b1775fcd-29cb-428f-a277-365169de370d
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 30341 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 74230 | artifact.fetch | complete | 1 / 3 | 1 week ago |
| 74231 | tool.cast_disasm | complete | 1 / 3 | 1 week ago |
| 74232 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 74233 | capability.graph | complete | 1 / 3 | 1 week ago |
| 74234 | detector.run | complete | 1 / 3 | 1 week ago |
| 74235 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
[codex:1496139] OpenAI Codex v0.77.0 (research preview)
[codex:1496139] --------
[codex:1496139] workdir: /tmp/codex-multi-8lt9lin6
[codex:1496139] model: gpt-5.2-codex
[codex:1496139] provider: openai
[codex:1496139] approval: never
[codex:1496139] sandbox: read-only
[codex:1496139] reasoning effort: xhigh
[codex:1496139] reasoning summaries: auto
[codex:1496139] session id: 019b6602-9fb6-79f2-a127-6f00e73dc93f
[codex:1496139] --------
[codex:1496139] user
[codex:1496139] You are a security auditor. Audit this Solidity codebase for exploitable vulnerabilities.
[codex:1496139] Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation, oracle manipulation,
[codex:1496139] accounting/invariant breaks, external call patterns, unchecked return values, and dangerous delegatecall.
[codex:1496139]
[codex:1496139] Scope rules:
[codex:1496139] - You MUST fully read `AUDIT_BUNDLE.txt` before concluding. It contains the complete contents of all first-party `contracts/**/*.sol` files.
[codex:1496139] - Treat `lib/` and `@openzeppelin/` as third-party dependencies; skip them unless there is a concrete misuse angle in first-party code.
[codex:1496139]
[codex:1496139] Output MUST be valid JSON matching the provided schema.
[codex:1496139] - If you find nothing meaningful: set no_findings=true and findings=[].
[codex:1496139] - Otherwise: set no_findings=false and include findings with severity/category/title and file/line locations when possible.
[codex:1496139]
[codex:1496139] Output constraints (IMPORTANT):
[codex:1496139] - severity MUST be exactly one of: info, low, medium, high, critical (lowercase).
[codex:1496139] - category MUST be exactly one of: access_control, reentrancy, math, oracle, upgradeability, auth, other.
[codex:1496139] mcp startup: no servers
[codex:1496139]
[codex:1496139] thinking
[codex:1496139] **Checking for available skills**
[codex:1496139] exec
[codex:1496139] /bin/bash -lc ls in /tmp/codex-multi-8lt9lin6 succeeded in 5ms:
[codex:1496139] AUDIT_BUNDLE.txt
[codex:1496139] codex-output-schema.json
[codex:1496139] contracts
[codex:1496139] exec
[codex:1496139] /bin/bash -lc 'cat AUDIT_BUNDLE.txt' in /tmp/codex-multi-8lt9lin6 succeeded in 5ms:
[codex:1496139] This file concatenates the full contents of first-party Solidity sources for auditing.
[codex:1496139]
[codex:1496139] ================================================================================
[codex:1496139] FILE: contracts/lib/openzeppelin-contracts/contracts/access/Ownable.sol
[codex:1496139] ================================================================================
[codex:1496139] // SPDX-License-Identifier: MIT
[codex:1496139] // OpenZeppelin Contracts (last updated v5.0.0) (access/Ownable.sol)
[codex:1496139]
[codex:1496139] pragma solidity ^0.8.20;
[codex:1496139]
[codex:1496139] import {Context} from "../utils/Context.sol";
[codex:1496139]
[codex:1496139] /**
[codex:1496139] * @dev Contract module which provides a basic access control mechanism, where
[codex:1496139] * there is an account (an owner) that can be granted exclusive access to
[codex:1496139] * specific functions.
[codex:1496139] *
[codex:1496139] * The initial owner is set to the address provided by the deployer. This can
[codex:1496139] * later be changed with {transferOwnership}.
[codex:1496139] *
[codex:1496139]
[codex:1496139] thinking
[codex:1496139] **Reviewing StablecoinMinter risks and constraints**
[codex:1496139]
[codex:1496139] I'm analyzing StablecoinMinter’s core logic to identify vulnerabilities around arithmetic, access control, reentrancy, and token behavior. There’s a deployment risk due to decimal mismatch underflow, a centralization risk where the owner can sweep stablecoin collateral causing potential underbacking, and an accounting risk if the stablecoin has transfer fees—users could mint more tokens than collateralized. Reentrancy concerns seem limited since state isn’t altered before external calls, and upgradeability or signature validation issues don’t apply. Overall, the contract’s design choices and assumptions limit some risks, but owner privileges and token fee behavior deserve attention as medium-severity concerns.
[codex:1496139] exec
[codex:1496139] /bin/bash -lc 'cat codex-output-schema.json' in /tmp/codex-multi-8lt9lin6 succeeded in 5ms:
[codex:1496139] {"type": "object", "additionalProperties": false, "required": ["no_findings", "summary", "findings"], "properties": {"no_findings": {"type": "boolean"}, "summary": {"type": "string"}, "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["severity", "category", "title", "evidence", "locations", "exploit_scenario", "recommendation"], "properties": {"severity": {"type": "string", "enum": ["info", "low", "medium", "high", "critical"]}, "category": {"type": "string", "enum": ["access_control", "reentrancy", "math", "oracle", "upgradeability", "auth", "other"]}, "title": {"type": "string"}, "exploit_scenario": {"type": "string"}, "recommendation": {"type": "string"}, "evidence": {"type": "string"}, "locations": {"type": "array", "items": {"type": "string"}}}}}}}
[codex:1496139]
[codex:1496139] thinking
[codex:1496139] **Evaluating potential vulnerabilities with focus on accounting and reentrancy**
[codex:1496139]
[codex:1496139] I’m analyzing the Solidity contract for exploitable issues, focusing on reentrancy, access control, unchecked return values, and accounting risks like fee-on-transfer tokens. There’s a subtle accounting risk where minted AID tokens may not match stablecoin collateral if the stablecoin charges transfer fees, resulting in potential undercollateralization. Reentrancy risks seem minimal given contract structure and ownership controls. Deployment could fail from decimal underflow in `DECIMAL_ADJUSTMENT`, but that’s a configuration issue rather than exploit. Overall, no critical exploits appear, but fee-on-transfer assumption and owner’s power to sweep collateral are worth noting as low to medium risks.
[codex:1496139] exec
[codex:1496139] /bin/bash -lc 'nl -ba contracts/src/Minter/StablecoinMinter.sol' in /tmp/codex-multi-8lt9lin6 succeeded in 5ms:
[codex:1496139] 1 // SPDX-License-Identifier: MIT
[codex:1496139] 2 pragma solidity 0.8.22;
[codex:1496139] 3
[codex:1496139] 4 import {Ownable2Step} from "@openzeppelin/contracts/access/Ownable2Step.sol";
[codex:1496139] 5 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
[codex:1496139] 6 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
[codex:1496139] 7 import {IAID} from "../interfaces/IAID.sol";
[codex:1496139] 8 import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
[codex:1496139] 9
[codex:1496139] 10 /// @title StablecoinMinter
[codex:1496139] 11 /// @notice Non-upgradeable minter that allows users to mint AID tokens by depositing stablecoins
[codex:1496139] 12 /// @dev Handles the decimal difference between stablecoins and AID (18 decimals)
[codex:1496139] 13 /// where 1 stablecoin = 1 AID (1:1 ratio)
[codex:1496139] 14 contract StablecoinMinter is Ownable2Step {
[codex:1496139] 15 /// @notice Address of the AID token
[codex:1496139] 16 address public immutable aid;
[codex:1496139] 17
[codex:1496139] 18 /// @notice Address of the stablecoin token
[codex:1496139] 19 address public immutable stablecoin;
[codex:1496139] 20
[codex:1496139]
[codex:1496139] thinking
[codex:1496139] **Summarizing audit findings and JSON output**
[codex:1496139]
[codex:1496139] I'm consolidating two main issues: an accounting/invariant break when minting with fee-on-transfer stablecoins causing unbacked tokens, and an access control risk where the owner can sweep collateral without corresponding burning. I'll classify severities as medium and low respectively, gather evidence lines, draft exploit scenarios, and build a concise JSON summary following the schema for presentation.
[codex:1496139] codex
[codex:1496139] {"no_findings":false,"summary":"Found 2 issues in StablecoinMinter: minting uses the requested amount instead of the actual received amount, and the owner can sweep collateral, breaking 1:1 backing assumptions.","findings":[{"severity":"medium","category":"other","title":"Mint amount ignores actual stablecoin received (fee-on-transfer/rebasing tokens)","exploit_scenario":"If the configured stablecoin charges a transfer fee or is rebasing, a user can call mint with a nominal amount (e.g., 100 units), the contract receives fewer tokens, but still mints the full AID amount. Repeating this mints unbacked AID and breaks the 1:1 collateral invariant.","recommendation":"Measure the stablecoin balance delta before/after transferFrom and mint based on the actual received amount, or explicitly restrict the stablecoin to a fee-free ERC20 and document/enforce that assumption.","evidence":"mint computes aidAmount from the input stablecoinAmount rather than the actual balance increase after transferFrom.","locations":["contracts/src/Minter/StablecoinMinter.sol:64","contracts/src/Minter/StablecoinMinter.sol:66","contracts/src/Minter/StablecoinMinter.sol:70"]},{"severity":"low","category":"access_control","title":"Owner can sweep collateral, leaving minted AID unbacked","exploit_scenario":"The owner can call sweep to transfer all stablecoins out of the contract while AID remains in circulation. This leaves users holding unbacked AID with no on-chain collateral.","recommendation":"If 1:1 backing is required, remove or strictly constrain sweep (e.g., only excess collateral or after burning AID). If intentional, clearly disclose the trust assumption to users.","evidence":"sweep allows the owner to transfer arbitrary stablecoin amounts without any accounting against outstanding AID supply.","locations":["contracts/src/Minter/StablecoinMinter.sol:80","contracts/src/Minter/StablecoinMinter.sol:84","contracts/src/Minter/StablecoinMinter.sol:87"]}]}
[codex:1496139] tokens used
[codex:1496139] 17,185
[codex:1496139] {"no_findings":false,"summary":"Found 2 issues in StablecoinMinter: minting uses the requested amount instead of the actual received amount, and the owner can sweep collateral, breaking 1:1 backing assumptions.","findings":[{"severity":"medium","category":"other","title":"Mint amount ignores actual stablecoin received (fee-on-transfer/rebasing tokens)","exploit_scenario":"If the configured stablecoin charges a transfer fee or is rebasing, a user can call mint with a nominal amount (e.g., 100 units), the contract receives fewer tokens, but still mints the full AID amount. Repeating this mints unbacked AID and breaks the 1:1 collateral invariant.","recommendation":"Measure the stablecoin balance delta before/after transferFrom and mint based on the actual received amount, or explicitly restrict the stablecoin to a fee-free ERC20 and document/enforce that assumption.","evidence":"mint computes aidAmount from the input stablecoinAmount rather than the actual balance increase after transferFrom.","locations":["contracts/src/Minter/StablecoinMinter.sol:64","contracts/src/Minter/StablecoinMinter.sol:66","contracts/src/Minter/StablecoinMinter.sol:70"]},{"severity":"low","category":"access_control","title":"Owner can sweep collateral, leaving minted AID unbacked","exploit_scenario":"The owner can call sweep to transfer all stablecoins out of the contract while AID remains in circulation. This leaves users holding unbacked AID with no on-chain collateral.","recommendation":"If 1:1 backing is required, remove or strictly constrain sweep (e.g., only excess collateral or after burning AID). If intentional, clearly disclose the trust assumption to users.","evidence":"sweep allows the owner to transfer arbitrary stablecoin amounts without any accounting against outstanding AID supply.","locations":["contracts/src/Minter/StablecoinMinter.sol:80","contracts/src/Minter/StablecoinMinter.sol:84","contracts/src/Minter/StablecoinMinter.sol:87"]}]}
{
"codex": {
"ran_at": "2025-12-28T17:32:36.793071+00:00",
"returncode": 0
},
"summary": "Found 2 issues in StablecoinMinter: minting uses the requested amount instead of the actual received amount, and the owner can sweep collateral, breaking 1:1 backing assumptions.",
"raw_final": {
"summary": "Found 2 issues in StablecoinMinter: minting uses the requested amount instead of the actual received amount, and the owner can sweep collateral, breaking 1:1 backing assumptions.",
"findings": [
{
"title": "Mint amount ignores actual stablecoin received (fee-on-transfer/rebasing tokens)",
"category": "other",
"evidence": "mint computes aidAmount from the input stablecoinAmount rather than the actual balance increase after transferFrom.",
"severity": "medium",
"locations": [
"contracts/src/Minter/StablecoinMinter.sol:64",
"contracts/src/Minter/StablecoinMinter.sol:66",
"contracts/src/Minter/StablecoinMinter.sol:70"
],
"recommendation": "Measure the stablecoin balance delta before/after transferFrom and mint based on the actual received amount, or explicitly restrict the stablecoin to a fee-free ERC20 and document/enforce that assumption.",
"exploit_scenario": "If the configured stablecoin charges a transfer fee or is rebasing, a user can call mint with a nominal amount (e.g., 100 units), the contract receives fewer tokens, but still mints the full AID amount. Repeating this mints unbacked AID and breaks the 1:1 collateral invariant."
},
{
"title": "Owner can sweep collateral, leaving minted AID unbacked",
"category": "access_control",
"evidence": "sweep allows the owner to transfer arbitrary stablecoin amounts without any accounting against outstanding AID supply.",
"severity": "low",
"locations": [
"contracts/src/Minter/StablecoinMinter.sol:80",
"contracts/src/Minter/StablecoinMinter.sol:84",
"contracts/src/Minter/StablecoinMinter.sol:87"
],
"recommendation": "If 1:1 backing is required, remove or strictly constrain sweep (e.g., only excess collateral or after burning AID). If intentional, clearly disclose the trust assumption to users.",
"exploit_scenario": "The owner can call sweep to transfer all stablecoins out of the contract while AID remains in circulation. This leaves users holding unbacked AID with no on-chain collateral."
}
],
"no_findings": false
},
"no_findings": false,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: CALLVALUE 00000006: DUP1 00000007: ISZERO 00000008: PUSH2 0x000f 0000000b: JUMPI 0000000c: PUSH0 0000000d: DUP1 0000000e: REVERT 0000000f: JUMPDEST 00000010: POP 00000011: PUSH1 0x04 00000013: CALLDATASIZE 00000014: LT 00000015: PUSH2 0x00b2 00000018: JUMPI 00000019: PUSH0 0000001a: CALLDATALOAD 0000001b: PUSH1 0xe0 0000001d: SHR 0000001e: DUP1 0000001f: PUSH4 0xb91cc136 00000024: GT 00000025: PUSH2 0x006f 00000028: JUMPI 00000029: DUP1 0000002a: PUSH4 0xb91cc136 0000002f: EQ 00000030: PUSH2 0x0152 00000033: JUMPI 00000034: DUP1 00000035: PUSH4 0xc1fd7a00 0000003a: EQ 0000003b: PUSH2 0x0170 0000003e: JUMPI 0000003f: DUP1 00000040: PUSH4 0xe30c3978 00000045: EQ 00000046: PUSH2 0x018e 00000049: JUMPI 0000004a: DUP1 0000004b: PUSH4 0xe9cbd822 00000050: EQ 00000051: PUSH2 0x01ac 00000054: JUMPI 00000055: DUP1 00000056: PUSH4 0xf2fde38b 0000005b: EQ 0000005c: PUSH2 0x01ca 0000005f: JUMPI 00000060: DUP1 00000061: PUSH4 0xf347f505 00000066: EQ 00000067: PUSH2 0x01e6 0000006a: JUMPI 0000006b: PUSH2 0x00b2 0000006e: JUMP 0000006f: JUMPDEST 00000070: DUP1 00000071: PUSH4 0x28a1f040 00000076: EQ 00000077: PUSH2 0x00b6 0000007a: JUMPI 0000007b: DUP1 0000007c: PUSH4 0x6ea056a9 00000081: EQ 00000082: PUSH2 0x00d4 00000085: JUMPI 00000086: DUP1 00000087: PUSH4 0x715018a6 0000008c: EQ 0000008d: PUSH2 0x00f0 00000090: JUMPI 00000091: DUP1 00000092: PUSH4 0x79ba5097 00000097: EQ 00000098: PUSH2 0x00fa 0000009b: JUMPI 0000009c: DUP1 0000009d: PUSH4 0x8da5cb5b 000000a2: EQ 000000a3: PUSH2 0x0104 000000a6: JUMPI 000000a7: DUP1 000000a8: PUSH4 0xa0712d68 000000ad: EQ 000000ae: PUSH2 0x0122 000000b1: JUMPI 000000b2: JUMPDEST 000000b3: PUSH0 000000b4: DUP1 000000b5: REVERT 000000b6: JUMPDEST 000000b7: PUSH2 0x00be 000000ba: PUSH2 0x0204 000000bd: JUMP 000000be: JUMPDEST 000000bf: PUSH1 0x40 000000c1: MLOAD 000000c2: PUSH2 0x00cb 000000c5: SWAP2 000000c6: SWAP1 000000c7: PUSH2 0x096c 000000ca: JUMP 000000cb: JUMPDEST 000000cc: PUSH1 0x40 000000ce: MLOAD 000000cf: DUP1 000000d0: SWAP2 000000d1: SUB 000000d2: SWAP1 000000d3: RETURN 000000d4: JUMPDEST 000000d5: PUSH2 0x00ee 000000d8: PUSH1 0x04 000000da: DUP1 000000db: CALLDATASIZE 000000dc: SUB 000000dd: DUP2 000000de: ADD 000000df: SWAP1 000000e0: PUSH2 0x00e9 000000e3: SWAP2 000000e4: SWAP1 000000e5: PUSH2 0x0a16 000000e8: JUMP 000000e9: JUMPDEST 000000ea: PUSH2 0x0228 000000ed: JUMP 000000ee: JUMPDEST 000000ef: STOP 000000f0: JUMPDEST 000000f1: PUSH2 0x00f8 000000f4: PUSH2 0x03c8 000000f7: JUMP 000000f8: JUMPDEST 000000f9: STOP 000000fa: JUMPDEST 000000fb: PUSH2 0x0102 000000fe: PUSH2 0x03db 00000101: JUMP 00000102: JUMPDEST 00000103: STOP 00000104: JUMPDEST 00000105: PUSH2 0x010c 00000108: PUSH2 0x0469 0000010b: JUMP 0000010c: JUMPDEST 0000010d: PUSH1 0x40 0000010f: MLOAD 00000110: PUSH2 0x0119 00000113: SWAP2 00000114: SWAP1 00000115: PUSH2 0x0a63 00000118: JUMP 00000119: JUMPDEST 0000011a: PUSH1 0x40 0000011c: MLOAD 0000011d: DUP1 0000011e: SWAP2 0000011f: SUB 00000120: SWAP1 00000121: RETURN 00000122: JUMPDEST 00000123: PUSH2 0x013c 00000126: PUSH1 0x04 00000128: DUP1 00000129: CALLDATASIZE 0000012a: SUB 0000012b: DUP2 0000012c: ADD 0000012d: SWAP1 0000012e: PUSH2 0x0137 00000131: SWAP2 00000132: SWAP1 00000133: PUSH2 0x0a7c 00000136: JUMP 00000137: JUMPDEST 00000138: PUSH2 0x0490 0000013b: JUMP 0000013c: JUMPDEST 0000013d: PUSH1 0x40 0000013f: MLOAD 00000140: PUSH2 0x0149 00000143: SWAP2 00000144: SWAP1 00000145: PUSH2 0x0ab6 00000148: JUMP 00000149: JUMPDEST 0000014a: PUSH1 0x40 0000014c: MLOAD 0000014d: DUP1 0000014e: SWAP2 0000014f: SUB 00000150: SWAP1 00000151: RETURN 00000152: JUMPDEST 00000153: PUSH2 0x015a 00000156: PUSH2 0x066e 00000159: JUMP 0000015a: JUMPDEST 0000015b: PUSH1 0x40 0000015d: MLOAD 0000015e: PUSH2 0x0167 00000161: SWAP2 00000162: SWAP1 00000163: PUSH2 0x0a63 00000166: JUMP 00000167: JUMPDEST 00000168: PUSH1 0x40 0000016a: MLOAD 0000016b: DUP1 0000016c: SWAP2 0000016d: SUB 0000016e: SWAP1 0000016f: RETURN 00000170: JUMPDEST 00000171: PUSH2 0x0178 00000174: PUSH2 0x0692 00000177: JUMP 00000178: JUMPDEST 00000179: PUSH1 0x40 0000017b: MLOAD 0000017c: PUSH2 0x0185 0000017f: SWAP2 00000180: SWAP1 00000181: PUSH2 0x0ab6 00000184: JUMP 00000185: JUMPDEST 00000186: PUSH1 0x40 00000188: MLOAD 00000189: DUP1 0000018a: SWAP2 0000018b: SUB 0000018c: SWAP1 0000018d: RETURN 0000018e: JUMPDEST 0000018f: PUSH2 0x0196 00000192: PUSH2 0x06b6 00000195: JUMP 00000196: JUMPDEST 00000197: PUSH1 0x40 00000199: MLOAD 0000019a: PUSH2 0x01a3 0000019d: SWAP2 0000019e: SWAP1 0000019f: PUSH2 0x0a63 000001a2: JUMP 000001a3: JUMPDEST 000001a4: PUSH1 0x40 000001a6: MLOAD 000001a7: DUP1 000001a8: SWAP2 000001a9: SUB 000001aa: SWAP1 000001ab: RETURN 000001ac: JUMPDEST 000001ad: PUSH2 0x01b4 000001b0: PUSH2 0x06de 000001b3: JUMP 000001b4: JUMPDEST 000001b5: PUSH1 0x40 000001b7: MLOAD 000001b8: PUSH2 0x01c1 000001bb: SWAP2 000001bc: SWAP1 000001bd: PUSH2 0x0a63 000001c0: JUMP 000001c1: JUMPDEST 000001c2: PUSH1 0x40 000001c4: MLOAD 000001c5: DUP1 000001c6: SWAP2 000001c7: SUB 000001c8: SWAP1 000001c9: RETURN 000001ca: JUMPDEST 000001cb: PUSH2 0x01e4 000001ce: PUSH1 0x04 000001d0: DUP1 000001d1: CALLDATASIZE 000001d2: SUB 000001d3: DUP2 000001d4: ADD 000001d5: SWAP1 000001d6: PUSH2 0x01df 000001d9: SWAP2 000001da: SWAP1 000001db: PUSH2 0x0acf 000001de: JUMP 000001df: JUMPDEST 000001e0: PUSH2 0x0702 000001e3: JUMP 000001e4: JUMPDEST 000001e5: STOP 000001e6: JUMPDEST 000001e7: PUSH2 0x01ee 000001ea: PUSH2 0x07ae 000001ed: JUMP 000001ee: JUMPDEST 000001ef: PUSH1 0x40 000001f1: MLOAD 000001f2: PUSH2 0x01fb 000001f5: SWAP2 000001f6: SWAP1 000001f7: PUSH2 0x096c 000001fa: JUMP 000001fb: JUMPDEST 000001fc: PUSH1 0x40 000001fe: MLOAD 000001ff: DUP1 00000200: SWAP2 00000201: SUB 00000202: SWAP1 00000203: RETURN 00000204: JUMPDEST 00000205: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000012 00000226: DUP2 00000227: JUMP 00000228: JUMPDEST 00000229: PUSH2 0x0230 0000022c: PUSH2 0x07d2 0000022f: JUMP 00000230: JUMPDEST 00000231: PUSH0 00000232: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000247: AND 00000248: DUP3 00000249: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000025e: AND 0000025f: SUB 00000260: PUSH2 0x02a0 00000263: JUMPI 00000264: PUSH0 00000265: PUSH1 0x40 00000267: MLOAD 00000268: PUSH32 0x1e4fbdf700000000000000000000000000000000000000000000000000000000 00000289: DUP2 0000028a: MSTORE 0000028b: PUSH1 0x04 0000028d: ADD 0000028e: PUSH2 0x0297 00000291: SWAP2 00000292: SWAP1 00000293: PUSH2 0x0a63 00000296: JUMP 00000297: JUMPDEST 00000298: PUSH1 0x40 0000029a: MLOAD 0000029b: DUP1 0000029c: SWAP2 0000029d: SUB 0000029e: SWAP1 0000029f: REVERT 000002a0: JUMPDEST 000002a1: PUSH0 000002a2: PUSH32 0x000000000000000000000000a0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 000002c3: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000002d8: AND 000002d9: PUSH4 0xa9059cbb 000002de: DUP5 000002df: DUP5 000002e0: PUSH1 0x40 000002e2: MLOAD 000002e3: DUP4 000002e4: PUSH4 0xffffffff 000002e9: AND 000002ea: PUSH1 0xe0 000002ec: SHL 000002ed: DUP2 000002ee: MSTORE 000002ef: PUSH1 0x04 000002f1: ADD 000002f2: PUSH2 0x02fc 000002f5: SWAP3 000002f6: SWAP2 000002f7: SWAP1 000002f8: PUSH2 0x0afa 000002fb: JUMP 000002fc: JUMPDEST 000002fd: PUSH1 0x20 000002ff: PUSH1 0x40 00000301: MLOAD 00000302: DUP1 00000303: DUP4 00000304: SUB 00000305: DUP2 00000306: PUSH0 00000307: DUP8 00000308: GAS 00000309: CALL 0000030a: ISZERO 0000030b: DUP1 0000030c: ISZERO 0000030d: PUSH2 0x0318 00000310: JUMPI 00000311: RETURNDATASIZE 00000312: PUSH0 00000313: DUP1 00000314: RETURNDATACOPY 00000315: RETURNDATASIZE 00000316: PUSH0 00000317: REVERT 00000318: JUMPDEST 00000319: POP 0000031a: POP 0000031b: POP 0000031c: POP 0000031d: PUSH1 0x40 0000031f: MLOAD 00000320: RETURNDATASIZE 00000321: PUSH1 0x1f 00000323: NOT 00000324: PUSH1 0x1f 00000326: DUP3 00000327: ADD 00000328: AND 00000329: DUP3 0000032a: ADD 0000032b: DUP1 0000032c: PUSH1 0x40 0000032e: MSTORE 0000032f: POP 00000330: DUP2 00000331: ADD 00000332: SWAP1 00000333: PUSH2 0x033c 00000336: SWAP2 00000337: SWAP1 00000338: PUSH2 0x0b56 0000033b: JUMP 0000033c: JUMPDEST 0000033d: SWAP1 0000033e: POP 0000033f: DUP1 00000340: PUSH2 0x0375 00000343: JUMPI 00000344: PUSH1 0x40 00000346: MLOAD 00000347: PUSH32 0x90b8ec1800000000000000000000000000000000000000000000000000000000 00000368: DUP2 00000369: MSTORE 0000036a: PUSH1 0x04 0000036c: ADD 0000036d: PUSH1 0x40 0000036f: MLOAD 00000370: DUP1 00000371: SWAP2 00000372: SUB 00000373: SWAP1 00000374: REVERT 00000375: JUMPDEST 00000376: DUP3 00000377: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000038c: AND 0000038d: PUSH32 0xc36b5179cb9c303b200074996eab2b3473eac370fdd7eba3bec636fe35109696 000003ae: DUP4 000003af: PUSH1 0x40 000003b1: MLOAD 000003b2: PUSH2 0x03bb 000003b5: SWAP2 000003b6: SWAP1 000003b7: PUSH2 0x0ab6 000003ba: JUMP 000003bb: JUMPDEST 000003bc: PUSH1 0x40 000003be: MLOAD 000003bf: DUP1 000003c0: SWAP2 000003c1: SUB 000003c2: SWAP1 000003c3: LOG2 000003c4: POP 000003c5: POP 000003c6: POP 000003c7: JUMP 000003c8: JUMPDEST 000003c9: PUSH2 0x03d0 000003cc: PUSH2 0x07d2 000003cf: JUMP 000003d0: JUMPDEST 000003d1: PUSH2 0x03d9 000003d4: PUSH0 000003d5: PUSH2 0x0859 000003d8: JUMP 000003d9: JUMPDEST 000003da: JUMP 000003db: JUMPDEST 000003dc: PUSH0 000003dd: PUSH2 0x03e4 000003e0: PUSH2 0x0889 000003e3: JUMP 000003e4: JUMPDEST 000003e5: SWAP1 000003e6: POP 000003e7: DUP1 000003e8: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000003fd: AND 000003fe: PUSH2 0x0405 00000401: PUSH2 0x06b6 00000404: JUMP 00000405: JUMPDEST 00000406: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000041b: AND 0000041c: EQ 0000041d: PUSH2 0x045d 00000420: JUMPI 00000421: DUP1 00000422: PUSH1 0x40 00000424: MLOAD 00000425: PUSH32 0x118cdaa700000000000000000000000000000000000000000000000000000000 00000446: DUP2 00000447: MSTORE 00000448: PUSH1 0x04 0000044a: ADD 0000044b: PUSH2 0x0454 0000044e: SWAP2 0000044f: SWAP1 00000450: PUSH2 0x0a63 00000453: JUMP 00000454: JUMPDEST 00000455: PUSH1 0x40 00000457: MLOAD 00000458: DUP1 00000459: SWAP2 0000045a: SUB 0000045b: SWAP1 0000045c: REVERT 0000045d: JUMPDEST 0000045e: PUSH2 0x0466 00000461: DUP2 00000462: PUSH2 0x0859 00000465: JUMP 00000466: JUMPDEST 00000467: POP 00000468: JUMP 00000469: JUMPDEST 0000046a: PUSH0 0000046b: DUP1 0000046c: PUSH0 0000046d: SWAP1 0000046e: SLOAD 0000046f: SWAP1 00000470: PUSH2 0x0100 00000473: EXP 00000474: SWAP1 00000475: DIV 00000476: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000048b: AND 0000048c: SWAP1 0000048d: POP 0000048e: SWAP1 0000048f: JUMP 00000490: JUMPDEST 00000491: PUSH0 00000492: DUP1 00000493: PUSH32 0x000000000000000000000000a0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 000004b4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000004c9: AND 000004ca: PUSH4 0x23b872dd 000004cf: CALLER 000004d0: ADDRESS 000004d1: DUP7 000004d2: PUSH1 0x40 000004d4: MLOAD 000004d5: DUP5 000004d6: PUSH4 0xffffffff 000004db: AND 000004dc: PUSH1 0xe0 000004de: SHL 000004df: DUP2 000004e0: MSTORE 000004e1: PUSH1 0x04 000004e3: ADD 000004e4: PUSH2 0x04ef 000004e7: SWAP4 000004e8: SWAP3 000004e9: SWAP2 000004ea: SWAP1 000004eb: PUSH2 0x0b81 000004ee: JUMP 000004ef: JUMPDEST 000004f0: PUSH1 0x20 000004f2: PUSH1 0x40 000004f4: MLOAD 000004f5: DUP1 000004f6: DUP4 000004f7: SUB 000004f8: DUP2 000004f9: PUSH0 000004fa: DUP8 000004fb: GAS 000004fc: CALL 000004fd: ISZERO 000004fe: DUP1 000004ff: ISZERO 00000500: PUSH2 0x050b 00000503: JUMPI 00000504: RETURNDATASIZE 00000505: PUSH0 00000506: DUP1 00000507: RETURNDATACOPY 00000508: RETURNDATASIZE 00000509: PUSH0 0000050a: REVERT 0000050b: JUMPDEST 0000050c: POP 0000050d: POP 0000050e: POP 0000050f: POP 00000510: PUSH1 0x40 00000512: MLOAD 00000513: RETURNDATASIZE 00000514: PUSH1 0x1f 00000516: NOT 00000517: PUSH1 0x1f 00000519: DUP3 0000051a: ADD 0000051b: AND 0000051c: DUP3 0000051d: ADD 0000051e: DUP1 0000051f: PUSH1 0x40 00000521: MSTORE 00000522: POP 00000523: DUP2 00000524: ADD 00000525: SWAP1 00000526: PUSH2 0x052f 00000529: SWAP2 0000052a: SWAP1 0000052b: PUSH2 0x0b56 0000052e: JUMP 0000052f: JUMPDEST 00000530: SWAP1 00000531: POP 00000532: DUP1 00000533: PUSH2 0x0568 00000536: JUMPI 00000537: PUSH1 0x40 00000539: MLOAD 0000053a: PUSH32 0x90b8ec1800000000000000000000000000000000000000000000000000000000 0000055b: DUP2 0000055c: MSTORE 0000055d: PUSH1 0x04 0000055f: ADD 00000560: PUSH1 0x40 00000562: MLOAD 00000563: DUP1 00000564: SWAP2 00000565: SUB 00000566: SWAP1 00000567: REVERT 00000568: JUMPDEST 00000569: PUSH0 0000056a: PUSH32 0x000000000000000000000000000000000000000000000000000000e8d4a51000 0000058b: DUP5 0000058c: PUSH2 0x0595 0000058f: SWAP2 00000590: SWAP1 00000591: PUSH2 0x0be3 00000594: JUMP 00000595: JUMPDEST 00000596: SWAP1 00000597: POP 00000598: PUSH32 0x00000000000000000000000018f52b3fb465118731d9e0d276d4eb3599d57596 000005b9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000005ce: AND 000005cf: PUSH4 0x40c10f19 000005d4: CALLER 000005d5: DUP4 000005d6: PUSH1 0x40 000005d8: MLOAD 000005d9: DUP4 000005da: PUSH4 0xffffffff 000005df: AND 000005e0: PUSH1 0xe0 000005e2: SHL 000005e3: DUP2 000005e4: MSTORE 000005e5: PUSH1 0x04 000005e7: ADD 000005e8: PUSH2 0x05f2 000005eb: SWAP3 000005ec: SWAP2 000005ed: SWAP1 000005ee: PUSH2 0x0afa 000005f1: JUMP 000005f2: JUMPDEST 000005f3: PUSH0 000005f4: PUSH1 0x40 000005f6: MLOAD 000005f7: DUP1 000005f8: DUP4 000005f9: SUB 000005fa: DUP2 000005fb: PUSH0 000005fc: DUP8 000005fd: DUP1 000005fe: EXTCODESIZE 000005ff: ISZERO 00000600: DUP1 00000601: ISZERO 00000602: PUSH2 0x0609 00000605: JUMPI 00000606: PUSH0 00000607: DUP1 00000608: REVERT 00000609: JUMPDEST 0000060a: POP 0000060b: GAS 0000060c: CALL 0000060d: ISZERO 0000060e: DUP1 0000060f: ISZERO 00000610: PUSH2 0x061b 00000613: JUMPI 00000614: RETURNDATASIZE 00000615: PUSH0 00000616: DUP1 00000617: RETURNDATACOPY 00000618: RETURNDATASIZE 00000619: PUSH0 0000061a: REVERT 0000061b: JUMPDEST 0000061c: POP 0000061d: POP 0000061e: POP 0000061f: POP 00000620: DUP1 00000621: DUP5 00000622: CALLER 00000623: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000638: AND 00000639: PUSH32 0x25b428dfde728ccfaddad7e29e4ac23c24ed7fd1a6e3e3f91894a9a073f5dfff 0000065a: PUSH1 0x40 0000065c: MLOAD 0000065d: PUSH1 0x40 0000065f: MLOAD 00000660: DUP1 00000661: SWAP2 00000662: SUB 00000663: SWAP1 00000664: LOG4 00000665: DUP1 00000666: SWAP3 00000667: POP 00000668: POP 00000669: POP 0000066a: SWAP2 0000066b: SWAP1 0000066c: POP 0000066d: JUMP 0000066e: JUMPDEST 0000066f: PUSH32 0x00000000000000000000000018f52b3fb465118731d9e0d276d4eb3599d57596 00000690: DUP2 00000691: JUMP 00000692: JUMPDEST 00000693: PUSH32 0x000000000000000000000000000000000000000000000000000000e8d4a51000 000006b4: DUP2 000006b5: JUMP 000006b6: JUMPDEST 000006b7: PUSH0 000006b8: PUSH1 0x01 000006ba: PUSH0 000006bb: SWAP1 000006bc: SLOAD 000006bd: SWAP1 000006be: PUSH2 0x0100 000006c1: EXP 000006c2: SWAP1 000006c3: DIV 000006c4: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000006d9: AND 000006da: SWAP1 000006db: POP 000006dc: SWAP1 000006dd: JUMP 000006de: JUMPDEST 000006df: PUSH32 0x000000000000000000000000a0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 00000700: DUP2 00000701: JUMP 00000702: JUMPDEST 00000703: PUSH2 0x070a 00000706: PUSH2 0x07d2 00000709: JUMP 0000070a: JUMPDEST 0000070b: DUP1 0000070c: PUSH1 0x01 0000070e: PUSH0 0000070f: PUSH2 0x0100 00000712: EXP 00000713: DUP2 00000714: SLOAD 00000715: DUP2 00000716: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000072b: MUL 0000072c: NOT 0000072d: AND 0000072e: SWAP1 0000072f: DUP4 00000730: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000745: AND 00000746: MUL 00000747: OR 00000748: SWAP1 00000749: SSTORE 0000074a: POP 0000074b: DUP1 0000074c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000761: AND 00000762: PUSH2 0x0769 00000765: PUSH2 0x0469 00000768: JUMP 00000769: JUMPDEST 0000076a: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000077f: AND 00000780: PUSH32 0x38d16b8cac22d99fc7c124b9cd0de2d3fa1faef420bfe791d8c362d765e22700 000007a1: PUSH1 0x40 000007a3: MLOAD 000007a4: PUSH1 0x40 000007a6: MLOAD 000007a7: DUP1 000007a8: SWAP2 000007a9: SUB 000007aa: SWAP1 000007ab: LOG3 000007ac: POP 000007ad: JUMP 000007ae: JUMPDEST 000007af: PUSH32 0x0000000000000000000000000000000000000000000000000000000000000006 000007d0: DUP2 000007d1: JUMP 000007d2: JUMPDEST 000007d3: PUSH2 0x07da 000007d6: PUSH2 0x0889 000007d9: JUMP 000007da: JUMPDEST 000007db: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000007f0: AND 000007f1: PUSH2 0x07f8 000007f4: PUSH2 0x0469 000007f7: JUMP 000007f8: JUMPDEST 000007f9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000080e: AND 0000080f: EQ 00000810: PUSH2 0x0857 00000813: JUMPI 00000814: PUSH2 0x081b 00000817: PUSH2 0x0889 0000081a: JUMP 0000081b: JUMPDEST 0000081c: PUSH1 0x40 0000081e: MLOAD 0000081f: PUSH32 0x118cdaa700000000000000000000000000000000000000000000000000000000 00000840: DUP2 00000841: MSTORE 00000842: PUSH1 0x04 00000844: ADD 00000845: PUSH2 0x084e 00000848: SWAP2 00000849: SWAP1 0000084a: PUSH2 0x0a63 0000084d: JUMP 0000084e: JUMPDEST 0000084f: PUSH1 0x40 00000851: MLOAD 00000852: DUP1 00000853: SWAP2 00000854: SUB 00000855: SWAP1 00000856: REVERT 00000857: JUMPDEST 00000858: JUMP 00000859: JUMPDEST 0000085a: PUSH1 0x01 0000085c: PUSH0 0000085d: PUSH2 0x0100 00000860: EXP 00000861: DUP2 00000862: SLOAD 00000863: SWAP1 00000864: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000879: MUL 0000087a: NOT 0000087b: AND 0000087c: SWAP1 0000087d: SSTORE 0000087e: PUSH2 0x0886 00000881: DUP2 00000882: PUSH2 0x0890 00000885: JUMP 00000886: JUMPDEST 00000887: POP 00000888: JUMP 00000889: JUMPDEST 0000088a: PUSH0 0000088b: CALLER 0000088c: SWAP1 0000088d: POP 0000088e: SWAP1 0000088f: JUMP 00000890: JUMPDEST 00000891: PUSH0 00000892: DUP1 00000893: PUSH0 00000894: SWAP1 00000895: SLOAD 00000896: SWAP1 00000897: PUSH2 0x0100 0000089a: EXP 0000089b: SWAP1 0000089c: DIV 0000089d: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008b2: AND 000008b3: SWAP1 000008b4: POP 000008b5: DUP2 000008b6: PUSH0 000008b7: DUP1 000008b8: PUSH2 0x0100 000008bb: EXP 000008bc: DUP2 000008bd: SLOAD 000008be: DUP2 000008bf: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008d4: MUL 000008d5: NOT 000008d6: AND 000008d7: SWAP1 000008d8: DUP4 000008d9: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000008ee: AND 000008ef: MUL 000008f0: OR 000008f1: SWAP1 000008f2: SSTORE 000008f3: POP 000008f4: DUP2 000008f5: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000090a: AND 0000090b: DUP2 0000090c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000921: AND 00000922: PUSH32 0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0 00000943: PUSH1 0x40 00000945: MLOAD 00000946: PUSH1 0x40 00000948: MLOAD 00000949: DUP1 0000094a: SWAP2 0000094b: SUB 0000094c: SWAP1 0000094d: LOG3 0000094e: POP 0000094f: POP 00000950: JUMP 00000951: JUMPDEST 00000952: PUSH0 00000953: PUSH1 0xff 00000955: DUP3 00000956: AND 00000957: SWAP1 00000958: POP 00000959: SWAP2 0000095a: SWAP1 0000095b: POP 0000095c: JUMP 0000095d: JUMPDEST 0000095e: PUSH2 0x0966 00000961: DUP2 00000962: PUSH2 0x0951 00000965: JUMP 00000966: JUMPDEST 00000967: DUP3 00000968: MSTORE 00000969: POP 0000096a: POP 0000096b: JUMP 0000096c: JUMPDEST 0000096d: PUSH0 0000096e: PUSH1 0x20 00000970: DUP3 00000971: ADD 00000972: SWAP1 00000973: POP 00000974: PUSH2 0x097f 00000977: PUSH0 00000978: DUP4 00000979: ADD 0000097a: DUP5 0000097b: PUSH2 0x095d 0000097e: JUMP 0000097f: JUMPDEST 00000980: SWAP3 00000981: SWAP2 00000982: POP 00000983: POP 00000984: JUMP 00000985: JUMPDEST 00000986: PUSH0 00000987: DUP1 00000988: REVERT 00000989: JUMPDEST 0000098a: PUSH0 0000098b: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 000009a0: DUP3 000009a1: AND 000009a2: SWAP1 000009a3: POP 000009a4: SWAP2 000009a5: SWAP1 000009a6: POP 000009a7: JUMP 000009a8: JUMPDEST 000009a9: PUSH0 000009aa: PUSH2 0x09b2 000009ad: DUP3 000009ae: PUSH2 0x0989 000009b1: JUMP 000009b2: JUMPDEST 000009b3: SWAP1 000009b4: POP 000009b5: SWAP2 000009b6: SWAP1 000009b7: POP 000009b8: JUMP 000009b9: JUMPDEST 000009ba: PUSH2 0x09c2 000009bd: DUP2 000009be: PUSH2 0x09a8 000009c1: JUMP 000009c2: JUMPDEST 000009c3: DUP2 000009c4: EQ 000009c5: PUSH2 0x09cc 000009c8: JUMPI 000009c9: PUSH0 000009ca: DUP1 000009cb: REVERT 000009cc: JUMPDEST 000009cd: POP 000009ce: JUMP 000009cf: JUMPDEST 000009d0: PUSH0 000009d1: DUP2 000009d2: CALLDATALOAD 000009d3: SWAP1 000009d4: POP 000009d5: PUSH2 0x09dd 000009d8: DUP2 000009d9: PUSH2 0x09b9 000009dc: JUMP 000009dd: JUMPDEST 000009de: SWAP3 000009df: SWAP2 000009e0: POP 000009e1: POP 000009e2: JUMP 000009e3: JUMPDEST 000009e4: PUSH0 000009e5: DUP2 000009e6: SWAP1 000009e7: POP 000009e8: SWAP2 000009e9: SWAP1 000009ea: POP 000009eb: JUMP 000009ec: JUMPDEST 000009ed: PUSH2 0x09f5 000009f0: DUP2 000009f1: PUSH2 0x09e3 000009f4: JUMP 000009f5: JUMPDEST 000009f6: DUP2 000009f7: EQ 000009f8: PUSH2 0x09ff 000009fb: JUMPI 000009fc: PUSH0 000009fd: DUP1 000009fe: REVERT 000009ff: JUMPDEST 00000a00: POP 00000a01: JUMP 00000a02: JUMPDEST 00000a03: PUSH0 00000a04: DUP2 00000a05: CALLDATALOAD 00000a06: SWAP1 00000a07: POP 00000a08: PUSH2 0x0a10 00000a0b: DUP2 00000a0c: PUSH2 0x09ec 00000a0f: JUMP 00000a10: JUMPDEST 00000a11: SWAP3 00000a12: SWAP2 00000a13: POP 00000a14: POP 00000a15: JUMP 00000a16: JUMPDEST 00000a17: PUSH0 00000a18: DUP1 00000a19: PUSH1 0x40 00000a1b: DUP4 00000a1c: DUP6 00000a1d: SUB 00000a1e: SLT 00000a1f: ISZERO 00000a20: PUSH2 0x0a2c 00000a23: JUMPI 00000a24: PUSH2 0x0a2b 00000a27: PUSH2 0x0985 00000a2a: JUMP 00000a2b: JUMPDEST 00000a2c: JUMPDEST 00000a2d: PUSH0 00000a2e: PUSH2 0x0a39 00000a31: DUP6 00000a32: DUP3 00000a33: DUP7 00000a34: ADD 00000a35: PUSH2 0x09cf 00000a38: JUMP 00000a39: JUMPDEST 00000a3a: SWAP3 00000a3b: POP 00000a3c: POP 00000a3d: PUSH1 0x20 00000a3f: PUSH2 0x0a4a 00000a42: DUP6 00000a43: DUP3 00000a44: DUP7 00000a45: ADD 00000a46: PUSH2 0x0a02 00000a49: JUMP 00000a4a: JUMPDEST 00000a4b: SWAP2 00000a4c: POP 00000a4d: POP 00000a4e: SWAP3 00000a4f: POP 00000a50: SWAP3 00000a51: SWAP1 00000a52: POP 00000a53: JUMP 00000a54: JUMPDEST 00000a55: PUSH2 0x0a5d 00000a58: DUP2 00000a59: PUSH2 0x09a8 00000a5c: JUMP 00000a5d: JUMPDEST 00000a5e: DUP3 00000a5f: MSTORE 00000a60: POP 00000a61: POP 00000a62: JUMP 00000a63: JUMPDEST 00000a64: PUSH0 00000a65: PUSH1 0x20 00000a67: DUP3 00000a68: ADD 00000a69: SWAP1 00000a6a: POP 00000a6b: PUSH2 0x0a76 00000a6e: PUSH0 00000a6f: DUP4 00000a70: ADD 00000a71: DUP5 00000a72: PUSH2 0x0a54 00000a75: JUMP 00000a76: JUMPDEST 00000a77: SWAP3 00000a78: SWAP2 00000a79: POP 00000a7a: POP 00000a7b: JUMP 00000a7c: JUMPDEST 00000a7d: PUSH0 00000a7e: PUSH1 0x20 00000a80: DUP3 00000a81: DUP5 00000a82: SUB 00000a83: SLT 00000a84: ISZERO 00000a85: PUSH2 0x0a91 00000a88: JUMPI 00000a89: PUSH2 0x0a90 00000a8c: PUSH2 0x0985 00000a8f: JUMP 00000a90: JUMPDEST 00000a91: JUMPDEST 00000a92: PUSH0 00000a93: PUSH2 0x0a9e 00000a96: DUP5 00000a97: DUP3 00000a98: DUP6 00000a99: ADD 00000a9a: PUSH2 0x0a02 00000a9d: JUMP 00000a9e: JUMPDEST 00000a9f: SWAP2 00000aa0: POP 00000aa1: POP 00000aa2: SWAP3 00000aa3: SWAP2 00000aa4: POP 00000aa5: POP 00000aa6: JUMP 00000aa7: JUMPDEST 00000aa8: PUSH2 0x0ab0 00000aab: DUP2 00000aac: PUSH2 0x09e3 00000aaf: JUMP 00000ab0: JUMPDEST 00000ab1: DUP3 00000ab2: MSTORE 00000ab3: POP 00000ab4: POP 00000ab5: JUMP 00000ab6: JUMPDEST 00000ab7: PUSH0 00000ab8: PUSH1 0x20 00000aba: DUP3 00000abb: ADD 00000abc: SWAP1 00000abd: POP 00000abe: PUSH2 0x0ac9 00000ac1: PUSH0 00000ac2: DUP4 00000ac3: ADD 00000ac4: DUP5 00000ac5: PUSH2 0x0aa7 00000ac8: JUMP 00000ac9: JUMPDEST 00000aca: SWAP3 00000acb: SWAP2 00000acc: POP 00000acd: POP 00000ace: JUMP 00000acf: JUMPDEST 00000ad0: PUSH0 00000ad1: PUSH1 0x20 00000ad3: DUP3 00000ad4: DUP5 00000ad5: SUB 00000ad6: SLT 00000ad7: ISZERO 00000ad8: PUSH2 0x0ae4 00000adb: JUMPI 00000adc: PUSH2 0x0ae3 00000adf: PUSH2 0x0985 00000ae2: JUMP 00000ae3: JUMPDEST 00000ae4: JUMPDEST 00000ae5: PUSH0 00000ae6: PUSH2 0x0af1 00000ae9: DUP5 00000aea: DUP3 00000aeb: DUP6 00000aec: ADD 00000aed: PUSH2 0x09cf 00000af0: JUMP 00000af1: JUMPDEST 00000af2: SWAP2 00000af3: POP 00000af4: POP 00000af5: SWAP3 00000af6: SWAP2 00000af7: POP 00000af8: POP 00000af9: JUMP 00000afa: JUMPDEST 00000afb: PUSH0 00000afc: PUSH1 0x40 00000afe: DUP3 00000aff: ADD 00000b00: SWAP1 00000b01: POP 00000b02: PUSH2 0x0b0d 00000b05: PUSH0 00000b06: DUP4 00000b07: ADD 00000b08: DUP6 00000b09: PUSH2 0x0a54 00000b0c: JUMP 00000b0d: JUMPDEST 00000b0e: PUSH2 0x0b1a 00000b11: PUSH1 0x20 00000b13: DUP4 00000b14: ADD 00000b15: DUP5 00000b16: PUSH2 0x0aa7 00000b19: JUMP 00000b1a: JUMPDEST 00000b1b: SWAP4 00000b1c: SWAP3 00000b1d: POP 00000b1e: POP 00000b1f: POP 00000b20: JUMP 00000b21: JUMPDEST 00000b22: PUSH0 00000b23: DUP2 00000b24: ISZERO 00000b25: ISZERO 00000b26: SWAP1 00000b27: POP 00000b28: SWAP2 00000b29: SWAP1 00000b2a: POP 00000b2b: JUMP 00000b2c: JUMPDEST 00000b2d: PUSH2 0x0b35 00000b30: DUP2 00000b31: PUSH2 0x0b21 00000b34: JUMP 00000b35: JUMPDEST 00000b36: DUP2 00000b37: EQ 00000b38: PUSH2 0x0b3f 00000b3b: JUMPI 00000b3c: PUSH0 00000b3d: DUP1 00000b3e: REVERT 00000b3f: JUMPDEST 00000b40: POP 00000b41: JUMP 00000b42: JUMPDEST 00000b43: PUSH0 00000b44: DUP2 00000b45: MLOAD 00000b46: SWAP1 00000b47: POP 00000b48: PUSH2 0x0b50 00000b4b: DUP2 00000b4c: PUSH2 0x0b2c 00000b4f: JUMP 00000b50: JUMPDEST 00000b51: SWAP3 00000b52: SWAP2 00000b53: POP 00000b54: POP 00000b55: JUMP 00000b56: JUMPDEST 00000b57: PUSH0 00000b58: PUSH1 0x20 00000b5a: DUP3 00000b5b: DUP5 00000b5c: SUB 00000b5d: SLT 00000b5e: ISZERO 00000b5f: PUSH2 0x0b6b 00000b62: JUMPI 00000b63: PUSH2 0x0b6a 00000b66: PUSH2 0x0985 00000b69: JUMP 00000b6a: JUMPDEST 00000b6b: JUMPDEST 00000b6c: PUSH0 00000b6d: PUSH2 0x0b78 00000b70: DUP5 00000b71: DUP3 00000b72: DUP6 00000b73: ADD 00000b74: PUSH2 0x0b42 00000b77: JUMP 00000b78: JUMPDEST 00000b79: SWAP2 00000b7a: POP 00000b7b: POP 00000b7c: SWAP3 00000b7d: SWAP2 00000b7e: POP 00000b7f: POP 00000b80: JUMP 00000b81: JUMPDEST 00000b82: PUSH0 00000b83: PUSH1 0x60 00000b85: DUP3 00000b86: ADD 00000b87: SWAP1 00000b88: POP 00000b89: PUSH2 0x0b94 00000b8c: PUSH0 00000b8d: DUP4 00000b8e: ADD 00000b8f: DUP7 00000b90: PUSH2 0x0a54 00000b93: JUMP 00000b94: JUMPDEST 00000b95: PUSH2 0x0ba1 00000b98: PUSH1 0x20 00000b9a: DUP4 00000b9b: ADD 00000b9c: DUP6 00000b9d: PUSH2 0x0a54 00000ba0: JUMP 00000ba1: JUMPDEST 00000ba2: PUSH2 0x0bae 00000ba5: PUSH1 0x40 00000ba7: DUP4 00000ba8: ADD 00000ba9: DUP5 00000baa: PUSH2 0x0aa7 00000bad: JUMP 00000bae: JUMPDEST 00000baf: SWAP5 00000bb0: SWAP4 00000bb1: POP 00000bb2: POP 00000bb3: POP 00000bb4: POP 00000bb5: JUMP 00000bb6: JUMPDEST 00000bb7: PUSH32 0x4e487b7100000000000000000000000000000000000000000000000000000000 00000bd8: PUSH0 00000bd9: MSTORE 00000bda: PUSH1 0x11 00000bdc: PUSH1 0x04 00000bde: MSTORE 00000bdf: PUSH1 0x24 00000be1: PUSH0 00000be2: REVERT 00000be3: JUMPDEST 00000be4: PUSH0 00000be5: PUSH2 0x0bed 00000be8: DUP3 00000be9: PUSH2 0x09e3 00000bec: JUMP 00000bed: JUMPDEST 00000bee: SWAP2 00000bef: POP 00000bf0: PUSH2 0x0bf8 00000bf3: DUP4 00000bf4: PUSH2 0x09e3 00000bf7: JUMP 00000bf8: JUMPDEST 00000bf9: SWAP3 00000bfa: POP 00000bfb: DUP3 00000bfc: DUP3 00000bfd: MUL 00000bfe: PUSH2 0x0c06 00000c01: DUP2 00000c02: PUSH2 0x09e3 00000c05: JUMP 00000c06: JUMPDEST 00000c07: SWAP2 00000c08: POP 00000c09: DUP3 00000c0a: DUP3 00000c0b: DIV 00000c0c: DUP5 00000c0d: EQ 00000c0e: DUP4 00000c0f: ISZERO 00000c10: OR 00000c11: PUSH2 0x0c1d 00000c14: JUMPI 00000c15: PUSH2 0x0c1c 00000c18: PUSH2 0x0bb6 00000c1b: JUMP 00000c1c: JUMPDEST 00000c1d: JUMPDEST 00000c1e: POP 00000c1f: SWAP3 00000c20: SWAP2 00000c21: POP 00000c22: POP 00000c23: JUMP 00000c24: INVALID 00000c25: LOG2 00000c26: PUSH5 0x6970667358 00000c2c: UNKNOWN(0x22) 00000c2d: SLT 00000c2e: KECCAK256 00000c2f: PUSH2 0xcaa9 00000c32: PUSH15 0xe4502b6f656627392a2be93e841504 00000c42: NUMBER 00000c43: UNKNOWN(0x2C) 00000c44: UNKNOWN(0xAB) 00000c45: UNKNOWN(0x2A) 00000c46: SLT 00000c47: SWAP12 00000c48: UNKNOWN(0xCC) 00000c49: UNKNOWN(0xB0) 00000c4a: XOR 00000c4b: MOD 00000c4c: RETURN 00000c4d: UNKNOWN(0xCF) 00000c4e: UNKNOWN(0x0F) 00000c4f: PUSH5 0x736f6c6343 00000c55: STOP 00000c56: ADDMOD 00000c57: AND 00000c58: STOP 00000c59: CALLER
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | other | detector | Untrusted CALL target/value reachable | 60 | no | no |
viewtrace_id: 0x7057af7d566a75fbb56c56bb39cde89b4aa63594d0534344a99ff391315b0e28
call_targets:
0xe2e1424687eb676b3807693cbb439362b8ea908e
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x7057af7d566a75fbb56c56bb39cde89b4aa63594d0534344a99ff391315b0e28",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xe2e1424687eb676b3807693cbb439362b8ea908e"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xb91cc136",
"selector": "0xb91cc136",
"calldata_variants": [
"0xb91cc136",
"0xb91cc1360000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc1fd7a00",
"selector": "0xc1fd7a00",
"calldata_variants": [
"0xc1fd7a00",
"0xc1fd7a000000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe30c3978",
"selector": "0xe30c3978",
"calldata_variants": [
"0xe30c3978",
"0xe30c39780000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe9cbd822",
"selector": "0xe9cbd822",
"calldata_variants": [
"0xe9cbd822",
"0xe9cbd8220000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf347f505",
"selector": "0xf347f505",
"calldata_variants": [
"0xf347f505",
"0xf347f5050000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x28a1f040",
"selector": "0x28a1f040",
"calldata_variants": [
"0x28a1f040",
"0x28a1f0400000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6ea056a9",
"selector": "0x6ea056a9",
"calldata_variants": [
"0x6ea056a9",
"0x6ea056a90000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 777,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1276,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1548,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 3,
"guards_detected": [],
"untrusted_call_count": 3
}
|
| high | other | detector | ETH value transfer possible | 55 | no | no |
viewtrace_id: 0x7057af7d566a75fbb56c56bb39cde89b4aa63594d0534344a99ff391315b0e28
call_targets:
0xe2e1424687eb676b3807693cbb439362b8ea908e
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x7057af7d566a75fbb56c56bb39cde89b4aa63594d0534344a99ff391315b0e28",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xe2e1424687eb676b3807693cbb439362b8ea908e"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xb91cc136",
"selector": "0xb91cc136",
"calldata_variants": [
"0xb91cc136",
"0xb91cc1360000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc1fd7a00",
"selector": "0xc1fd7a00",
"calldata_variants": [
"0xc1fd7a00",
"0xc1fd7a000000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe30c3978",
"selector": "0xe30c3978",
"calldata_variants": [
"0xe30c3978",
"0xe30c39780000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe9cbd822",
"selector": "0xe9cbd822",
"calldata_variants": [
"0xe9cbd822",
"0xe9cbd8220000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf2fde38b",
"selector": "0xf2fde38b",
"calldata_variants": [
"0xf2fde38b",
"0xf2fde38b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf347f505",
"selector": "0xf347f505",
"calldata_variants": [
"0xf347f505",
"0xf347f5050000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x28a1f040",
"selector": "0x28a1f040",
"calldata_variants": [
"0x28a1f040",
"0x28a1f0400000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6ea056a9",
"selector": "0x6ea056a9",
"calldata_variants": [
"0x6ea056a9",
"0x6ea056a90000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 777,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1276,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1548,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 3,
"guards_detected": []
}
|
| medium | other | codex | Mint amount ignores actual stablecoin received (fee-on-transfer/rebasing tokens) | 75 | no | — |
viewevidence_json{
"evidence": "mint computes aidAmount from the input stablecoinAmount rather than the actual balance increase after transferFrom.",
"locations": [
"contracts/src/Minter/StablecoinMinter.sol:64",
"contracts/src/Minter/StablecoinMinter.sol:66",
"contracts/src/Minter/StablecoinMinter.sol:70"
],
"recommendation": "Measure the stablecoin balance delta before/after transferFrom and mint based on the actual received amount, or explicitly restrict the stablecoin to a fee-free ERC20 and document/enforce that assumption.",
"exploit_scenario": "If the configured stablecoin charges a transfer fee or is rebasing, a user can call mint with a nominal amount (e.g., 100 units), the contract receives fewer tokens, but still mints the full AID amount. Repeating this mints unbacked AID and breaks the 1:1 collateral invariant."
}
|
| low | access_control | codex | Owner can sweep collateral, leaving minted AID unbacked | 65 | no | — |
viewevidence_json{
"evidence": "sweep allows the owner to transfer arbitrary stablecoin amounts without any accounting against outstanding AID supply.",
"locations": [
"contracts/src/Minter/StablecoinMinter.sol:80",
"contracts/src/Minter/StablecoinMinter.sol:84",
"contracts/src/Minter/StablecoinMinter.sol:87"
],
"recommendation": "If 1:1 backing is required, remove or strictly constrain sweep (e.g., only excess collateral or after burning AID). If intentional, clearly disclose the trust assumption to users.",
"exploit_scenario": "The owner can call sweep to transfer all stablecoins out of the contract while AID remains in circulation. This leaves users holding unbacked AID with no on-chain collateral."
}
|