bbccc818-bed4-42f3-ab86-cad202273cd6
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 31749 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 95917 | artifact.fetch | failed | 1 / 3 | 1 week ago |
| 95918 | tool.cast_disasm | complete | 1 / 3 | 1 week ago |
| 95919 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 95920 | capability.graph | complete | 1 / 3 | 1 week ago |
| 95921 | detector.run | complete | 1 / 3 | 1 week ago |
| 95922 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
[codex:847604] OpenAI Codex v0.77.0 (research preview)
[codex:847604] --------
[codex:847604] workdir: /tmp/codex-multi-z1hifcbh
[codex:847604] model: gpt-5.2-codex
[codex:847604] provider: openai
[codex:847604] approval: never
[codex:847604] sandbox: read-only
[codex:847604] reasoning effort: xhigh
[codex:847604] reasoning summaries: auto
[codex:847604] session id: 019b8fce-66f4-7400-bf17-57cc8e9140c6
[codex:847604] --------
[codex:847604] user
[codex:847604] You are a profit-focused exploit hunter. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:847604]
[codex:847604] Read `AUDIT_BUNDLE.txt` completely before concluding. Treat `lib/` and `@openzeppelin/` as trusted unless misused.
[codex:847604]
[codex:847604] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:847604] - Gas inefficiency, code quality, naming, or best practices
[codex:847604] - Theoretical vulnerabilities without a clear extraction path
[codex:847604] - Centralization risks (admin can rug) - assume admin keys are secure
[codex:847604] - Front-running unless it enables theft beyond MEV
[codex:847604] - DoS, griefing, or issues that don't result in attacker profit
[codex:847604] - Missing events, view function issues, or informational findings
[codex:847604]
[codex:847604] HIGH-VALUE PATTERNS TO HUNT:
[codex:847604] - Reentrancy: external calls before state updates that allow double-withdrawal
[codex:847604] - Access control: missing/bypassable auth on withdraw, transfer, or mint functions
[codex:847604] - Flash loan attacks: borrow -> manipulate -> profit in single tx
[codex:847604] - Price oracle manipulation: TWAP with short window, spot price reads, stale prices
[codex:847604] - Signature replay: missing nonce, chainId, or deadline in permit/meta-tx
[codex:847604] - Proxy hijacking: unprotected initialize(), storage collision, UUPS without auth
[codex:847604] - Accounting errors: rounding that favors attacker, share inflation, first depositor attacks
[codex:847604] - Unchecked external calls: return value ignored on token transfers enabling fake tokens
[codex:847604] - Cross-function reentrancy: state read in function A, modified via reentrant call, used stale in A
[codex:847604]
[codex:847604] For each finding, you MUST provide:
[codex:847604] 1. Exact file and line numbers of vulnerable code
[codex:847604] 2. Step-by-step exploit transaction sequence
[codex:847604] 3. Estimated profit potential (order of magnitude: contract balance, LP reserves, etc.)
[codex:847604]
[codex:847604] If no concrete profit path exists: set no_findings=true. Do NOT pad with low-severity noise.
[codex:847604]
[codex:847604] Output MUST be valid JSON matching the provided schema.
[codex:847604] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:847604] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:847604] mcp startup: no servers
[codex:847604]
[codex:847604] thinking
[codex:847604] **Preparing to read AUDIT_BUNDLE.txt**
[codex:847604] exec
[codex:847604] /bin/bash -lc ls in /tmp/codex-multi-z1hifcbh succeeded in 5ms:
[codex:847604] AUDIT_BUNDLE.txt
[codex:847604] codex-output-schema.json
[codex:847604] contracts
[codex:847604] exec
[codex:847604] /bin/bash -lc 'cat AUDIT_BUNDLE.txt' in /tmp/codex-multi-z1hifcbh succeeded in 6ms:
[codex:847604] This file concatenates first-party Solidity sources only (lib/@openzeppelin excluded).
[codex:847604]
[codex:847604] ================================================================================
[codex:847604] FILE: contracts/src/ERC4626Migrator.sol
[codex:847604] ================================================================================
[codex:847604] // SPDX-License-Identifier: AGPL-3.0-only
[codex:847604] pragma solidity 0.8.18;
[codex:847604]
[codex:847604] import {ERC20} from "solmate/tokens/ERC20.sol";
[codex:847604] import {SafeTransferLib} from "solmate/utils/SafeTransferLib.sol";
[codex:847604] import {FixedPointMathLib} from "solmate/utils/FixedPointMathLib.sol";
[codex:847604] import {ReentrancyGuard} from "solmate/utils/ReentrancyGuard.sol";
[codex:847604]
[codex:847604] /**
[codex:847604] * @title ERC4626Migrator
[codex:847604] * @author LHerskind
[codex:847604] * @notice Contract to be used for distributing tokens based on their shares of the total supply.
[codex:847604] * Practically LP tokens that can be migrated to WETH, DAI, and USDC.
[codex:847604] * WETH, Dai and USDC held by the contract will be used to distribute to users, so that the contract
[codex:847604] * is funded before users start using it, as they otherwise could simply sacrifice their share of the
[codex:847604]
[codex:847604] thinking
[codex:847604] **Analyzing ERC4626Migrator exploit potential**
[codex:847604]
[codex:847604] I'm working through a detailed exploit analysis of the ERC4626Migrator contract, focusing on how its floatingSupply calculation and token transfers interact. I'm testing if attackers can profit by manipulating floatingSupply via token transfers to the contract or using flash loans. So far, my math shows no profitable scenarios because tokens sent to the contract reduce floatingSupply but don't return assets, preventing gain. I also consider edge cases like zero floatingSupply, reentrancy, and deflationary tokens, but none yield concrete exploits. Overall, it looks secure with no findings, so I'll produce a JSON summary stating no exploit was found.
[codex:847604] codex
[codex:847604] {"no_findings":true,"summary":"Reviewed ERC4626Migrator; no concrete exploit path to extract value found.","findings":[]}
[codex:847604] tokens used
[codex:847604] 8,865
[codex:847604] {"no_findings":true,"summary":"Reviewed ERC4626Migrator; no concrete exploit path to extract value found.","findings":[]}
{
"codex": {
"ran_at": "2026-01-05T20:17:53.648467+00:00",
"returncode": 0
},
"summary": "Reviewed ERC4626Migrator; no concrete exploit path to extract value found.",
"raw_final": {
"summary": "Reviewed ERC4626Migrator; no concrete exploit path to extract value found.",
"findings": [],
"no_findings": true
},
"no_findings": true,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: CALLVALUE 00000006: DUP1 00000007: ISZERO 00000008: PUSH2 0x0010 0000000b: JUMPI 0000000c: PUSH1 0x00 0000000e: DUP1 0000000f: REVERT 00000010: JUMPDEST 00000011: POP 00000012: PUSH1 0x04 00000014: CALLDATASIZE 00000015: LT 00000016: PUSH2 0x0062 00000019: JUMPI 0000001a: PUSH1 0x00 0000001c: CALLDATALOAD 0000001d: PUSH1 0xe0 0000001f: SHR 00000020: DUP1 00000021: PUSH4 0x34981905 00000026: EQ 00000027: PUSH2 0x0067 0000002a: JUMPI 0000002b: DUP1 0000002c: PUSH4 0x6dcb9d01 00000031: EQ 00000032: PUSH2 0x00ab 00000035: JUMPI 00000036: DUP1 00000037: PUSH4 0x8277908b 0000003c: EQ 0000003d: PUSH2 0x00e0 00000040: JUMPI 00000041: DUP1 00000042: PUSH4 0x89a30271 00000047: EQ 00000048: PUSH2 0x010e 0000004b: JUMPI 0000004c: DUP1 0000004d: PUSH4 0xad5c4648 00000052: EQ 00000053: PUSH2 0x0129 00000056: JUMPI 00000057: DUP1 00000058: PUSH4 0xe0bab4c4 0000005d: EQ 0000005e: PUSH2 0x0144 00000061: JUMPI 00000062: JUMPDEST 00000063: PUSH1 0x00 00000065: DUP1 00000066: REVERT 00000067: JUMPDEST 00000068: PUSH2 0x008e 0000006b: PUSH32 0x0000000000000000000000003c66b18f67ca6c1a71f829e2f6a0c987f97462d0 0000008c: DUP2 0000008d: JUMP 0000008e: JUMPDEST 0000008f: PUSH1 0x40 00000091: MLOAD 00000092: PUSH1 0x01 00000094: PUSH1 0x01 00000096: PUSH1 0xa0 00000098: SHL 00000099: SUB 0000009a: SWAP1 0000009b: SWAP2 0000009c: AND 0000009d: DUP2 0000009e: MSTORE 0000009f: PUSH1 0x20 000000a1: ADD 000000a2: JUMPDEST 000000a3: PUSH1 0x40 000000a5: MLOAD 000000a6: DUP1 000000a7: SWAP2 000000a8: SUB 000000a9: SWAP1 000000aa: RETURN 000000ab: JUMPDEST 000000ac: PUSH2 0x00d2 000000af: PUSH32 0x427a506ff6e15bd1b7e4e93da52c8ec95f6af1279618a2f076946e83d8294996 000000d0: DUP2 000000d1: JUMP 000000d2: JUMPDEST 000000d3: PUSH1 0x40 000000d5: MLOAD 000000d6: SWAP1 000000d7: DUP2 000000d8: MSTORE 000000d9: PUSH1 0x20 000000db: ADD 000000dc: PUSH2 0x00a2 000000df: JUMP 000000e0: JUMPDEST 000000e1: PUSH2 0x00f3 000000e4: PUSH2 0x00ee 000000e7: CALLDATASIZE 000000e8: PUSH1 0x04 000000ea: PUSH2 0x0725 000000ed: JUMP 000000ee: JUMPDEST 000000ef: PUSH2 0x015f 000000f2: JUMP 000000f3: JUMPDEST 000000f4: PUSH1 0x40 000000f6: DUP1 000000f7: MLOAD 000000f8: SWAP4 000000f9: DUP5 000000fa: MSTORE 000000fb: PUSH1 0x20 000000fd: DUP5 000000fe: ADD 000000ff: SWAP3 00000100: SWAP1 00000101: SWAP3 00000102: MSTORE 00000103: SWAP1 00000104: DUP3 00000105: ADD 00000106: MSTORE 00000107: PUSH1 0x60 00000109: ADD 0000010a: PUSH2 0x00a2 0000010d: JUMP 0000010e: JUMPDEST 0000010f: PUSH2 0x008e 00000112: PUSH20 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 00000127: DUP2 00000128: JUMP 00000129: JUMPDEST 0000012a: PUSH2 0x008e 0000012d: PUSH20 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2 00000142: DUP2 00000143: JUMP 00000144: JUMPDEST 00000145: PUSH2 0x008e 00000148: PUSH20 0x6b175474e89094c44da98b954eedeac495271d0f 0000015d: DUP2 0000015e: JUMP 0000015f: JUMPDEST 00000160: PUSH1 0x00 00000162: DUP1 00000163: PUSH1 0x00 00000165: DUP1 00000166: SLOAD 00000167: PUSH1 0x01 00000169: EQ 0000016a: PUSH2 0x01a7 0000016d: JUMPI 0000016e: PUSH1 0x40 00000170: MLOAD 00000171: PUSH3 0x461bcd 00000175: PUSH1 0xe5 00000177: SHL 00000178: DUP2 00000179: MSTORE 0000017a: PUSH1 0x20 0000017c: PUSH1 0x04 0000017e: DUP3 0000017f: ADD 00000180: MSTORE 00000181: PUSH1 0x0a 00000183: PUSH1 0x24 00000185: DUP3 00000186: ADD 00000187: MSTORE 00000188: PUSH10 0x5245454e5452414e4359 00000193: PUSH1 0xb0 00000195: SHL 00000196: PUSH1 0x44 00000198: DUP3 00000199: ADD 0000019a: MSTORE 0000019b: PUSH1 0x64 0000019d: ADD 0000019e: JUMPDEST 0000019f: PUSH1 0x40 000001a1: MLOAD 000001a2: DUP1 000001a3: SWAP2 000001a4: SUB 000001a5: SWAP1 000001a6: REVERT 000001a7: JUMPDEST 000001a8: PUSH1 0x02 000001aa: PUSH1 0x00 000001ac: SSTORE 000001ad: PUSH1 0x40 000001af: MLOAD 000001b0: PUSH12 0xffffffffffffffffffffffff 000001bd: NOT 000001be: CALLER 000001bf: PUSH1 0x60 000001c1: SHL 000001c2: AND 000001c3: PUSH1 0x20 000001c5: DUP3 000001c6: ADD 000001c7: MSTORE 000001c8: PUSH32 0x427a506ff6e15bd1b7e4e93da52c8ec95f6af1279618a2f076946e83d8294996 000001e9: PUSH1 0x34 000001eb: DUP3 000001ec: ADD 000001ed: MSTORE 000001ee: PUSH1 0x54 000001f0: ADD 000001f1: PUSH1 0x40 000001f3: MLOAD 000001f4: PUSH1 0x20 000001f6: DUP2 000001f7: DUP4 000001f8: SUB 000001f9: SUB 000001fa: DUP2 000001fb: MSTORE 000001fc: SWAP1 000001fd: PUSH1 0x40 000001ff: MSTORE 00000200: DUP1 00000201: MLOAD 00000202: SWAP1 00000203: PUSH1 0x20 00000205: ADD 00000206: KECCAK256 00000207: DUP5 00000208: EQ 00000209: PUSH2 0x022e 0000020c: JUMPI 0000020d: PUSH1 0x40 0000020f: MLOAD 00000210: PUSH4 0xb55b4077 00000215: PUSH1 0xe0 00000217: SHL 00000218: DUP2 00000219: MSTORE 0000021a: CALLER 0000021b: PUSH1 0x04 0000021d: DUP3 0000021e: ADD 0000021f: MSTORE 00000220: PUSH1 0x24 00000222: DUP2 00000223: ADD 00000224: DUP6 00000225: SWAP1 00000226: MSTORE 00000227: PUSH1 0x44 00000229: ADD 0000022a: PUSH2 0x019e 0000022d: JUMP 0000022e: JUMPDEST 0000022f: PUSH1 0x00 00000231: DUP1 00000232: PUSH1 0x00 00000234: PUSH2 0x023c 00000237: DUP9 00000238: PUSH2 0x0344 0000023b: JUMP 0000023c: JUMPDEST 0000023d: SWAP2 0000023e: SWAP5 0000023f: POP 00000240: SWAP3 00000241: POP 00000242: SWAP1 00000243: POP 00000244: PUSH2 0x0278 00000247: PUSH1 0x01 00000249: PUSH1 0x01 0000024b: PUSH1 0xa0 0000024d: SHL 0000024e: SUB 0000024f: PUSH32 0x0000000000000000000000003c66b18f67ca6c1a71f829e2f6a0c987f97462d0 00000270: AND 00000271: CALLER 00000272: ADDRESS 00000273: DUP12 00000274: PUSH2 0x05ff 00000277: JUMP 00000278: JUMPDEST 00000279: DUP3 0000027a: ISZERO 0000027b: PUSH2 0x029d 0000027e: JUMPI 0000027f: PUSH2 0x029d 00000282: PUSH20 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2 00000297: CALLER 00000298: DUP6 00000299: PUSH2 0x0689 0000029c: JUMP 0000029d: JUMPDEST 0000029e: DUP2 0000029f: ISZERO 000002a0: PUSH2 0x02c2 000002a3: JUMPI 000002a4: PUSH2 0x02c2 000002a7: PUSH20 0x6b175474e89094c44da98b954eedeac495271d0f 000002bc: CALLER 000002bd: DUP5 000002be: PUSH2 0x0689 000002c1: JUMP 000002c2: JUMPDEST 000002c3: DUP1 000002c4: ISZERO 000002c5: PUSH2 0x02e7 000002c8: JUMPI 000002c9: PUSH2 0x02e7 000002cc: PUSH20 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 000002e1: CALLER 000002e2: DUP4 000002e3: PUSH2 0x0689 000002e6: JUMP 000002e7: JUMPDEST 000002e8: PUSH1 0x40 000002ea: DUP1 000002eb: MLOAD 000002ec: DUP10 000002ed: DUP2 000002ee: MSTORE 000002ef: PUSH1 0x20 000002f1: DUP2 000002f2: ADD 000002f3: DUP6 000002f4: SWAP1 000002f5: MSTORE 000002f6: SWAP1 000002f7: DUP2 000002f8: ADD 000002f9: DUP4 000002fa: SWAP1 000002fb: MSTORE 000002fc: PUSH1 0x60 000002fe: DUP2 000002ff: ADD 00000300: DUP3 00000301: SWAP1 00000302: MSTORE 00000303: CALLER 00000304: SWAP1 00000305: PUSH32 0x1f2c20404af41d4504d6da6e9e0259c917db4113acf5cd4b059dc4ebf1ad10d9 00000326: SWAP1 00000327: PUSH1 0x80 00000329: ADD 0000032a: PUSH1 0x40 0000032c: MLOAD 0000032d: DUP1 0000032e: SWAP2 0000032f: SUB 00000330: SWAP1 00000331: LOG2 00000332: PUSH1 0x01 00000334: PUSH1 0x00 00000336: SSTORE 00000337: SWAP2 00000338: SWAP8 00000339: SWAP1 0000033a: SWAP7 0000033b: POP 0000033c: SWAP1 0000033d: SWAP5 0000033e: POP 0000033f: SWAP3 00000340: POP 00000341: POP 00000342: POP 00000343: JUMP 00000344: JUMPDEST 00000345: PUSH1 0x40 00000347: MLOAD 00000348: PUSH4 0x70a08231 0000034d: PUSH1 0xe0 0000034f: SHL 00000350: DUP2 00000351: MSTORE 00000352: ADDRESS 00000353: PUSH1 0x04 00000355: DUP3 00000356: ADD 00000357: MSTORE 00000358: PUSH1 0x00 0000035a: SWAP1 0000035b: DUP2 0000035c: SWAP1 0000035d: DUP2 0000035e: SWAP1 0000035f: DUP2 00000360: SWAP1 00000361: PUSH1 0x01 00000363: PUSH1 0x01 00000365: PUSH1 0xa0 00000367: SHL 00000368: SUB 00000369: PUSH32 0x0000000000000000000000003c66b18f67ca6c1a71f829e2f6a0c987f97462d0 0000038a: AND 0000038b: SWAP1 0000038c: PUSH4 0x70a08231 00000391: SWAP1 00000392: PUSH1 0x24 00000394: ADD 00000395: PUSH1 0x20 00000397: PUSH1 0x40 00000399: MLOAD 0000039a: DUP1 0000039b: DUP4 0000039c: SUB 0000039d: DUP2 0000039e: DUP7 0000039f: GAS 000003a0: STATICCALL 000003a1: ISZERO 000003a2: DUP1 000003a3: ISZERO 000003a4: PUSH2 0x03b1 000003a7: JUMPI 000003a8: RETURNDATASIZE 000003a9: PUSH1 0x00 000003ab: DUP1 000003ac: RETURNDATACOPY 000003ad: RETURNDATASIZE 000003ae: PUSH1 0x00 000003b0: REVERT 000003b1: JUMPDEST 000003b2: POP 000003b3: POP 000003b4: POP 000003b5: POP 000003b6: PUSH1 0x40 000003b8: MLOAD 000003b9: RETURNDATASIZE 000003ba: PUSH1 0x1f 000003bc: NOT 000003bd: PUSH1 0x1f 000003bf: DUP3 000003c0: ADD 000003c1: AND 000003c2: DUP3 000003c3: ADD 000003c4: DUP1 000003c5: PUSH1 0x40 000003c7: MSTORE 000003c8: POP 000003c9: DUP2 000003ca: ADD 000003cb: SWAP1 000003cc: PUSH2 0x03d5 000003cf: SWAP2 000003d0: SWAP1 000003d1: PUSH2 0x0747 000003d4: JUMP 000003d5: JUMPDEST 000003d6: PUSH32 0x0000000000000000000000003c66b18f67ca6c1a71f829e2f6a0c987f97462d0 000003f7: PUSH1 0x01 000003f9: PUSH1 0x01 000003fb: PUSH1 0xa0 000003fd: SHL 000003fe: SUB 000003ff: AND 00000400: PUSH4 0x18160ddd 00000405: PUSH1 0x40 00000407: MLOAD 00000408: DUP2 00000409: PUSH4 0xffffffff 0000040e: AND 0000040f: PUSH1 0xe0 00000411: SHL 00000412: DUP2 00000413: MSTORE 00000414: PUSH1 0x04 00000416: ADD 00000417: PUSH1 0x20 00000419: PUSH1 0x40 0000041b: MLOAD 0000041c: DUP1 0000041d: DUP4 0000041e: SUB 0000041f: DUP2 00000420: DUP7 00000421: GAS 00000422: STATICCALL 00000423: ISZERO 00000424: DUP1 00000425: ISZERO 00000426: PUSH2 0x0433 00000429: JUMPI 0000042a: RETURNDATASIZE 0000042b: PUSH1 0x00 0000042d: DUP1 0000042e: RETURNDATACOPY 0000042f: RETURNDATASIZE 00000430: PUSH1 0x00 00000432: REVERT 00000433: JUMPDEST 00000434: POP 00000435: POP 00000436: POP 00000437: POP 00000438: PUSH1 0x40 0000043a: MLOAD 0000043b: RETURNDATASIZE 0000043c: PUSH1 0x1f 0000043e: NOT 0000043f: PUSH1 0x1f 00000441: DUP3 00000442: ADD 00000443: AND 00000444: DUP3 00000445: ADD 00000446: DUP1 00000447: PUSH1 0x40 00000449: MSTORE 0000044a: POP 0000044b: DUP2 0000044c: ADD 0000044d: SWAP1 0000044e: PUSH2 0x0457 00000451: SWAP2 00000452: SWAP1 00000453: PUSH2 0x0747 00000456: JUMP 00000457: JUMPDEST 00000458: PUSH2 0x0461 0000045b: SWAP2 0000045c: SWAP1 0000045d: PUSH2 0x0760 00000460: JUMP 00000461: JUMPDEST 00000462: PUSH1 0x40 00000464: MLOAD 00000465: PUSH4 0x70a08231 0000046a: PUSH1 0xe0 0000046c: SHL 0000046d: DUP2 0000046e: MSTORE 0000046f: ADDRESS 00000470: PUSH1 0x04 00000472: DUP3 00000473: ADD 00000474: MSTORE 00000475: SWAP1 00000476: SWAP2 00000477: POP 00000478: PUSH1 0x00 0000047a: SWAP1 0000047b: PUSH2 0x04e6 0000047e: SWAP1 0000047f: PUSH20 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2 00000494: SWAP1 00000495: PUSH4 0x70a08231 0000049a: SWAP1 0000049b: PUSH1 0x24 0000049d: ADD 0000049e: PUSH1 0x20 000004a0: PUSH1 0x40 000004a2: MLOAD 000004a3: DUP1 000004a4: DUP4 000004a5: SUB 000004a6: DUP2 000004a7: DUP7 000004a8: GAS 000004a9: STATICCALL 000004aa: ISZERO 000004ab: DUP1 000004ac: ISZERO 000004ad: PUSH2 0x04ba 000004b0: JUMPI 000004b1: RETURNDATASIZE 000004b2: PUSH1 0x00 000004b4: DUP1 000004b5: RETURNDATACOPY 000004b6: RETURNDATASIZE 000004b7: PUSH1 0x00 000004b9: REVERT 000004ba: JUMPDEST 000004bb: POP 000004bc: POP 000004bd: POP 000004be: POP 000004bf: PUSH1 0x40 000004c1: MLOAD 000004c2: RETURNDATASIZE 000004c3: PUSH1 0x1f 000004c5: NOT 000004c6: PUSH1 0x1f 000004c8: DUP3 000004c9: ADD 000004ca: AND 000004cb: DUP3 000004cc: ADD 000004cd: DUP1 000004ce: PUSH1 0x40 000004d0: MSTORE 000004d1: POP 000004d2: DUP2 000004d3: ADD 000004d4: SWAP1 000004d5: PUSH2 0x04de 000004d8: SWAP2 000004d9: SWAP1 000004da: PUSH2 0x0747 000004dd: JUMP 000004de: JUMPDEST 000004df: DUP8 000004e0: SWAP1 000004e1: DUP5 000004e2: PUSH2 0x0707 000004e5: JUMP 000004e6: JUMPDEST 000004e7: PUSH1 0x40 000004e9: MLOAD 000004ea: PUSH4 0x70a08231 000004ef: PUSH1 0xe0 000004f1: SHL 000004f2: DUP2 000004f3: MSTORE 000004f4: ADDRESS 000004f5: PUSH1 0x04 000004f7: DUP3 000004f8: ADD 000004f9: MSTORE 000004fa: SWAP1 000004fb: SWAP2 000004fc: POP 000004fd: PUSH1 0x00 000004ff: SWAP1 00000500: PUSH2 0x056b 00000503: SWAP1 00000504: PUSH20 0x6b175474e89094c44da98b954eedeac495271d0f 00000519: SWAP1 0000051a: PUSH4 0x70a08231 0000051f: SWAP1 00000520: PUSH1 0x24 00000522: ADD 00000523: PUSH1 0x20 00000525: PUSH1 0x40 00000527: MLOAD 00000528: DUP1 00000529: DUP4 0000052a: SUB 0000052b: DUP2 0000052c: DUP7 0000052d: GAS 0000052e: STATICCALL 0000052f: ISZERO 00000530: DUP1 00000531: ISZERO 00000532: PUSH2 0x053f 00000535: JUMPI 00000536: RETURNDATASIZE 00000537: PUSH1 0x00 00000539: DUP1 0000053a: RETURNDATACOPY 0000053b: RETURNDATASIZE 0000053c: PUSH1 0x00 0000053e: REVERT 0000053f: JUMPDEST 00000540: POP 00000541: POP 00000542: POP 00000543: POP 00000544: PUSH1 0x40 00000546: MLOAD 00000547: RETURNDATASIZE 00000548: PUSH1 0x1f 0000054a: NOT 0000054b: PUSH1 0x1f 0000054d: DUP3 0000054e: ADD 0000054f: AND 00000550: DUP3 00000551: ADD 00000552: DUP1 00000553: PUSH1 0x40 00000555: MSTORE 00000556: POP 00000557: DUP2 00000558: ADD 00000559: SWAP1 0000055a: PUSH2 0x0563 0000055d: SWAP2 0000055e: SWAP1 0000055f: PUSH2 0x0747 00000562: JUMP 00000563: JUMPDEST 00000564: DUP9 00000565: SWAP1 00000566: DUP6 00000567: PUSH2 0x0707 0000056a: JUMP 0000056b: JUMPDEST 0000056c: PUSH1 0x40 0000056e: MLOAD 0000056f: PUSH4 0x70a08231 00000574: PUSH1 0xe0 00000576: SHL 00000577: DUP2 00000578: MSTORE 00000579: ADDRESS 0000057a: PUSH1 0x04 0000057c: DUP3 0000057d: ADD 0000057e: MSTORE 0000057f: SWAP1 00000580: SWAP2 00000581: POP 00000582: PUSH1 0x00 00000584: SWAP1 00000585: PUSH2 0x05f0 00000588: SWAP1 00000589: PUSH20 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 0000059e: SWAP1 0000059f: PUSH4 0x70a08231 000005a4: SWAP1 000005a5: PUSH1 0x24 000005a7: ADD 000005a8: PUSH1 0x20 000005aa: PUSH1 0x40 000005ac: MLOAD 000005ad: DUP1 000005ae: DUP4 000005af: SUB 000005b0: DUP2 000005b1: DUP7 000005b2: GAS 000005b3: STATICCALL 000005b4: ISZERO 000005b5: DUP1 000005b6: ISZERO 000005b7: PUSH2 0x05c4 000005ba: JUMPI 000005bb: RETURNDATASIZE 000005bc: PUSH1 0x00 000005be: DUP1 000005bf: RETURNDATACOPY 000005c0: RETURNDATASIZE 000005c1: PUSH1 0x00 000005c3: REVERT 000005c4: JUMPDEST 000005c5: POP 000005c6: POP 000005c7: POP 000005c8: POP 000005c9: PUSH1 0x40 000005cb: MLOAD 000005cc: RETURNDATASIZE 000005cd: PUSH1 0x1f 000005cf: NOT 000005d0: PUSH1 0x1f 000005d2: DUP3 000005d3: ADD 000005d4: AND 000005d5: DUP3 000005d6: ADD 000005d7: DUP1 000005d8: PUSH1 0x40 000005da: MSTORE 000005db: POP 000005dc: DUP2 000005dd: ADD 000005de: SWAP1 000005df: PUSH2 0x05e8 000005e2: SWAP2 000005e3: SWAP1 000005e4: PUSH2 0x0747 000005e7: JUMP 000005e8: JUMPDEST 000005e9: DUP10 000005ea: SWAP1 000005eb: DUP7 000005ec: PUSH2 0x0707 000005ef: JUMP 000005f0: JUMPDEST 000005f1: SWAP3 000005f2: SWAP9 000005f3: SWAP2 000005f4: SWAP8 000005f5: POP 000005f6: SWAP2 000005f7: SWAP6 000005f8: POP 000005f9: SWAP4 000005fa: POP 000005fb: POP 000005fc: POP 000005fd: POP 000005fe: JUMP 000005ff: JUMPDEST 00000600: PUSH1 0x00 00000602: PUSH1 0x40 00000604: MLOAD 00000605: PUSH4 0x23b872dd 0000060a: PUSH1 0xe0 0000060c: SHL 0000060d: DUP2 0000060e: MSTORE 0000060f: DUP5 00000610: PUSH1 0x04 00000612: DUP3 00000613: ADD 00000614: MSTORE 00000615: DUP4 00000616: PUSH1 0x24 00000618: DUP3 00000619: ADD 0000061a: MSTORE 0000061b: DUP3 0000061c: PUSH1 0x44 0000061e: DUP3 0000061f: ADD 00000620: MSTORE 00000621: PUSH1 0x20 00000623: PUSH1 0x00 00000625: PUSH1 0x64 00000627: DUP4 00000628: PUSH1 0x00 0000062a: DUP11 0000062b: GAS 0000062c: CALL 0000062d: RETURNDATASIZE 0000062e: ISZERO 0000062f: PUSH1 0x1f 00000631: RETURNDATASIZE 00000632: GT 00000633: PUSH1 0x01 00000635: PUSH1 0x00 00000637: MLOAD 00000638: EQ 00000639: AND 0000063a: OR 0000063b: AND 0000063c: SWAP2 0000063d: POP 0000063e: POP 0000063f: DUP1 00000640: PUSH2 0x0682 00000643: JUMPI 00000644: PUSH1 0x40 00000646: MLOAD 00000647: PUSH3 0x461bcd 0000064b: PUSH1 0xe5 0000064d: SHL 0000064e: DUP2 0000064f: MSTORE 00000650: PUSH1 0x20 00000652: PUSH1 0x04 00000654: DUP3 00000655: ADD 00000656: MSTORE 00000657: PUSH1 0x14 00000659: PUSH1 0x24 0000065b: DUP3 0000065c: ADD 0000065d: MSTORE 0000065e: PUSH20 0x1514905394d1915497d19493d357d19052531151 00000673: PUSH1 0x62 00000675: SHL 00000676: PUSH1 0x44 00000678: DUP3 00000679: ADD 0000067a: MSTORE 0000067b: PUSH1 0x64 0000067d: ADD 0000067e: PUSH2 0x019e 00000681: JUMP 00000682: JUMPDEST 00000683: POP 00000684: POP 00000685: POP 00000686: POP 00000687: POP 00000688: JUMP 00000689: JUMPDEST 0000068a: PUSH1 0x00 0000068c: PUSH1 0x40 0000068e: MLOAD 0000068f: PUSH4 0xa9059cbb 00000694: PUSH1 0xe0 00000696: SHL 00000697: DUP2 00000698: MSTORE 00000699: DUP4 0000069a: PUSH1 0x04 0000069c: DUP3 0000069d: ADD 0000069e: MSTORE 0000069f: DUP3 000006a0: PUSH1 0x24 000006a2: DUP3 000006a3: ADD 000006a4: MSTORE 000006a5: PUSH1 0x20 000006a7: PUSH1 0x00 000006a9: PUSH1 0x44 000006ab: DUP4 000006ac: PUSH1 0x00 000006ae: DUP10 000006af: GAS 000006b0: CALL 000006b1: RETURNDATASIZE 000006b2: ISZERO 000006b3: PUSH1 0x1f 000006b5: RETURNDATASIZE 000006b6: GT 000006b7: PUSH1 0x01 000006b9: PUSH1 0x00 000006bb: MLOAD 000006bc: EQ 000006bd: AND 000006be: OR 000006bf: AND 000006c0: SWAP2 000006c1: POP 000006c2: POP 000006c3: DUP1 000006c4: PUSH2 0x0701 000006c7: JUMPI 000006c8: PUSH1 0x40 000006ca: MLOAD 000006cb: PUSH3 0x461bcd 000006cf: PUSH1 0xe5 000006d1: SHL 000006d2: DUP2 000006d3: MSTORE 000006d4: PUSH1 0x20 000006d6: PUSH1 0x04 000006d8: DUP3 000006d9: ADD 000006da: MSTORE 000006db: PUSH1 0x0f 000006dd: PUSH1 0x24 000006df: DUP3 000006e0: ADD 000006e1: MSTORE 000006e2: PUSH15 0x1514905394d1915497d19052531151 000006f2: PUSH1 0x8a 000006f4: SHL 000006f5: PUSH1 0x44 000006f7: DUP3 000006f8: ADD 000006f9: MSTORE 000006fa: PUSH1 0x64 000006fc: ADD 000006fd: PUSH2 0x019e 00000700: JUMP 00000701: JUMPDEST 00000702: POP 00000703: POP 00000704: POP 00000705: POP 00000706: JUMP 00000707: JUMPDEST 00000708: PUSH1 0x00 0000070a: DUP3 0000070b: PUSH1 0x00 0000070d: NOT 0000070e: DIV 0000070f: DUP5 00000710: GT 00000711: DUP4 00000712: MUL 00000713: ISZERO 00000714: DUP3 00000715: MUL 00000716: PUSH2 0x071e 00000719: JUMPI 0000071a: PUSH1 0x00 0000071c: DUP1 0000071d: REVERT 0000071e: JUMPDEST 0000071f: POP 00000720: SWAP2 00000721: MUL 00000722: DIV 00000723: SWAP1 00000724: JUMP 00000725: JUMPDEST 00000726: PUSH1 0x00 00000728: DUP1 00000729: PUSH1 0x40 0000072b: DUP4 0000072c: DUP6 0000072d: SUB 0000072e: SLT 0000072f: ISZERO 00000730: PUSH2 0x0738 00000733: JUMPI 00000734: PUSH1 0x00 00000736: DUP1 00000737: REVERT 00000738: JUMPDEST 00000739: POP 0000073a: POP 0000073b: DUP1 0000073c: CALLDATALOAD 0000073d: SWAP3 0000073e: PUSH1 0x20 00000740: SWAP1 00000741: SWAP2 00000742: ADD 00000743: CALLDATALOAD 00000744: SWAP2 00000745: POP 00000746: JUMP 00000747: JUMPDEST 00000748: PUSH1 0x00 0000074a: PUSH1 0x20 0000074c: DUP3 0000074d: DUP5 0000074e: SUB 0000074f: SLT 00000750: ISZERO 00000751: PUSH2 0x0759 00000754: JUMPI 00000755: PUSH1 0x00 00000757: DUP1 00000758: REVERT 00000759: JUMPDEST 0000075a: POP 0000075b: MLOAD 0000075c: SWAP2 0000075d: SWAP1 0000075e: POP 0000075f: JUMP 00000760: JUMPDEST 00000761: DUP2 00000762: DUP2 00000763: SUB 00000764: DUP2 00000765: DUP2 00000766: GT 00000767: ISZERO 00000768: PUSH2 0x0781 0000076b: JUMPI 0000076c: PUSH4 0x4e487b71 00000771: PUSH1 0xe0 00000773: SHL 00000774: PUSH1 0x00 00000776: MSTORE 00000777: PUSH1 0x11 00000779: PUSH1 0x04 0000077b: MSTORE 0000077c: PUSH1 0x24 0000077e: PUSH1 0x00 00000780: REVERT 00000781: JUMPDEST 00000782: SWAP3 00000783: SWAP2 00000784: POP 00000785: POP 00000786: JUMP 00000787: INVALID 00000788: LOG2 00000789: PUSH5 0x6970667358 0000078f: UNKNOWN(0x22) 00000790: SLT 00000791: KECCAK256 00000792: UNKNOWN(0xE5) 00000793: UNKNOWN(0xDC) 00000794: SELFBALANCE 00000795: JUMPDEST 00000796: ORIGIN 00000797: STATICCALL 00000798: PUSH8 0x0fcc43459a6ecdb3 000007a1: SWAP14 000007a2: UNKNOWN(0xA8) 000007a3: UNKNOWN(0x0E) 000007a4: LOG0 000007a5: BLOBBASEFEE 000007a6: UNKNOWN(0xDC) 000007a7: UNKNOWN(0x22) 000007a8: UNKNOWN(0xCD) 000007a9: UNKNOWN(0xEC) 000007aa: PUSH16 0x010e6574bc958464736f6c6343000812 000007bb: STOP 000007bc: CALLER
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| high | auth | detector | Authorization based on tx.origin | 70 | no | — |
viewvalidation_json{
"reason": "missing sink mapping",
"status": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x34981905",
"selector": "0x34981905",
"calldata_variants": [
"0x34981905",
"0x349819050000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6dcb9d01",
"selector": "0x6dcb9d01",
"calldata_variants": [
"0x6dcb9d01",
"0x6dcb9d010000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8277908b",
"selector": "0x8277908b",
"calldata_variants": [
"0x8277908b",
"0x8277908b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x89a30271",
"selector": "0x89a30271",
"calldata_variants": [
"0x89a30271",
"0x89a302710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xad5c4648",
"selector": "0xad5c4648",
"calldata_variants": [
"0xad5c4648",
"0xad5c46480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe0bab4c4",
"selector": "0xe0bab4c4",
"calldata_variants": [
"0xe0bab4c4",
"0xe0bab4c40000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"guards_detected": [
{
"pc": 1942,
"type": "tx_origin_used"
}
]
}
|
| medium | other | detector | Untrusted CALL target/value reachable | 45 | no | no |
viewtrace_id: 0xd0cf5380b915209c80c9f8b169bf8350c2caa8ddc342fdf9a321ce6700cb0bd7
call_targets:
0xc52b9ae03d971954701b07090c57d993edcfbe79
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0xd0cf5380b915209c80c9f8b169bf8350c2caa8ddc342fdf9a321ce6700cb0bd7",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xc52b9ae03d971954701b07090c57d993edcfbe79"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x34981905",
"selector": "0x34981905",
"calldata_variants": [
"0x34981905",
"0x349819050000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6dcb9d01",
"selector": "0x6dcb9d01",
"calldata_variants": [
"0x6dcb9d01",
"0x6dcb9d010000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8277908b",
"selector": "0x8277908b",
"calldata_variants": [
"0x8277908b",
"0x8277908b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x89a30271",
"selector": "0x89a30271",
"calldata_variants": [
"0x89a30271",
"0x89a302710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xad5c4648",
"selector": "0xad5c4648",
"calldata_variants": [
"0xad5c4648",
"0xad5c46480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe0bab4c4",
"selector": "0xe0bab4c4",
"calldata_variants": [
"0xe0bab4c4",
"0xe0bab4c40000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1580,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1712,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 2,
"guards_detected": [
{
"pc": 1942,
"type": "tx_origin_used"
}
],
"untrusted_call_count": 2
}
|
| medium | other | detector | ETH value transfer possible | 40 | no | no |
viewtrace_id: 0xd0cf5380b915209c80c9f8b169bf8350c2caa8ddc342fdf9a321ce6700cb0bd7
call_targets:
0xc52b9ae03d971954701b07090c57d993edcfbe79
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0xd0cf5380b915209c80c9f8b169bf8350c2caa8ddc342fdf9a321ce6700cb0bd7",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xc52b9ae03d971954701b07090c57d993edcfbe79"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x34981905",
"selector": "0x34981905",
"calldata_variants": [
"0x34981905",
"0x349819050000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x6dcb9d01",
"selector": "0x6dcb9d01",
"calldata_variants": [
"0x6dcb9d01",
"0x6dcb9d010000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8277908b",
"selector": "0x8277908b",
"calldata_variants": [
"0x8277908b",
"0x8277908b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x89a30271",
"selector": "0x89a30271",
"calldata_variants": [
"0x89a30271",
"0x89a302710000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xad5c4648",
"selector": "0xad5c4648",
"calldata_variants": [
"0xad5c4648",
"0xad5c46480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xe0bab4c4",
"selector": "0xe0bab4c4",
"calldata_variants": [
"0xe0bab4c4",
"0xe0bab4c40000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 1580,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1712,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 2,
"guards_detected": [
{
"pc": 1942,
"type": "tx_origin_used"
}
]
}
|