TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

80a4c5c7-faeb-42b9-b911-9e6dcc348d66

failed
Chain ID
1
Address
0x1e143b2588705dfea63a17f2032ca123df995ce0
Block Number
—
Created
Thu, Jan 1, 2026 3:59 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract
Confirmed
2
Validated
2
Source
Verified
Review Backing
Not yet
Best current signal
Untrusted CALL target/value reachable
crit 0 high 2 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
31072 report.consolidate complete 1 / 1 3 months ago
76246 artifact.fetch failed 1 / 3 1 week ago
76247 tool.cast_disasm complete 1 / 3 1 week ago
76248 analysis.bundle complete 1 / 3 1 week ago
76249 capability.graph complete 1 / 3 1 week ago
76250 detector.run complete 1 / 3 1 week ago
76251 validation.fork complete 1 / 3 1 week ago
113562 tool.slither failed 2 / 2 1 week ago

Artifact

Runtime bytecode: available
Creation TX: —
Deployer: —
Proxy: no
Implementation:
—
Verified Source: yes

Slither

tool.slither
Status
failed solc version 0.3.5 is too old for supported toolchain
Attempts
2 / 2
Findings
0
Solc
—
View stderr 
Traceback (most recent call last):
  File "/var/www/tripwire/worker/worker.py", line 198, in main
    payload = dispatch_job(job_type, job_id, job_meta, run_data, config, laravel_client)
  File "/var/www/tripwire/worker/worker.py", line 114, in dispatch_job
    return slither_run.run(job_id, job_meta, run_data, config, log, laravel_client)
           ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/www/tripwire/worker/jobs/slither_run.py", line 1056, in run
    solc_path, solc_meta = _prepare_solc(chosen_version, workspace)
                           ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/www/tripwire/worker/jobs/slither_run.py", line 190, in _prepare_solc
    raise RuntimeError(f"solc version {default_version} is too old for supported toolchain")
RuntimeError: solc version 0.3.5 is too old for supported toolchain

Codex

report.consolidate
Job Status
complete
Attempts
1 / 1
Findings
0
No findings?
yes
Summary
No concrete, exploitable profit path found; functions only forward msg.value and do not expose contract-held balance.
View stderr 
[codex:8917] OpenAI Codex v0.77.0 (research preview)
[codex:8917] --------
[codex:8917] workdir: /tmp/codex-multi-y2ama317
[codex:8917] model: gpt-5.2-codex
[codex:8917] provider: openai
[codex:8917] approval: never
[codex:8917] sandbox: read-only
[codex:8917] reasoning effort: xhigh
[codex:8917] reasoning summaries: auto
[codex:8917] session id: 019b7a48-b384-77d3-8b08-4ae9c351e7e9
[codex:8917] --------
[codex:8917] user
[codex:8917] You are a profit-focused exploit hunter. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:8917] 
[codex:8917] Read `AUDIT_BUNDLE.txt` completely before concluding. Treat `lib/` and `@openzeppelin/` as trusted unless misused.
[codex:8917] 
[codex:8917] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:8917] - Gas inefficiency, code quality, naming, or best practices
[codex:8917] - Theoretical vulnerabilities without a clear extraction path
[codex:8917] - Centralization risks (admin can rug) - assume admin keys are secure
[codex:8917] - Front-running unless it enables theft beyond MEV
[codex:8917] - DoS, griefing, or issues that don't result in attacker profit
[codex:8917] - Missing events, view function issues, or informational findings
[codex:8917] 
[codex:8917] HIGH-VALUE PATTERNS TO HUNT:
[codex:8917] - Reentrancy: external calls before state updates that allow double-withdrawal
[codex:8917] - Access control: missing/bypassable auth on withdraw, transfer, or mint functions
[codex:8917] - Flash loan attacks: borrow -> manipulate -> profit in single tx
[codex:8917] - Price oracle manipulation: TWAP with short window, spot price reads, stale prices
[codex:8917] - Signature replay: missing nonce, chainId, or deadline in permit/meta-tx
[codex:8917] - Proxy hijacking: unprotected initialize(), storage collision, UUPS without auth
[codex:8917] - Accounting errors: rounding that favors attacker, share inflation, first depositor attacks
[codex:8917] - Unchecked external calls: return value ignored on token transfers enabling fake tokens
[codex:8917] - Cross-function reentrancy: state read in function A, modified via reentrant call, used stale in A
[codex:8917] 
[codex:8917] For each finding, you MUST provide:
[codex:8917] 1. Exact file and line numbers of vulnerable code
[codex:8917] 2. Step-by-step exploit transaction sequence
[codex:8917] 3. Estimated profit potential (order of magnitude: contract balance, LP reserves, etc.)
[codex:8917] 
[codex:8917] If no concrete profit path exists: set no_findings=true. Do NOT pad with low-severity noise.
[codex:8917] 
[codex:8917] Output MUST be valid JSON matching the provided schema.
[codex:8917] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:8917] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:8917] mcp startup: no servers
[codex:8917] 
[codex:8917] thinking
[codex:8917] **Reading AUDIT_BUNDLE instructions**
[codex:8917] exec
[codex:8917] /bin/bash -lc ls in /tmp/codex-multi-y2ama317 succeeded in 6ms:
[codex:8917] AUDIT_BUNDLE.txt
[codex:8917] codex-output-schema.json
[codex:8917] contracts
[codex:8917] exec
[codex:8917] /bin/bash -lc "sed -n '1,200p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-y2ama317 succeeded in 5ms:
[codex:8917] This file concatenates first-party Solidity sources only (lib/@openzeppelin excluded).
[codex:8917] 
[codex:8917] ================================================================================
[codex:8917] FILE: contracts/Contract.sol
[codex:8917] ================================================================================
[codex:8917] contract ClassicCheck {
[codex:8917]        function isClassic() constant returns (bool isClassic);
[codex:8917] }
[codex:8917] 
[codex:8917] contract SafeConditionalHFTransfer {
[codex:8917] 
[codex:8917]     bool classic;
[codex:8917]     
[codex:8917]     function SafeConditionalHFTransfer() {
[codex:8917]         classic = ClassicCheck(0x882fb4240f9a11e197923d0507de9a983ed69239).isClassic();
[codex:8917]     }
[codex:8917]     
[codex:8917]     function classicTransfer(address to) {
[codex:8917]         if (!classic) 
[codex:8917]             msg.sender.send(msg.value);
[codex:8917] 
[codex:8917] thinking
[codex:8917] **Assessing exploitability and profit potential**
[codex:8917] codex
[codex:8917] {"no_findings":true,"summary":"No concrete, exploitable profit path found; functions only forward msg.value and do not expose contract-held balance.","findings":[]}
[codex:8917] tokens used
[codex:8917] 5,657
[codex:8917] {"no_findings":true,"summary":"No concrete, exploitable profit path found; functions only forward msg.value and do not expose contract-held balance.","findings":[]}
Metadata 
{
    "codex": {
        "ran_at": "2026-01-01T15:59:17.383377+00:00",
        "returncode": 0
    },
    "summary": "No concrete, exploitable profit path found; functions only forward msg.value and do not expose contract-held balance.",
    "raw_final": {
        "summary": "No concrete, exploitable profit path found; functions only forward msg.value and do not expose contract-held balance.",
        "findings": [],
        "no_findings": true
    },
    "no_findings": true,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
0
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
4
EXT*/BALANCE
0
Total opcodes
211
Flags
No heuristic flags raised.
View cast disassembly output 
00000000: PUSH1 0x60
00000002: PUSH1 0x40
00000004: MSTORE
00000005: PUSH1 0x00
00000007: CALLDATALOAD
00000008: PUSH29 0x0100000000000000000000000000000000000000000000000000000000
00000026: SWAP1
00000027: DIV
00000028: DUP1
00000029: PUSH4 0x1a695230
0000002e: EQ
0000002f: PUSH2 0x0044
00000032: JUMPI
00000033: DUP1
00000034: PUSH4 0x565a2ecf
00000039: EQ
0000003a: PUSH2 0x005c
0000003d: JUMPI
0000003e: PUSH2 0x0042
00000041: JUMP
00000042: JUMPDEST
00000043: STOP
00000044: JUMPDEST
00000045: PUSH2 0x005a
00000048: PUSH1 0x04
0000004a: DUP1
0000004b: DUP1
0000004c: CALLDATALOAD
0000004d: SWAP1
0000004e: PUSH1 0x20
00000050: ADD
00000051: SWAP1
00000052: SWAP2
00000053: SWAP1
00000054: POP
00000055: POP
00000056: PUSH2 0x0074
00000059: JUMP
0000005a: JUMPDEST
0000005b: STOP
0000005c: JUMPDEST
0000005d: PUSH2 0x0072
00000060: PUSH1 0x04
00000062: DUP1
00000063: DUP1
00000064: CALLDATALOAD
00000065: SWAP1
00000066: PUSH1 0x20
00000068: ADD
00000069: SWAP1
0000006a: SWAP2
0000006b: SWAP1
0000006c: POP
0000006d: POP
0000006e: PUSH2 0x00f9
00000071: JUMP
00000072: JUMPDEST
00000073: STOP
00000074: JUMPDEST
00000075: PUSH1 0x00
00000077: PUSH1 0x00
00000079: SWAP1
0000007a: SLOAD
0000007b: SWAP1
0000007c: PUSH2 0x0100
0000007f: EXP
00000080: SWAP1
00000081: DIV
00000082: PUSH1 0xff
00000084: AND
00000085: ISZERO
00000086: PUSH2 0x00c1
00000089: JUMPI
0000008a: CALLER
0000008b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000a0: AND
000000a1: PUSH1 0x00
000000a3: CALLVALUE
000000a4: PUSH1 0x40
000000a6: MLOAD
000000a7: DUP1
000000a8: SWAP1
000000a9: POP
000000aa: PUSH1 0x00
000000ac: PUSH1 0x40
000000ae: MLOAD
000000af: DUP1
000000b0: DUP4
000000b1: SUB
000000b2: DUP2
000000b3: DUP6
000000b4: DUP9
000000b5: DUP9
000000b6: CALL
000000b7: SWAP4
000000b8: POP
000000b9: POP
000000ba: POP
000000bb: POP
000000bc: POP
000000bd: PUSH2 0x00f5
000000c0: JUMP
000000c1: JUMPDEST
000000c2: DUP1
000000c3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
000000d8: AND
000000d9: PUSH1 0x00
000000db: CALLVALUE
000000dc: PUSH1 0x40
000000de: MLOAD
000000df: DUP1
000000e0: SWAP1
000000e1: POP
000000e2: PUSH1 0x00
000000e4: PUSH1 0x40
000000e6: MLOAD
000000e7: DUP1
000000e8: DUP4
000000e9: SUB
000000ea: DUP2
000000eb: DUP6
000000ec: DUP9
000000ed: DUP9
000000ee: CALL
000000ef: SWAP4
000000f0: POP
000000f1: POP
000000f2: POP
000000f3: POP
000000f4: POP
000000f5: JUMPDEST
000000f6: JUMPDEST
000000f7: POP
000000f8: JUMP
000000f9: JUMPDEST
000000fa: PUSH1 0x00
000000fc: PUSH1 0x00
000000fe: SWAP1
000000ff: SLOAD
00000100: SWAP1
00000101: PUSH2 0x0100
00000104: EXP
00000105: SWAP1
00000106: DIV
00000107: PUSH1 0xff
00000109: AND
0000010a: ISZERO
0000010b: ISZERO
0000010c: PUSH2 0x0147
0000010f: JUMPI
00000110: CALLER
00000111: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
00000126: AND
00000127: PUSH1 0x00
00000129: CALLVALUE
0000012a: PUSH1 0x40
0000012c: MLOAD
0000012d: DUP1
0000012e: SWAP1
0000012f: POP
00000130: PUSH1 0x00
00000132: PUSH1 0x40
00000134: MLOAD
00000135: DUP1
00000136: DUP4
00000137: SUB
00000138: DUP2
00000139: DUP6
0000013a: DUP9
0000013b: DUP9
0000013c: CALL
0000013d: SWAP4
0000013e: POP
0000013f: POP
00000140: POP
00000141: POP
00000142: POP
00000143: PUSH2 0x017b
00000146: JUMP
00000147: JUMPDEST
00000148: DUP1
00000149: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
0000015e: AND
0000015f: PUSH1 0x00
00000161: CALLVALUE
00000162: PUSH1 0x40
00000164: MLOAD
00000165: DUP1
00000166: SWAP1
00000167: POP
00000168: PUSH1 0x00
0000016a: PUSH1 0x40
0000016c: MLOAD
0000016d: DUP1
0000016e: DUP4
0000016f: SUB
00000170: DUP2
00000171: DUP6
00000172: DUP9
00000173: DUP9
00000174: CALL
00000175: SWAP4
00000176: POP
00000177: POP
00000178: POP
00000179: POP
0000017a: POP
0000017b: JUMPDEST
0000017c: JUMPDEST
0000017d: POP
0000017e: JUMP

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
high other detector Untrusted CALL target/value reachable 60 yes yes
view
trace_id: 0x05e91b8d67b023d178676a4f9b1430b04411a5a3fc77cedd0e86a5a813618b8c
call_targets: 0x0000000000000000000000000000000000000000, 0x1e143b2588705dfea63a17f2032ca123df995ce0
target_varies: yes
classification: target_varies
validation_json 
{
    "sink": "CALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0x05e91b8d67b023d178676a4f9b1430b04411a5a3fc77cedd0e86a5a813618b8c",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x0000000000000000000000000000000000000000",
        "0x1e143b2588705dfea63a17f2032ca123df995ce0"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x1a695230",
            "selector": "0x1a695230",
            "calldata_variants": [
                "0x1a695230",
                "0x1a6952300000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x565a2ecf",
            "selector": "0x565a2ecf",
            "calldata_variants": [
                "0x565a2ecf",
                "0x565a2ecf0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 182,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 238,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 316,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "call_count": 4,
    "guards_detected": [],
    "untrusted_call_count": 4
}
high other detector ETH value transfer possible 55 yes yes
view
trace_id: 0x05e91b8d67b023d178676a4f9b1430b04411a5a3fc77cedd0e86a5a813618b8c
call_targets: 0x0000000000000000000000000000000000000000, 0x1e143b2588705dfea63a17f2032ca123df995ce0
target_varies: yes
classification: target_varies
validation_json 
{
    "sink": "CALL",
    "errors": 0,
    "status": "confirmed",
    "attempts": 1,
    "trace_id": "0x05e91b8d67b023d178676a4f9b1430b04411a5a3fc77cedd0e86a5a813618b8c",
    "confirmed": true,
    "trace_mode": "callTracer",
    "call_targets": [
        "0x0000000000000000000000000000000000000000",
        "0x1e143b2588705dfea63a17f2032ca123df995ce0"
    ],
    "matched_probe": null,
    "target_varies": true,
    "classification": "target_varies"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x1a695230",
            "selector": "0x1a695230",
            "calldata_variants": [
                "0x1a695230",
                "0x1a6952300000000000000000000000000000000000000000000000000000000000000000"
            ]
        },
        {
            "calldata": "0x565a2ecf",
            "selector": "0x565a2ecf",
            "calldata_variants": [
                "0x565a2ecf",
                "0x565a2ecf0000000000000000000000000000000000000000000000000000000000000000"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 182,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 238,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        },
        {
            "pc": 316,
            "opcode": "CALL",
            "returndata_checked": null,
            "value_expression_category": "computed",
            "target_expression_category": "computed"
        }
    ],
    "eth_value_calls": 4,
    "guards_detected": []
}