	1 / 1	3 months ago
95311	artifact.fetch	failed	1 / 3	1 week ago
95312	tool.cast_disasm	complete	1 / 3	1 week ago
95313	analysis.bundle	complete	1 / 3	1 week ago
95314	capability.graph	complete	1 / 3	1 week ago
95315	detector.run	complete	1 / 3	1 week ago
95316	validation.fork	complete	1 / 3	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: yes

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

Job Status

complete

Attempts

1 / 1

Findings

0

No findings?

yes

Summary

No concrete, exploitable profit paths identified in the provided bundle.

View stderr

[codex:1269528] OpenAI Codex v0.77.0 (research preview)
[codex:1269528] --------
[codex:1269528] workdir: /tmp/codex-multi-fh0s9l9x
[codex:1269528] model: gpt-5.2-codex
[codex:1269528] provider: openai
[codex:1269528] approval: never
[codex:1269528] sandbox: read-only
[codex:1269528] reasoning effort: xhigh
[codex:1269528] reasoning summaries: auto
[codex:1269528] session id: 019b8be5-aa3e-73e3-a8dc-06086be1bcbf
[codex:1269528] --------
[codex:1269528] user
[codex:1269528] You are a profit-focused exploit hunter. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:1269528] 
[codex:1269528] Read `AUDIT_BUNDLE.txt` completely before concluding. Treat `lib/` and `@openzeppelin/` as trusted unless misused.
[codex:1269528] 
[codex:1269528] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:1269528] - Gas inefficiency, code quality, naming, or best practices
[codex:1269528] - Theoretical vulnerabilities without a clear extraction path
[codex:1269528] - Centralization risks (admin can rug) - assume admin keys are secure
[codex:1269528] - Front-running unless it enables theft beyond MEV
[codex:1269528] - DoS, griefing, or issues that don't result in attacker profit
[codex:1269528] - Missing events, view function issues, or informational findings
[codex:1269528] 
[codex:1269528] HIGH-VALUE PATTERNS TO HUNT:
[codex:1269528] - Reentrancy: external calls before state updates that allow double-withdrawal
[codex:1269528] - Access control: missing/bypassable auth on withdraw, transfer, or mint functions
[codex:1269528] - Flash loan attacks: borrow -> manipulate -> profit in single tx
[codex:1269528] - Price oracle manipulation: TWAP with short window, spot price reads, stale prices
[codex:1269528] - Signature replay: missing nonce, chainId, or deadline in permit/meta-tx
[codex:1269528] - Proxy hijacking: unprotected initialize(), storage collision, UUPS without auth
[codex:1269528] - Accounting errors: rounding that favors attacker, share inflation, first depositor attacks
[codex:1269528] - Unchecked external calls: return value ignored on token transfers enabling fake tokens
[codex:1269528] - Cross-function reentrancy: state read in function A, modified via reentrant call, used stale in A
[codex:1269528] 
[codex:1269528] For each finding, you MUST provide:
[codex:1269528] 1. Exact file and line numbers of vulnerable code
[codex:1269528] 2. Step-by-step exploit transaction sequence
[codex:1269528] 3. Estimated profit potential (order of magnitude: contract balance, LP reserves, etc.)
[codex:1269528] 
[codex:1269528] If no concrete profit path exists: set no_findings=true. Do NOT pad with low-severity noise.
[codex:1269528] 
[codex:1269528] Output MUST be valid JSON matching the provided schema.
[codex:1269528] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:1269528] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:1269528] mcp startup: no servers
[codex:1269528] 
[codex:1269528] thinking
[codex:1269528] **Preparing to read key files**
[codex:1269528] exec
[codex:1269528] /bin/bash -lc ls in /tmp/codex-multi-fh0s9l9x succeeded in 5ms:
[codex:1269528] AUDIT_BUNDLE.txt
[codex:1269528] codex-output-schema.json
[codex:1269528] contracts
[codex:1269528] exec
[codex:1269528] /bin/bash -lc "sed -n '1,200p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-fh0s9l9x succeeded in 5ms:
[codex:1269528] This file concatenates first-party Solidity sources only (lib/@openzeppelin excluded).
[codex:1269528] 
[codex:1269528] ================================================================================
[codex:1269528] FILE: contracts/src/interfaces/IERC165.sol
[codex:1269528] ================================================================================
[codex:1269528] // SPDX-License-Identifier: GPL-3.0-or-later
[codex:1269528] pragma solidity ^0.8.23;
[codex:1269528] 
[codex:1269528] interface IERC165 {
[codex:1269528]     /// @notice Checks if a contract implements an interface.
[codex:1269528]     /// @param interfaceId The interface identifier, as specified in ERC-165.
[codex:1269528]     /// @return supported True if the contract implements `interfaceId` and
[codex:1269528]     /// `interfaceId` is not 0xffffffff, false otherwise.
[codex:1269528]     function supportsInterface(bytes4 interfaceId) external view returns (bool supported);
[codex:1269528] }
[codex:1269528] 
[codex:1269528] ================================================================================
[codex:1269528] FILE: contracts/src/interfaces/IERC6909.sol
[codex:1269528] ================================================================================
[codex:1269528] // SPDX-License-Identifier: GPL-3.0-or-later
[codex:1269528] exec
[codex:1269528] /bin/bash -lc "sed -n '200,400p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-fh0s9l9x succeeded in 5ms:
[codex:1269528] 
[codex:1269528]         uint256 totalAllocation;
[codex:1269528]         for (uint256 i; i < numOfRecipients; ++i) {
[codex:1269528]             totalAllocation += _split.allocations[i];
[codex:1269528]         }
[codex:1269528] 
[codex:1269528]         if (totalAllocation != _split.totalAllocation) revert InvalidSplit_TotalAllocationMismatch();
[codex:1269528]     }
[codex:1269528] 
[codex:1269528]     function getDistributions(
[codex:1269528]         Split calldata _split,
[codex:1269528]         uint256 _amount
[codex:1269528]     )
[codex:1269528]         internal
[codex:1269528]         pure
[codex:1269528]         returns (uint256[] memory amounts, uint256 distributorReward)
[codex:1269528]     {
[codex:1269528]         uint256 numOfRecipients = _split.recipients.length;
[codex:1269528]         amounts = new uint256[](numOfRecipients);
[codex:1269528] 
[codex:1269528] exec
[codex:1269528] /bin/bash -lc "sed -n '400,800p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-fh0s9l9x succeeded in 5ms:
[codex:1269528] 
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528]     /*                             INTERNAL FUNCTIONS                             */
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528] 
[codex:1269528]     function getSigner() internal view override returns (address) {
[codex:1269528]         return owner;
[codex:1269528]     }
[codex:1269528] }
[codex:1269528] 
[codex:1269528] ================================================================================
[codex:1269528] FILE: contracts/src/splitters/pull/PullSplit.sol
[codex:1269528] ================================================================================
[codex:1269528] // SPDX-License-Identifier: GPL-3.0-or-later
[codex:1269528] pragma solidity ^0.8.23;
[codex:1269528] 
[codex:1269528] import { Cast } from "../../libraries/Cast.sol";
[codex:1269528] import { SplitV2Lib } from "../../libraries/SplitV2.sol";
[codex:1269528] import { SplitWalletV2 } from "../SplitWalletV2.sol";
[codex:1269528] 
[codex:1269528] exec
[codex:1269528] /bin/bash -lc "sed -n '800,1200p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-fh0s9l9x succeeded in 5ms:
[codex:1269528] 
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528]     /*                                   EVENTS                                   */
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528] 
[codex:1269528]     event ExecCalls(Call[] calls);
[codex:1269528] 
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528]     /*                          CONSTRUCTOR & INITIALIZER                         */
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528] 
[codex:1269528]     function __initWallet(address _owner) internal {
[codex:1269528]         __initPausable(_owner, false);
[codex:1269528]     }
[codex:1269528] 
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528]     /*                                  FUNCTONS                                  */
[codex:1269528]     /* -------------------------------------------------------------------------- */
[codex:1269528] 
[codex:1269528]     /**
[codex:1269528] 
[codex:1269528] thinking
[codex:1269528] **Assessing potential exploits**
[codex:1269528] 
[codex:1269528] I'm carefully checking the contract functions for any exploitable paths to profit, especially focusing on access control, distribution mechanics, and external calls. It seems no concrete profit exploits are present given the protections and intended incentives, so I'll prepare a clean JSON report indicating no findings with a concise summary.
[codex:1269528] codex
[codex:1269528] {"no_findings":true,"summary":"No concrete, exploitable profit paths identified in the provided bundle.","findings":[]}
[codex:1269528] tokens used
[codex:1269528] 12,733
[codex:1269528] {"no_findings":true,"summary":"No concrete, exploitable profit paths identified in the provided bundle.","findings":[]}

Metadata

{
    "codex": {
        "ran_at": "2026-01-05T02:04:21.925556+00:00",
        "returncode": 0
    },
    "summary": "No concrete, exploitable profit paths identified in the provided bundle.",
    "raw_final": {
        "summary": "No concrete, exploitable profit paths identified in the provided bundle.",
        "findings": [],
        "no_findings": true
    },
    "no_findings": true,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm

Delegatecall

1

Selfdestruct

0

CREATE2

0

CALL-family (heavy)

0

EXT*/BALANCE

0

Total opcodes

35

Flags

delegatecall_present

View cast disassembly output

00000000: CALLDATASIZE
00000001: PUSH1 0x2c
00000003: JUMPI
00000004: CALLVALUE
00000005: RETURNDATASIZE
00000006: MSTORE
00000007: PUSH32 0x9e4ac34f21c619cefc926c8bd93b54bf5a39c7ab2127a895af1cc0691d7e3dff
00000028: MSIZE
00000029: RETURNDATASIZE
0000002a: LOG1
0000002b: STOP
0000002c: JUMPDEST
0000002d: RETURNDATASIZE
0000002e: RETURNDATASIZE
0000002f: RETURNDATASIZE
00000030: RETURNDATASIZE
00000031: CALLDATASIZE
00000032: RETURNDATASIZE
00000033: RETURNDATASIZE
00000034: CALLDATACOPY
00000035: CALLDATASIZE
00000036: RETURNDATASIZE
00000037: PUSH20 0xf9c25250523df26343222fc46de932355b850c97
0000004c: GAS
0000004d: DELEGATECALL
0000004e: RETURNDATASIZE
0000004f: RETURNDATASIZE
00000050: SWAP4
00000051: DUP1
00000052: RETURNDATACOPY
00000053: PUSH1 0x57
00000055: JUMPI
00000056: REVERT
00000057: JUMPDEST
00000058: RETURN

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
critical	upgradeability	detector	Untrusted DELEGATECALL target reachable	70	no	no	view validation_json { "sink": "DELEGATECALL", "errors": 10, "status": "unknown", "attempts": 11, "confirmed": false, "trace_mode": "callTracer", "call_targets": null, "matched_probe": null, "target_varies": null, "classification": "no_sink" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x", "selector": "fallback", "calldata_variants": [ "0x" ] } ] } evidence_json { "examples": [ { "pc": 77, "opcode": "DELEGATECALL", "returndata_checked": null, "value_expression_category": "n/a", "target_expression_category": "computed" } ], "guards_detected": [], "delegatecall_count": 1, "untrusted_delegatecall_count": 1 }
medium	upgradeability	cast	DELEGATECALL present	80	no	—	view evidence_json { "notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns", "delegatecall_count": 1 }

Severity