Analysis Run

c9cd9a6d-1d93-4304-8e92-802c612866c8

complete

Chain ID

1

Address

0xdfc0b0a0dc341b6c83267a0121d820f16d3e59c7

Block Number

—

Created

Tue, Dec 30, 2025 3:24 PM

Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract

Confirmed

0

Validated

0

Source

Bytecode only

Review Backing

Present

Best current signal

Untrusted DELEGATECALL target reachable

crit 0 high 0 direct contract

Review Checklist

1. Read the findings table first. Ignore raw jobs until the result looks real.

2. Confirm attacker control, not just the existence of a sink.

3. Confirm money or privilege impact.

4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts

ID	Type	Status	Attempts	Heartbeat
30715	report.consolidate	complete	1 / 1	3 months ago
75286	artifact.fetch	complete	1 / 3	1 week ago
75287	tool.cast_disasm	complete	1 / 3	1 week ago
75288	analysis.bundle	complete	1 / 3	1 week ago
75289	capability.graph	complete	1 / 3	1 week ago
75290	detector.run	complete	1 / 3	1 week ago
75291	validation.fork	complete	1 / 3	1 week ago

Artifact

Runtime bytecode: available

Creation TX: —

Deployer: —

Proxy: no

Implementation:

—

Verified Source: no

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate

Job Status

complete

Attempts

1 / 1

Findings

2

No findings?

no

Summary

Bytecode implements a beacon-style proxy that resolves the implementation via an external resolver each call, with no validation of the resolver response.

View stderr

[codex:587183] OpenAI Codex v0.77.0 (research preview)
[codex:587183] --------
[codex:587183] workdir: /tmp/codex-multi-170xdhrl
[codex:587183] model: gpt-5.2-codex
[codex:587183] provider: openai
[codex:587183] approval: never
[codex:587183] sandbox: read-only
[codex:587183] reasoning effort: xhigh
[codex:587183] reasoning summaries: auto
[codex:587183] session id: 019b6fd9-05e7-71c3-930c-5e0fff0a8555
[codex:587183] --------
[codex:587183] user
[codex:587183] You are a security auditor. You are given EVM runtime bytecode (and possibly a disassembly) for a contract with NO verified source.
[codex:587183] This is best-effort. Do not hallucinate: only flag issues when there's a concrete, explainable angle from bytecode/disasm patterns.
[codex:587183] 
[codex:587183] You MUST read the full `BYTECODE_BUNDLE.txt` before concluding.
[codex:587183] 
[codex:587183] Output MUST be valid JSON matching the provided schema.
[codex:587183] - If you cannot identify a concrete issue from bytecode/disasm alone: set no_findings=true and findings=[].
[codex:587183] - Otherwise: include findings with severity/category/title/evidence and point locations to BYTECODE_BUNDLE.txt line ranges when possible.
[codex:587183] 
[codex:587183] Output constraints (IMPORTANT):
[codex:587183] - severity MUST be exactly one of: info, low, medium, high, critical (lowercase).
[codex:587183] - category MUST be exactly one of: access_control, reentrancy, math, oracle, upgradeability, auth, other.
[codex:587183] mcp startup: no servers
[codex:587183] 
[codex:587183] thinking
[codex:587183] **Listing project files**
[codex:587183] exec
[codex:587183] /bin/bash -lc ls in /tmp/codex-multi-170xdhrl succeeded in 7ms:
[codex:587183] BYTECODE_BUNDLE.txt
[codex:587183] codex-output-schema.json
[codex:587183] 
[codex:587183] thinking
[codex:587183] **Reading full BYTECODE_BUNDLE.txt**
[codex:587183] exec
[codex:587183] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-170xdhrl succeeded in 5ms:
[codex:587183] Runtime bytecode bundle for best-effort auditing.
[codex:587183] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:587183] 
[codex:587183] FILE: runtime_bytecode.hex
[codex:587183] 0x3d3d3d3d3d73f05650328db0fc7cf52b2d23535dfd976f93ce805afa3d82803e368260203750808036602082515af43d82803e903d91603a57fd5bf3
[codex:587183] 
[codex:587183] thinking
[codex:587183] **Analyzing unusual bytecode proxies**
[codex:587183] exec
[codex:587183] /bin/bash -lc "python - <<'PY'
[codex:587183] code = bytes.fromhex('3d3d3d3d3d73f05650328db0fc7cf52b2d23535dfd976f93ce805afa3d82803e368260203750808036602082515af43d82803e903d91603a57fd5bf3')
[codex:587183] 
[codex:587183] # opcode table
[codex:587183] op = {i: f'PUSH{i-0x5f}' for i in range(0x60,0x80)}
[codex:587183] op.update({i: f'DUP{i-0x7f}' for i in range(0x80,0x90)})
[codex:587183] op.update({i: f'SWAP{i-0x8f}' for i in range(0x90,0xa0)})
[codex:587183] op.update({i: f'LOG{i-0xa0}' for i in range(0xa0,0xa5)})
[codex:587183] # add some names
[codex:587183] names = {
[codex:587183] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:587183] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:587183] 0x20:'SHA3',
[codex:587183] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:587183] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:587183] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:587183] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT',
[codex:587183] }
[codex:587183] 
[codex:587183] op.update(names)
[codex:587183] 
[codex:587183] i=0
[codex:587183] while i < len(code):
[codex:587183]     b=code[i]
[codex:587183]     name=op.get(b, f'OP_{b:02x}')
[codex:587183]     if 0x60 <= b <= 0x7f:
[codex:587183]         n=b-0x5f
[codex:587183]         data=code[i+1:i+1+n]
[codex:587183]         print(f'{i:02x}: {name} 0x{data.hex()}')
[codex:587183]         i += 1+n
[codex:587183]     else:
[codex:587183]         print(f'{i:02x}: {name}')
[codex:587183]         i += 1
[codex:587183] PY" in /tmp/codex-multi-170xdhrl succeeded in 37ms:
[codex:587183] 00: RETURNDATASIZE
[codex:587183] 01: RETURNDATASIZE
[codex:587183] 02: RETURNDATASIZE
[codex:587183] 03: RETURNDATASIZE
[codex:587183] 04: RETURNDATASIZE
[codex:587183] 05: PUSH20 0xf05650328db0fc7cf52b2d23535dfd976f93ce80
[codex:587183] 1a: GAS
[codex:587183] 1b: STATICCALL
[codex:587183] 1c: RETURNDATASIZE
[codex:587183] 1d: DUP3
[codex:587183] 1e: DUP1
[codex:587183] 1f: RETURNDATACOPY
[codex:587183] 20: CALLDATASIZE
[codex:587183] 21: DUP3
[codex:587183] 22: PUSH1 0x20
[codex:587183] 24: CALLDATACOPY
[codex:587183] 25: POP
[codex:587183] 26: DUP1
[codex:587183] 27: DUP1
[codex:587183] 28: CALLDATASIZE
[codex:587183] 
[codex:587183] thinking
[codex:587183] **Analyzing proxy call patterns and risks**
[codex:587183] exec
[codex:587183] /bin/bash -lc 'cat codex-output-schema.json' in /tmp/codex-multi-170xdhrl succeeded in 5ms:
[codex:587183] {"type": "object", "additionalProperties": false, "required": ["no_findings", "summary", "findings"], "properties": {"no_findings": {"type": "boolean"}, "summary": {"type": "string"}, "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["severity", "category", "title", "evidence", "locations", "exploit_scenario", "recommendation"], "properties": {"severity": {"type": "string", "enum": ["info", "low", "medium", "high", "critical"]}, "category": {"type": "string", "enum": ["access_control", "reentrancy", "math", "oracle", "upgradeability", "auth", "other"]}, "title": {"type": "string"}, "exploit_scenario": {"type": "string"}, "recommendation": {"type": "string"}, "evidence": {"type": "string"}, "locations": {"type": "array", "items": {"type": "string"}}}}}}}
[codex:587183] 
[codex:587183] thinking
[codex:587183] **Composing detailed security findings JSON**
[codex:587183] 
[codex:587183] I’m putting together a JSON report that flags two concrete issues based on bytecode patterns: upgradeability risks from an external resolver controlling implementation, and unchecked resolver response leading to potential unexpected behavior or DoS. I’m including careful evidence from bytecode instructions, severity levels, categories, exploit scenarios, and recommendations, all aligned with the task’s requirements.
[codex:587183] codex
[codex:587183] {"no_findings":false,"summary":"Bytecode implements a beacon-style proxy that resolves the implementation via an external resolver each call, with no validation of the resolver response.","findings":[{"severity":"info","category":"upgradeability","title":"Implementation address is resolved via external resolver each call","exploit_scenario":"If the resolver contract at the hardcoded address is controlled or upgradeable, its operator can change the implementation address at any time, effectively upgrading or replacing this contract’s logic without changes to the proxy bytecode.","recommendation":"Document and communicate the trust/upgradeability assumption; if immutability is desired, hardcode the implementation or enforce a fixed beacon/timelock and verify the returned address on-chain.","evidence":"Runtime bytecode performs `PUSH20 <resolver> GAS STATICCALL` with empty calldata, then `RETURNDATACOPY` to memory and `MLOAD` the returned word as the target for `DELEGATECALL`.","locations":["BYTECODE_BUNDLE.txt:4"]},{"severity":"low","category":"other","title":"Resolver response and success are not validated before delegatecall","exploit_scenario":"If the resolver reverts or returns less than 32 bytes (or zero), the proxy still `MLOAD`s memory[0] (likely zero) and `DELEGATECALL`s that address, causing unexpected behavior or DoS/empty-success for callers.","recommendation":"Check the `STATICCALL` success flag and require `returndatasize >= 32` before using the returned word; revert on failure or malformed response.","evidence":"After `STATICCALL` the success flag is discarded (POP) and no `RETURNDATASIZE` check occurs before `MLOAD` and `DELEGATECALL`.","locations":["BYTECODE_BUNDLE.txt:4"]}]}
[codex:587183] tokens used
[codex:587183] 22,959
[codex:587183] {"no_findings":false,"summary":"Bytecode implements a beacon-style proxy that resolves the implementation via an external resolver each call, with no validation of the resolver response.","findings":[{"severity":"info","category":"upgradeability","title":"Implementation address is resolved via external resolver each call","exploit_scenario":"If the resolver contract at the hardcoded address is controlled or upgradeable, its operator can change the implementation address at any time, effectively upgrading or replacing this contract’s logic without changes to the proxy bytecode.","recommendation":"Document and communicate the trust/upgradeability assumption; if immutability is desired, hardcode the implementation or enforce a fixed beacon/timelock and verify the returned address on-chain.","evidence":"Runtime bytecode performs `PUSH20 <resolver> GAS STATICCALL` with empty calldata, then `RETURNDATACOPY` to memory and `MLOAD` the returned word as the target for `DELEGATECALL`.","locations":["BYTECODE_BUNDLE.txt:4"]},{"severity":"low","category":"other","title":"Resolver response and success are not validated before delegatecall","exploit_scenario":"If the resolver reverts or returns less than 32 bytes (or zero), the proxy still `MLOAD`s memory[0] (likely zero) and `DELEGATECALL`s that address, causing unexpected behavior or DoS/empty-success for callers.","recommendation":"Check the `STATICCALL` success flag and require `returndatasize >= 32` before using the returned word; revert on failure or malformed response.","evidence":"After `STATICCALL` the success flag is discarded (POP) and no `RETURNDATASIZE` check occurs before `MLOAD` and `DELEGATECALL`.","locations":["BYTECODE_BUNDLE.txt:4"]}]}

Metadata

{
    "codex": {
        "ran_at": "2025-12-30T15:24:14.260178+00:00",
        "returncode": 0
    },
    "summary": "Bytecode implements a beacon-style proxy that resolves the implementation via an external resolver each call, with no validation of the resolver response.",
    "raw_final": {
        "summary": "Bytecode implements a beacon-style proxy that resolves the implementation via an external resolver each call, with no validation of the resolver response.",
        "findings": [
            {
                "title": "Implementation address is resolved via external resolver each call",
                "category": "upgradeability",
                "evidence": "Runtime bytecode performs `PUSH20 <resolver> GAS STATICCALL` with empty calldata, then `RETURNDATACOPY` to memory and `MLOAD` the returned word as the target for `DELEGATECALL`.",
                "severity": "info",
                "locations": [
                    "BYTECODE_BUNDLE.txt:4"
                ],
                "recommendation": "Document and communicate the trust/upgradeability assumption; if immutability is desired, hardcode the implementation or enforce a fixed beacon/timelock and verify the returned address on-chain.",
                "exploit_scenario": "If the resolver contract at the hardcoded address is controlled or upgradeable, its operator can change the implementation address at any time, effectively upgrading or replacing this contract\u2019s logic without changes to the proxy bytecode."
            },
            {
                "title": "Resolver response and success are not validated before delegatecall",
                "category": "other",
                "evidence": "After `STATICCALL` the success flag is discarded (POP) and no `RETURNDATASIZE` check occurs before `MLOAD` and `DELEGATECALL`.",
                "severity": "low",
                "locations": [
                    "BYTECODE_BUNDLE.txt:4"
                ],
                "recommendation": "Check the `STATICCALL` success flag and require `returndatasize >= 32` before using the returned word; revert on failure or malformed response.",
                "exploit_scenario": "If the resolver reverts or returns less than 32 bytes (or zero), the proxy still `MLOAD`s memory[0] (likely zero) and `DELEGATECALL`s that address, causing unexpected behavior or DoS/empty-success for callers."
            }
        ],
        "no_findings": false
    },
    "no_findings": false,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm

Delegatecall

1

Selfdestruct

0

CREATE2

0

CALL-family (heavy)

1

EXT*/BALANCE

0

Total opcodes

37

Flags

delegatecall_present

View cast disassembly output

00000000: RETURNDATASIZE
00000001: RETURNDATASIZE
00000002: RETURNDATASIZE
00000003: RETURNDATASIZE
00000004: RETURNDATASIZE
00000005: PUSH20 0xf05650328db0fc7cf52b2d23535dfd976f93ce80
0000001a: GAS
0000001b: STATICCALL
0000001c: RETURNDATASIZE
0000001d: DUP3
0000001e: DUP1
0000001f: RETURNDATACOPY
00000020: CALLDATASIZE
00000021: DUP3
00000022: PUSH1 0x20
00000024: CALLDATACOPY
00000025: POP
00000026: DUP1
00000027: DUP1
00000028: CALLDATASIZE
00000029: PUSH1 0x20
0000002b: DUP3
0000002c: MLOAD
0000002d: GAS
0000002e: DELEGATECALL
0000002f: RETURNDATASIZE
00000030: DUP3
00000031: DUP1
00000032: RETURNDATACOPY
00000033: SWAP1
00000034: RETURNDATASIZE
00000035: SWAP2
00000036: PUSH1 0x3a
00000038: JUMPI
00000039: REVERT
0000003a: JUMPDEST
0000003b: RETURN

Findings

validated = confirmed for call sinks; sink observed for others

Severity	Category	Tool	Title	Confidence	Validated	Confirmed	Details
critical	upgradeability	detector	Untrusted DELEGATECALL target reachable	70	no	no	view trace_id: 0x986c2ad81181c2d3d3ead4d1eaddf094d66b4f689d08a1cc823420ebcd68e11e call_targets: 0x3e99506fa2643368943065aac0495437834b6f8d target_varies: no classification: constant_target validation_json { "sink": "DELEGATECALL", "errors": 0, "status": "sink_reached", "attempts": 1, "trace_id": "0x986c2ad81181c2d3d3ead4d1eaddf094d66b4f689d08a1cc823420ebcd68e11e", "confirmed": false, "trace_mode": "callTracer", "call_targets": [ "0x3e99506fa2643368943065aac0495437834b6f8d" ], "matched_probe": null, "target_varies": false, "classification": "constant_target" } witness_json { "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata", "constraints": [], "entrypoints": [ { "calldata": "0x", "selector": "fallback", "calldata_variants": [ "0x" ] } ] } evidence_json { "examples": [ { "pc": 46, "opcode": "DELEGATECALL", "returndata_checked": null, "value_expression_category": "n/a", "target_expression_category": "computed" } ], "guards_detected": [], "delegatecall_count": 1, "untrusted_delegatecall_count": 1 }
medium	upgradeability	cast	DELEGATECALL present	80	no	—	view evidence_json { "notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns", "delegatecall_count": 1 }
low	other	codex	Resolver response and success are not validated before delegatecall	65	no	—	view evidence_json { "evidence": "After `STATICCALL` the success flag is discarded (POP) and no `RETURNDATASIZE` check occurs before `MLOAD` and `DELEGATECALL`.", "locations": [ "BYTECODE_BUNDLE.txt:4" ], "recommendation": "Check the `STATICCALL` success flag and require `returndatasize >= 32` before using the returned word; revert on failure or malformed response.", "exploit_scenario": "If the resolver reverts or returns less than 32 bytes (or zero), the proxy still `MLOAD`s memory[0] (likely zero) and `DELEGATECALL`s that address, causing unexpected behavior or DoS/empty-success for callers." }
info	upgradeability	codex	Implementation address is resolved via external resolver each call	60	no	—	view evidence_json { "evidence": "Runtime bytecode performs `PUSH20 <resolver> GAS STATICCALL` with empty calldata, then `RETURNDATACOPY` to memory and `MLOAD` the returned word as the target for `DELEGATECALL`.", "locations": [ "BYTECODE_BUNDLE.txt:4" ], "recommendation": "Document and communicate the trust/upgradeability assumption; if immutability is desired, hardcode the implementation or enforce a fixed beacon/timelock and verify the returned address on-chain.", "exploit_scenario": "If the resolver contract at the hardcoded address is controlled or upgradeable, its operator can change the implementation address at any time, effectively upgrading or replacing this contract\u2019s logic without changes to the proxy bytecode." }