cff5d260-1ec7-4624-b2c8-dc125bd96a9d
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 31612 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 111470 | artifact.fetch | complete | 1 / 3 | 1 week ago |
| 111471 | tool.cast_disasm | complete | 1 / 3 | 1 week ago |
| 111472 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 111473 | capability.graph | complete | 1 / 3 | 1 week ago |
| 111474 | detector.run | complete | 1 / 3 | 1 week ago |
| 111475 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
[codex:448248] OpenAI Codex v0.77.0 (research preview)
[codex:448248] --------
[codex:448248] workdir: /tmp/codex-multi-wduvfb94
[codex:448248] model: gpt-5.2-codex
[codex:448248] provider: openai
[codex:448248] approval: never
[codex:448248] sandbox: read-only
[codex:448248] reasoning effort: xhigh
[codex:448248] reasoning summaries: auto
[codex:448248] session id: 019b883c-c1c0-78f1-8d56-9dd2b4e3f205
[codex:448248] --------
[codex:448248] user
[codex:448248] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:448248]
[codex:448248] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:448248]
[codex:448248] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:448248] - Gas inefficiency, code quality, or best practices
[codex:448248] - Theoretical vulnerabilities without a clear extraction path
[codex:448248] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:448248] - Issues requiring social engineering or off-chain coordination
[codex:448248]
[codex:448248] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:448248] - CALL/DELEGATECALL with controllable destination or calldata
[codex:448248] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:448248] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:448248] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:448248] - External calls before state updates (reentrancy)
[codex:448248] - SELFDESTRUCT with controllable beneficiary
[codex:448248] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:448248]
[codex:448248] For each finding, you MUST explain:
[codex:448248] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:448248] 2. The concrete sequence of transactions to extract value
[codex:448248] 3. Why you believe this is exploitable (not just suspicious)
[codex:448248]
[codex:448248] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:448248] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:448248]
[codex:448248] Output MUST be valid JSON matching the provided schema.
[codex:448248] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:448248] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:448248] mcp startup: no servers
[codex:448248]
[codex:448248] thinking
[codex:448248] **Checking user skills and reading BYTECODE_BUNDLE.txt**
[codex:448248] exec
[codex:448248] /bin/bash -lc ls in /tmp/codex-multi-wduvfb94 succeeded in 6ms:
[codex:448248] BYTECODE_BUNDLE.txt
[codex:448248] codex-output-schema.json
[codex:448248] exec
[codex:448248] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-wduvfb94 succeeded in 5ms:
[codex:448248] Runtime bytecode bundle for best-effort auditing.
[codex:448248] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:448248]
[codex:448248] FILE: runtime_bytecode.hex
[codex:448248] 0x6080604052600436106100e15760003560e060020a9004806392e35aac11610083578063e32476481161005d578063e3247648146102e9578063edaad3c3146102fe578063f602dd0614610313578063feea022614610346576100e1565b806392e35aac146102455780639570f9011461026f578063d7f3de83146102d4576100e1565b806345f09ce9116100bf57806345f09ce9146101645780635a49f471146101d1578063785df1a1146101fb5780638242661914610230576100e1565b8063182d37e3146100f75780632626921b1461011e57806331430c8b14610133575b6004805434908101909155600380549091019055005b34801561010357600080fd5b5061010c61035b565b60408051918252519081900360200190f35b34801561012a57600080fd5b5061010c610361565b34801561013f57600080fd5b50610148610367565b60408051600160a060020a039092168252519081900360200190f35b34801561017057600080fd5b50610179610376565b604080519b8c5260208c019a909a528a8a019890985260608a0196909652608089019490945260a088019290925260c087015260e0860152610100850152610120840152151561014083015251908190036101600190f35b3480156101dd57600080fd5b50610148600480360360208110156101f457600080fd5b5035610863565b34801561020757600080fd5b5061022e6004803603602081101561021e57600080fd5b5035600160a060020a031661088a565b005b34801561023c57600080fd5b5061010c610943565b34801561025157600080fd5b5061010c6004803603602081101561026857600080fd5b5035610949565b34801561027b57600080fd5b50610284610967565b60408051602080825283518183015283519192839290830191858101910280838360005b838110156102c05781810151838201526020016102a8565b505050509050019250505060405180910390f35b3480156102e057600080fd5b506101486109ca565b3480156102f557600080fd5b5061022e6109d9565b34801561030a57600080fd5b5061010c610c3b565b34801561031f57600080fd5b5061022e6004803603602081101561033657600080fd5b5035600160a060020a0316610c4e565b34801561035257600080fd5b5061022e610dc8565b60045481565b60065481565b600754600160a060020a031681565b60008060008060008060008060008060006004549a50600760009054906101000a9004600160a060020a0316600160a060020a031663f6afe4f760016040518263ffffffff1660e060020a0281526004018082815260200191505060006040518083038186803b1580156103e957600080fd5b505afa1580156103fd573d6000803e3d6000fd5b505050506040513d6000823e601f3d908101601f19168201604052602081101561042657600080fd5b81019080805164010000000081111561043e57600080fd5b8201602081018481111561045157600080fd5b815185602082028301116401000000008211171561046e57600080fd5b5050516007546040805160e060020a63f6afe4f7028152600260048201529051929f50600160a060020a03909116945063f6afe4f793506024808201935060009291829003018186803b1580156104c457600080fd5b505afa1580156104d8573d6000803e3d6000fd5b505050506040513d6000823e601f3d908101601f19168201604052602081101561050157600080fd5b81019080805164010000000081111561051957600080fd5b8201602081018481111561052c57600080fd5b815185602082028301116401000000008211171561054957600080fd5b5050516007546040805160e060020a63f6afe4f7028152600360048201529051929e50600160a060020a03909116945063f6afe4f793506024808201935060009291829003018186803b15801561059f57600080fd5b505afa1580156105b3573d6000803e3d6000fd5b505050506040513d6000823e601f3d908101601f1916820160405260208110156105dc57600080fd5b8101908080516401000000008111156105f457600080fd5b8201602081018481111561060757600080fd5b815185602082028301116401000000008211171561062457600080fd5b5050516007546040805160e060020a63f6afe4f70281526004818101529051929d50600160a060020a03909116945063f6afe4f793506024808201935060009291829003018186803b15801561067957600080fd5b505afa15801561068d573d6000803e3d6000fd5b505050506040513d6000823e601f3d908101601f1916820160405260208110156106b657600080fd5b8101908080516401000000008111156106ce57600080fd5b820160208101848111156106e157600080fd5b81518560208202830111640100000000821117156106fe57600080fd5b5050929190505050519650896064600860018154811061071a57fe5b90600052602060002001548d028161072e57fe5b048161073657fe5b049550886064600860028154811061074a57fe5b90600052602060002001548d028161075e57fe5b048161076657fe5b049450876064600860038154811061077a57fe5b90600052602060002001548d028161078e57fe5b048161079657fe5b04935086606460086004815481106107aa57fe5b90600052602060002001548d02816107be57fe5b04816107c657fe5b0492506006549150733bd98cd3499d084bf9eda554bca6a4d8a608a42963cb1511126040518163ffffffff1660e060020a02815260040160206040518083038186803b15801561081557600080fd5b505af4158015610829573d6000803e3d6000fd5b505050506040513d602081101561083f57600080fd5b50519a9b999a98999798969795969495939492939192600702428490031015919050565b6001818154811061087057fe5b600091825260209091200154600160a060020a0316905081565b6000805b6001548110156108db5733600160a060020a0316600182815481106108af57fe5b600091825260209091200154600160a060020a031614156108d357600191506108db565b60010161088e565b50806108e657600080fd5b50600080546001810182559080527f290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e56301805473ffffffffffffffffffffffffffffffffffffffff1916600160a060020a0392909216919091179055565b60035481565b6008818154811061095657fe5b600091825260209091200154905081565b606060008054806020026020016040519081016040528092919081815260200182805480156109bf57602002820191906000526020600020905b8154600160a060020a031681526001909101906020018083116109a1575b505050505090505b90565b600254600160a060020a031681565b6000805b600154811015610a2a5733600160a060020a0316600182815481106109fe57fe5b600091825260209091200154600160a060020a03161415610a225760019150610a2a565b6001016109dd565b5080610a3557600080fd5b600454600060015b6005811015610bf3576007546040805160e060020a63f6afe4f7028152600481018490529051606092600160a060020a03169163f6afe4f7916024808301926000929190829003018186803b158015610a9557600080fd5b505afa158015610aa9573d6000803e3d6000fd5b505050506040513d6000823e601f3d908101601f191682016040526020811015610ad257600080fd5b810190808051640100000000811115610aea57600080fd5b82016020810184811115610afd57600080fd5b8151856020820283011164010000000082111715610b1a57600080fd5b5050805190945015159250610b329150505750610beb565b60008151606460088581548110610b4557fe5b9060005260206000200154870281610b5957fe5b0481610b6157fe5b8351959095019404905060005b8251811015610be757610b94838281518110610b8657fe5b602002602001015183610eaf565b8142848381518110610ba257fe5b6020026020010151600160a060020a03167f577849f524d7a258c2926155a2654340b4c9b7c0491dbf34f0c508488f91390760405160405180910390a4600101610b6e565b5050505b600101610a3d565b506040805182815260208101849052815142927f6948b798f16f0e63888c1ac32860b1a94d311658719b7c7fb6953227b37c28b3928290030190a2610c36610ed1565b505050565b3360009081526005602052604090205490565b6000805b600154811015610c9f5733600160a060020a031660018281548110610c7357fe5b600091825260209091200154600160a060020a03161415610c975760019150610c9f565b600101610c52565b5080610caa57600080fd5b60005b600054811015610c365782600160a060020a031660008281548110610cce57fe5b600091825260209091200154600160a060020a03161415610dbc5760005b60005460001901811015610d6c5760008160010181548110610d0a57fe5b60009182526020822001548154600160a060020a03909116919083908110610d2e57fe5b6000918252602090912001805473ffffffffffffffffffffffffffffffffffffffff1916600160a060020a0392909216919091179055600101610cec565b50600080546000198101908110610d7f57fe5b60009182526020822001805473ffffffffffffffffffffffffffffffffffffffff19169055805490610db5906000198301610ed8565b5050610dc4565b600101610cad565b5050565b33803b908115610e3957604080517f08c379a000000000000000000000000000000000000000000000000000000000815260206004820152600b60248201527f44414f5f5761726e696e67000000000000000000000000000000000000000000604482015290519081900360640190fd5b33600081815260056020526040808220805490839055905190929183156108fc02918491818181858888f19350505050158015610e7a573d6000803e3d6000fd5b506040518190429033907fbddd1ccdc906c307cb4efb86d73316b7d08fed8f446e5a863761b92155fe15aa90600090a4505050565b600160a060020a03909116600090815260056020526040902080549091019055565b6000600455565b815481835581811115610c3657600083815260209020610c369181019083016109c791905b80821115610f115760008155600101610efd565b509056fea165627a7a723058200dae21491fdc9709685aa626e24f6fb70e47b71e67755db9809f8a2f4d51dad90029
[codex:448248]
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing bytecode function selectors and storage**
[codex:448248] thinking
[codex:448248] **Decoding fallback payable logic and deposit handling**
[codex:448248]
[codex:448248] I’m parsing the fallback code that accepts ETH and increments storage slots tracking totals, confirming the contract accepts deposits this way. I’m also examining the complex function that verifies the sender is an EOA, updates a mapping with caller’s data, and makes a call transferring ETH—this looks like a withdrawal or claim function. I want to carefully disassemble that function next to confirm its behavior and check if it could be exploited to profit.
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re,sys
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # simple disasm
[codex:448248] opcodes={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xf6:'',0xf7:'',0xf8:'',0xf9:'',0xfa:'STATICCALL',0xfb:'',0xfc:'',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248]
[codex:448248] # output with offsets
[codex:448248] idx=0
[codex:448248] out=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opcodes.get(op, 'OP_%02x'%op)
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] data=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] out.append((idx//2-1, f\"{name} 0x{data}\"))
[codex:448248] else:
[codex:448248] out.append((idx//2-1, name))
[codex:448248]
[codex:448248] # print some around offset 0xdc0-0xf00
[codex:448248] for off,ins in out:
[codex:448248] if 0xd80<=off<=0xf20:
[codex:448248] print(f\"{off:04x}: {ins}\")
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 35ms:
[codex:448248] 0d81: PUSH1 0x00
[codex:448248] 0d82: SWAP2
[codex:448248] 0d83: DUP3
[codex:448248] 0d84: MSTORE
[codex:448248] 0d86: PUSH1 0x20
[codex:448248] 0d87: DUP3
[codex:448248] 0d88: SHA3
[codex:448248] 0d89: ADD
[codex:448248] 0d8a: DUP1
[codex:448248] 0d8b: SLOAD
[codex:448248] 0da0: PUSH20 0xffffffffffffffffffffffffffffffffffffffff
[codex:448248] 0da1: NOT
[codex:448248] 0da2: AND
[codex:448248] 0da3: SWAP1
[codex:448248] 0da4: SSTORE
[codex:448248] 0da5: DUP1
[codex:448248] 0da6: SLOAD
[codex:448248] 0da7: SWAP1
[codex:448248] 0daa: PUSH2 0x0db5
[codex:448248] 0dab: SWAP1
[codex:448248]
[codex:448248] thinking
[codex:448248] **Examining earlier disassembly regions**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # build disasm
[codex:448248] opcodes={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248] idx=0
[codex:448248] out=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opcodes.get(op, f'OP_{op:02x}')
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] data=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] out.append((idx//2-1, f\"{name} 0x{data}\"))
[codex:448248] else:
[codex:448248] out.append((idx//2-1, name))
[codex:448248]
[codex:448248] for off,ins in out:
[codex:448248] if 0x0a00<=off<=0x0d20:
[codex:448248] print(f\"{off:04x}: {ins}\")
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 27ms:
[codex:448248] 0a00: PUSH1 0x00
[codex:448248] 0a01: SWAP2
[codex:448248] 0a02: DUP3
[codex:448248] 0a03: MSTORE
[codex:448248] 0a05: PUSH1 0x20
[codex:448248] 0a06: SWAP1
[codex:448248] 0a07: SWAP2
[codex:448248] 0a08: SHA3
[codex:448248] 0a09: ADD
[codex:448248] 0a0a: SLOAD
[codex:448248] 0a0c: PUSH1 0x01
[codex:448248] 0a0e: PUSH1 0xa0
[codex:448248] 0a10: PUSH1 0x02
[codex:448248] 0a11: EXP
[codex:448248] 0a12: SUB
[codex:448248] 0a13: AND
[codex:448248] 0a14: EQ
[codex:448248] 0a15: ISZERO
[codex:448248] 0a18: PUSH2 0x0a22
[codex:448248] 0a19: JUMPI
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing membership verification and distribution function**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # disasm
[codex:448248] op={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248] idx=0
[codex:448248] out=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=op.get(op, f'OP_{op:02x}')
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] data=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] out.append((idx//2-1, f\"{name} 0x{data}\"))
[codex:448248] else:
[codex:448248] out.append((idx//2-1, name))
[codex:448248]
[codex:448248] for off,ins in out:
[codex:448248] if 0x0850<=off<=0x0900:
[codex:448248] print(f\"{off:04x}: {ins}\")
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 exited 1 in 34ms:
[codex:448248] Traceback (most recent call last):
[codex:448248] File "<stdin>", line 23, in <module>
[codex:448248] AttributeError: 'int' object has no attribute 'get'
[codex:448248]
[codex:448248] thinking
[codex:448248] **Fixing type bug**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # disasm
[codex:448248] opmap={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248] idx=0
[codex:448248] out=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opmap.get(op, f'OP_{op:02x}')
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] data=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] out.append((idx//2-1, f\"{name} 0x{data}\"))
[codex:448248] else:
[codex:448248] out.append((idx//2-1, name))
[codex:448248]
[codex:448248] for off,ins in out:
[codex:448248] if 0x0850<=off<=0x0900:
[codex:448248] print(f\"{off:04x}: {ins}\")
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 26ms:
[codex:448248] 0850: SWAP4
[codex:448248] 0851: SWAP5
[codex:448248] 0852: SWAP3
[codex:448248] 0853: SWAP4
[codex:448248] 0854: SWAP2
[codex:448248] 0855: SWAP3
[codex:448248] 0857: PUSH1 0x07
[codex:448248] 0858: MUL
[codex:448248] 0859: TIMESTAMP
[codex:448248] 085a: DUP5
[codex:448248] 085b: SWAP1
[codex:448248] 085c: SUB
[codex:448248] 085d: LT
[codex:448248] 085e: ISZERO
[codex:448248] 085f: SWAP2
[codex:448248] 0860: SWAP1
[codex:448248] 0861: POP
[codex:448248] 0862: JUMP
[codex:448248] 0863: JUMPDEST
[codex:448248] 0865: PUSH1 0x01
[codex:448248]
[codex:448248] thinking
[codex:448248] **Investigating function 0x088a behavior**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # disasm
[codex:448248] opmap={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248] idx=0
[codex:448248] out=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opmap.get(op, f'OP_{op:02x}')
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] data=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] out.append((idx//2-1, f\"{name} 0x{data}\"))
[codex:448248] else:
[codex:448248] out.append((idx//2-1, name))
[codex:448248]
[codex:448248] for off,ins in out:
[codex:448248] if 0x08e0<=off<=0x0960:
[codex:448248] print(f\"{off:04x}: {ins}\")
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 28ms:
[codex:448248] 08e0: PUSH2 0x08e6
[codex:448248] 08e1: JUMPI
[codex:448248] 08e3: PUSH1 0x00
[codex:448248] 08e4: DUP1
[codex:448248] 08e5: REVERT
[codex:448248] 08e6: JUMPDEST
[codex:448248] 08e7: POP
[codex:448248] 08e9: PUSH1 0x00
[codex:448248] 08ea: DUP1
[codex:448248] 08eb: SLOAD
[codex:448248] 08ed: PUSH1 0x01
[codex:448248] 08ee: DUP2
[codex:448248] 08ef: ADD
[codex:448248] 08f0: DUP3
[codex:448248] 08f1: SSTORE
[codex:448248] 08f2: SWAP1
[codex:448248] 08f3: DUP1
[codex:448248] 08f4: MSTORE
[codex:448248] 0915: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563
[codex:448248] 0916: ADD
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing contract functions for membership logic**
[codex:448248] exec
[codex:448248] /bin/bash -lc 'which evm || which hevm || which dapp' in /tmp/codex-multi-wduvfb94 exited 1 in 8ms:
[codex:448248]
[codex:448248]
[codex:448248] thinking
[codex:448248] **Checking for pyevmasm installation**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import sys,importlib.util
[codex:448248] print('pyevmasm', importlib.util.find_spec('pyevmasm'))
[codex:448248] print('eth_abi', importlib.util.find_spec('eth_abi'))
[codex:448248] print('evmdasm', importlib.util.find_spec('evmdasm'))
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 18ms:
[codex:448248] pyevmasm None
[codex:448248] eth_abi ModuleSpec(name='eth_abi', loader=<_frozen_importlib_external.SourceFileLoader object at 0x7f832259af50>, origin='/var/www/tripwire/.venv/lib/python3.13/site-packages/eth_abi/__init__.py', submodule_search_locations=['/var/www/tripwire/.venv/lib/python3.13/site-packages/eth_abi'])
[codex:448248] evmdasm None
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing function entry points and stack**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] opmap={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248] idx=0
[codex:448248] out=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opmap.get(op, f'OP_{op:02x}')
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] data=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] out.append((idx//2-1, f\"{name} 0x{data}\"))
[codex:448248] else:
[codex:448248] out.append((idx//2-1, name))
[codex:448248]
[codex:448248] for off,ins in out:
[codex:448248] if 0x0300<=off<=0x0400:
[codex:448248] print(f\"{off:04x}: {ins}\")
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 27ms:
[codex:448248] 0300: DUP1
[codex:448248] 0301: ISZERO
[codex:448248] 0304: PUSH2 0x030a
[codex:448248] 0305: JUMPI
[codex:448248] 0307: PUSH1 0x00
[codex:448248] 0308: DUP1
[codex:448248] 0309: REVERT
[codex:448248] 030a: JUMPDEST
[codex:448248] 030b: POP
[codex:448248] 030e: PUSH2 0x010c
[codex:448248] 0311: PUSH2 0x0c3b
[codex:448248] 0312: JUMP
[codex:448248] 0313: JUMPDEST
[codex:448248] 0314: CALLVALUE
[codex:448248] 0315: DUP1
[codex:448248] 0316: ISZERO
[codex:448248] 0319: PUSH2 0x031f
[codex:448248] 031a: JUMPI
[codex:448248] 031c: PUSH1 0x00
[codex:448248] 031d: DUP1
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing EVM stack and storage patterns**
[codex:448248]
[codex:448248] I'm carefully stepping through EVM bytecode to understand how this function manages a mapping related to the caller, likely zeroing out a balance before making a call that sends ETH from the contract. The stack operations are complex, so I'll build a symbolic stack interpreter to track values and confirm what parameters the CALL uses. This should clarify the function’s behavior and security implications.
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # Build list of (offset, opcode, immediates)
[codex:448248] opmap={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248]
[codex:448248] ops=[]
[codex:448248] idx=0
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opmap.get(op, f'OP_{op:02x}')
[codex:448248] imm=None
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] imm=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] ops.append((off,name,imm))
[codex:448248]
[codex:448248] # Extract ops from 0xe39 to 0xe64
[codex:448248] segment=[o for o in ops if 0xe39<=o[0]<=0xe64]
[codex:448248] for off,name,imm in segment:
[codex:448248] if imm:
[codex:448248] print(f\"{off:04x}: {name} 0x{imm}\")
[codex:448248] else:
[codex:448248] print(f\"{off:04x}: {name}\")
[codex:448248]
[codex:448248] # Simple stack trace
[codex:448248] stack=[]
[codex:448248] mem={'0x40':'mem40'}
[codex:448248]
[codex:448248] def push(x):
[codex:448248] stack.append(x)
[codex:448248]
[codex:448248] def pop():
[codex:448248] return stack.pop() if stack else 'underflow'
[codex:448248]
[codex:448248] # helper to show stack
[codex:448248]
[codex:448248] def show(off,name):
[codex:448248] print(f\"{off:04x} {name:<10} stack: {stack}\")
[codex:448248]
[codex:448248] for off,name,imm in segment:
[codex:448248] if name.startswith('PUSH'):
[codex:448248] push('0x'+imm)
[codex:448248] elif name.startswith('DUP'):
[codex:448248] n=int(name[3:])
[codex:448248] push(stack[-n])
[codex:448248] elif name.startswith('SWAP'):
[codex:448248] n=int(name[4:])
[codex:448248] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:448248] elif name=='CALLER':
[codex:448248] push('caller')
[codex:448248] elif name=='MLOAD':
[codex:448248] # pop offset, push mem[offset]
[codex:448248] offv=pop()
[codex:448248] push(f\"mload({offv})\")
[codex:448248] elif name=='MSTORE':
[codex:448248] val=pop(); offv=pop()
[codex:448248] # store, ignore
[codex:448248] elif name=='SHA3':
[codex:448248] size=pop(); offv=pop(); push(f\"keccak({offv},{size})\")
[codex:448248] elif name=='SLOAD':
[codex:448248] key=pop(); push(f\"sload({key})\")
[codex:448248] elif name=='SSTORE':
[codex:448248] val=pop(); key=pop();
[codex:448248] elif name=='ISZERO':
[codex:448248] v=pop(); push(f\"iszero({v})\")
[codex:448248] elif name=='MUL':
[codex:448248] a=pop(); b=pop(); push(f\"({a}*{b})\")
[codex:448248] elif name=='CALL':
[codex:448248] # record parameters
[codex:448248] gas=pop(); to=pop(); value=pop(); in_off=pop(); in_sz=pop(); out_off=pop(); out_sz=pop();
[codex:448248] push('callret')
[codex:448248] print('CALL args:', {'gas':gas,'to':to,'value':value,'in_off':in_off,'in_sz':in_sz,'out_off':out_off,'out_sz':out_sz})
[codex:448248] else:
[codex:448248] # generic pop/push for ops not handled
[codex:448248] if name in ('ADD','SUB','DIV','AND','OR','XOR','EQ','LT','GT','SLT','SGT','EXP'):
[codex:448248] b=pop(); a=pop(); push(f\"({a}{name}{b})\")
[codex:448248] elif name in ('POP',):
[codex:448248] pop()
[codex:448248] else:
[codex:448248] # ignore unknown
[codex:448248] pass
[codex:448248] #show(off,name)
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 27ms:
[codex:448248] 0e39: JUMPDEST
[codex:448248] 0e3a: CALLER
[codex:448248] 0e3b: PUSH1 0x00
[codex:448248] 0e3d: DUP2
[codex:448248] 0e3e: DUP2
[codex:448248] 0e3f: MSTORE
[codex:448248] 0e40: PUSH1 0x05
[codex:448248] 0e42: PUSH1 0x20
[codex:448248] 0e44: MSTORE
[codex:448248] 0e45: PUSH1 0x40
[codex:448248] 0e47: DUP1
[codex:448248] 0e48: DUP3
[codex:448248] 0e49: SHA3
[codex:448248] 0e4a: DUP1
[codex:448248] 0e4b: SLOAD
[codex:448248] 0e4c: SWAP1
[codex:448248] 0e4d: DUP4
[codex:448248] 0e4e: SWAP1
[codex:448248] 0e4f: SSTORE
[codex:448248] 0e50: SWAP1
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing EVM call and control flow**
[codex:448248]
[codex:448248] I’m investigating the EVM call to understand how gas, value, and caller are computed, noticing potential misinterpretations from incomplete stack tracking and memory modeling. To resolve this, I plan to build a symbolic interpreter starting at function entry to precisely follow stack changes, control flow, and jumps, including JUMPI decisions, aiming to clarify the conditions and state at the call site.
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # build op list
[codex:448248] opmap={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248]
[codex:448248] ops=[]
[codex:448248] idx=0
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opmap.get(op, f'OP_{op:02x}')
[codex:448248] imm=None
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] imm=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] ops.append((off,name,imm))
[codex:448248]
[codex:448248] # map offset->index
[codex:448248] idx_by_off={off:i for i,(off,_,_) in enumerate(ops)}
[codex:448248]
[codex:448248] # Interpreter from 0x0346 to CALL at 0xe64 following success path.
[codex:448248] start=0x0346
[codex:448248] pc=start
[codex:448248] stack=['ret'] # simulate return address? Actually at 0x0346, stack empty. We'll follow and push ret at internal call.
[codex:448248] # We'll track memory and storage symbolically
[codex:448248]
[codex:448248] def push(x):
[codex:448248] stack.append(x)
[codex:448248]
[codex:448248] def pop():
[codex:448248] return stack.pop() if stack else 'underflow'
[codex:448248]
[codex:448248] mem={}
[codex:448248]
[codex:448248] # We'll follow until off == 0xe64
[codex:448248] visited=0
[codex:448248] while True:
[codex:448248] if pc not in idx_by_off:
[codex:448248] print('pc not found', hex(pc)); break
[codex:448248] off,name,imm=ops[idx_by_off[pc]]
[codex:448248] # print step
[codex:448248] # print(f\"{off:04x} {name} {imm or ''} stack:{stack}\")
[codex:448248] # execute
[codex:448248] if name.startswith('PUSH'):
[codex:448248] push('0x'+imm)
[codex:448248] elif name=='CALLVALUE':
[codex:448248] push('callvalue')
[codex:448248] elif name=='CALLER':
[codex:448248] push('caller')
[codex:448248] elif name=='EXTCODESIZE':
[codex:448248] a=pop(); push(f\"extcodesize({a})\")
[codex:448248] elif name=='ISZERO':
[codex:448248] a=pop(); push(f\"iszero({a})\")
[codex:448248] elif name=='DUP1':
[codex:448248] push(stack[-1])
[codex:448248] elif name.startswith('DUP'):
[codex:448248] n=int(name[3:])
[codex:448248] push(stack[-n])
[codex:448248] elif name.startswith('SWAP'):
[codex:448248] n=int(name[4:])
[codex:448248] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:448248] elif name=='POP':
[codex:448248] pop()
[codex:448248] elif name=='MSTORE':
[codex:448248] val=pop(); offv=pop(); mem[offv]=val
[codex:448248] elif name=='MLOAD':
[codex:448248] offv=pop(); push(mem.get(offv,f\"mload({offv})\"))
[codex:448248] elif name=='SHA3':
[codex:448248] size=pop(); offv=pop(); push(f\"keccak({offv},{size})\")
[codex:448248] elif name=='SLOAD':
[codex:448248] key=pop(); push(f\"sload({key})\")
[codex:448248] elif name=='SSTORE':
[codex:448248] val=pop(); key=pop();
[codex:448248] elif name in ('ADD','SUB','MUL','DIV','AND','OR','XOR','EQ','LT','GT','SLT','SGT','EXP'):
[codex:448248] b=pop(); a=pop(); push(f\"({a}{name}{b})\")
[codex:448248] elif name=='JUMPI':
[codex:448248] dest=pop(); cond=pop();
[codex:448248] # decide jump based on pc
[codex:448248] if off==0x034d:
[codex:448248] # callvalue==0 -> jump
[codex:448248] pc=int(dest,16); continue
[codex:448248] if off==0x0dd2:
[codex:448248] # extcodesize check -> jump to 0xe39 for EOA
[codex:448248] pc=int(dest,16); continue
[codex:448248] # default: fallthrough
[codex:448248] elif name=='JUMP':
[codex:448248] dest=pop();
[codex:448248] pc=int(dest,16); continue
[codex:448248] elif name=='CALL':
[codex:448248] gas=pop(); to=pop(); value=pop(); in_off=pop(); in_sz=pop(); out_off=pop(); out_sz=pop();
[codex:448248] print('CALL at', hex(off))
[codex:448248] print('args:', gas,to,value,in_off,in_sz,out_off,out_sz)
[codex:448248] break
[codex:448248] elif name=='REVERT':
[codex:448248] print('revert'); break
[codex:448248] # advance
[codex:448248] pc=ops[idx_by_off[pc]+1][0]
[codex:448248] visited+=1
[codex:448248] if visited>5000:
[codex:448248] print('loop'); break
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 30ms:
[codex:448248] CALL at 0xe64
[codex:448248] args: (iszero(sload(keccak(0x40,0x00)))MUL0x08fc) caller sload(keccak(0x40,0x00)) mload(0x40) 0x00 mload(0x40) 0x00
[codex:448248]
[codex:448248] thinking
[codex:448248] **Reevaluating initial stack setup**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # build op list
[codex:448248] opmap={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248]
[codex:448248] ops=[]
[codex:448248] idx=0
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opmap.get(op, f'OP_{op:02x}')
[codex:448248] imm=None
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] imm=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] ops.append((off,name,imm))
[codex:448248]
[codex:448248] idx_by_off={off:i for i,(off,_,_) in enumerate(ops)}
[codex:448248]
[codex:448248] pc=0x0346
[codex:448248] stack=[]
[codex:448248] mem={}
[codex:448248]
[codex:448248] def push(x):
[codex:448248] stack.append(x)
[codex:448248]
[codex:448248] def pop():
[codex:448248] return stack.pop() if stack else 'underflow'
[codex:448248]
[codex:448248] visited=0
[codex:448248] while True:
[codex:448248] if pc not in idx_by_off:
[codex:448248] print('pc not found', hex(pc)); break
[codex:448248] off,name,imm=ops[idx_by_off[pc]]
[codex:448248] # execute
[codex:448248] if name.startswith('PUSH'):
[codex:448248] push('0x'+imm)
[codex:448248] elif name=='CALLVALUE':
[codex:448248] push('callvalue')
[codex:448248] elif name=='CALLER':
[codex:448248] push('caller')
[codex:448248] elif name=='EXTCODESIZE':
[codex:448248] a=pop(); push(f\"extcodesize({a})\")
[codex:448248] elif name=='ISZERO':
[codex:448248] a=pop(); push(f\"iszero({a})\")
[codex:448248] elif name.startswith('DUP'):
[codex:448248] n=int(name[3:])
[codex:448248] push(stack[-n])
[codex:448248] elif name.startswith('SWAP'):
[codex:448248] n=int(name[4:])
[codex:448248] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:448248] elif name=='POP':
[codex:448248] pop()
[codex:448248] elif name=='MSTORE':
[codex:448248] val=pop(); offv=pop(); mem[offv]=val
[codex:448248] elif name=='MLOAD':
[codex:448248] offv=pop(); push(mem.get(offv,f\"mload({offv})\"))
[codex:448248] elif name=='SHA3':
[codex:448248] size=pop(); offv=pop(); push(f\"keccak({offv},{size})\")
[codex:448248] elif name=='SLOAD':
[codex:448248] key=pop(); push(f\"sload({key})\")
[codex:448248] elif name=='SSTORE':
[codex:448248] val=pop(); key=pop();
[codex:448248] elif name in ('ADD','SUB','MUL','DIV','AND','OR','XOR','EQ','LT','GT','SLT','SGT','EXP'):
[codex:448248] b=pop(); a=pop(); push(f\"({a}{name}{b})\")
[codex:448248] elif name=='JUMPI':
[codex:448248] dest=pop(); cond=pop();
[codex:448248] if off==0x034d:
[codex:448248] pc=int(dest,16); continue
[codex:448248] if off==0x0dd2:
[codex:448248] pc=int(dest,16); continue
[codex:448248] # default fallthrough
[codex:448248] elif name=='JUMP':
[codex:448248] dest=pop();
[codex:448248] pc=int(dest,16); continue
[codex:448248] elif name=='CALL':
[codex:448248] gas=pop(); to=pop(); value=pop(); in_off=pop(); in_sz=pop(); out_off=pop(); out_sz=pop();
[codex:448248] print('CALL at', hex(off))
[codex:448248] print('args:', gas,to,value,in_off,in_sz,out_off,out_sz)
[codex:448248] break
[codex:448248] elif name=='REVERT':
[codex:448248] print('revert'); break
[codex:448248] pc=ops[idx_by_off[pc]+1][0]
[codex:448248] visited+=1
[codex:448248] if visited>8000:
[codex:448248] print('loop'); break
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 29ms:
[codex:448248] CALL at 0xe64
[codex:448248] args: (iszero(sload(keccak(0x40,0x00)))MUL0x08fc) caller sload(keccak(0x40,0x00)) mload(0x40) 0x00 mload(0x40) 0x00
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing memory and stack behavior in interpreter**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # build op list
[codex:448248] opmap={
[codex:448248] 0x00:'STOP',0x01:'ADD',0x02:'MUL',0x03:'SUB',0x04:'DIV',0x05:'SDIV',0x06:'MOD',0x07:'SMOD',0x08:'ADDMOD',0x09:'MULMOD',0x0a:'EXP',0x0b:'SIGNEXTEND',
[codex:448248] 0x10:'LT',0x11:'GT',0x12:'SLT',0x13:'SGT',0x14:'EQ',0x15:'ISZERO',0x16:'AND',0x17:'OR',0x18:'XOR',0x19:'NOT',0x1a:'BYTE',0x1b:'SHL',0x1c:'SHR',0x1d:'SAR',
[codex:448248] 0x20:'SHA3',
[codex:448248] 0x30:'ADDRESS',0x31:'BALANCE',0x32:'ORIGIN',0x33:'CALLER',0x34:'CALLVALUE',0x35:'CALLDATALOAD',0x36:'CALLDATASIZE',0x37:'CALLDATACOPY',0x38:'CODESIZE',0x39:'CODECOPY',0x3a:'GASPRICE',0x3b:'EXTCODESIZE',0x3c:'EXTCODECOPY',0x3d:'RETURNDATASIZE',0x3e:'RETURNDATACOPY',0x3f:'EXTCODEHASH',
[codex:448248] 0x40:'BLOCKHASH',0x41:'COINBASE',0x42:'TIMESTAMP',0x43:'NUMBER',0x44:'DIFFICULTY',0x45:'GASLIMIT',0x46:'CHAINID',0x47:'SELFBALANCE',0x48:'BASEFEE',
[codex:448248] 0x50:'POP',0x51:'MLOAD',0x52:'MSTORE',0x53:'MSTORE8',0x54:'SLOAD',0x55:'SSTORE',0x56:'JUMP',0x57:'JUMPI',0x58:'PC',0x59:'MSIZE',0x5a:'GAS',0x5b:'JUMPDEST',
[codex:448248] 0x60:'PUSH1',0x61:'PUSH2',0x62:'PUSH3',0x63:'PUSH4',0x64:'PUSH5',0x65:'PUSH6',0x66:'PUSH7',0x67:'PUSH8',0x68:'PUSH9',0x69:'PUSH10',0x6a:'PUSH11',0x6b:'PUSH12',0x6c:'PUSH13',0x6d:'PUSH14',0x6e:'PUSH15',0x6f:'PUSH16',
[codex:448248] 0x70:'PUSH17',0x71:'PUSH18',0x72:'PUSH19',0x73:'PUSH20',0x74:'PUSH21',0x75:'PUSH22',0x76:'PUSH23',0x77:'PUSH24',0x78:'PUSH25',0x79:'PUSH26',0x7a:'PUSH27',0x7b:'PUSH28',0x7c:'PUSH29',0x7d:'PUSH30',0x7e:'PUSH31',0x7f:'PUSH32',
[codex:448248] 0x80:'DUP1',0x81:'DUP2',0x82:'DUP3',0x83:'DUP4',0x84:'DUP5',0x85:'DUP6',0x86:'DUP7',0x87:'DUP8',0x88:'DUP9',0x89:'DUP10',0x8a:'DUP11',0x8b:'DUP12',0x8c:'DUP13',0x8d:'DUP14',0x8e:'DUP15',0x8f:'DUP16',
[codex:448248] 0x90:'SWAP1',0x91:'SWAP2',0x92:'SWAP3',0x93:'SWAP4',0x94:'SWAP5',0x95:'SWAP6',0x96:'SWAP7',0x97:'SWAP8',0x98:'SWAP9',0x99:'SWAP10',0x9a:'SWAP11',0x9b:'SWAP12',0x9c:'SWAP13',0x9d:'SWAP14',0x9e:'SWAP15',0x9f:'SWAP16',
[codex:448248] 0xa0:'LOG0',0xa1:'LOG1',0xa2:'LOG2',0xa3:'LOG3',0xa4:'LOG4',
[codex:448248] 0xf0:'CREATE',0xf1:'CALL',0xf2:'CALLCODE',0xf3:'RETURN',0xf4:'DELEGATECALL',0xf5:'CREATE2',0xfa:'STATICCALL',0xfd:'REVERT',0xfe:'INVALID',0xff:'SELFDESTRUCT'
[codex:448248] }
[codex:448248]
[codex:448248] ops=[]
[codex:448248] idx=0
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] name=opmap.get(op, f'OP_{op:02x}')
[codex:448248] imm=None
[codex:448248] if name.startswith('PUSH'):
[codex:448248] n=int(name[4:])
[codex:448248] imm=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] ops.append((off,name,imm))
[codex:448248]
[codex:448248] idx_by_off={off:i for i,(off,_,_) in enumerate(ops)}
[codex:448248]
[codex:448248] pc=0x0346
[codex:448248] stack=[]
[codex:448248] mem={}
[codex:448248]
[codex:448248] def push(x):
[codex:448248] stack.append(x)
[codex:448248]
[codex:448248] def pop():
[codex:448248] return stack.pop() if stack else 'underflow'
[codex:448248]
[codex:448248] visited=0
[codex:448248] while True:
[codex:448248] if pc not in idx_by_off:
[codex:448248] print('pc not found', hex(pc)); break
[codex:448248] off,name,imm=ops[idx_by_off[pc]]
[codex:448248] if 0xe3a <= off <= 0xe64:
[codex:448248] print(f\"{off:04x} {name} {imm or ''} | stack before: {stack}\")
[codex:448248] # execute
[codex:448248] if name.startswith('PUSH'):
[codex:448248] push('0x'+imm)
[codex:448248] elif name=='CALLVALUE':
[codex:448248] push('callvalue')
[codex:448248] elif name=='CALLER':
[codex:448248] push('caller')
[codex:448248] elif name=='EXTCODESIZE':
[codex:448248] a=pop(); push(f\"extcodesize({a})\")
[codex:448248] elif name=='ISZERO':
[codex:448248] a=pop(); push(f\"iszero({a})\")
[codex:448248] elif name.startswith('DUP'):
[codex:448248] n=int(name[3:])
[codex:448248] push(stack[-n])
[codex:448248] elif name.startswith('SWAP'):
[codex:448248] n=int(name[4:])
[codex:448248] stack[-1], stack[-1-n] = stack[-1-n], stack[-1]
[codex:448248] elif name=='POP':
[codex:448248] pop()
[codex:448248] elif name=='MSTORE':
[codex:448248] val=pop(); offv=pop(); mem[offv]=val
[codex:448248] elif name=='MLOAD':
[codex:448248] offv=pop(); push(mem.get(offv,f\"mload({offv})\"))
[codex:448248] elif name=='SHA3':
[codex:448248] size=pop(); offv=pop(); push(f\"keccak({offv},{size})\")
[codex:448248] elif name=='SLOAD':
[codex:448248] key=pop(); push(f\"sload({key})\")
[codex:448248] elif name=='SSTORE':
[codex:448248] val=pop(); key=pop();
[codex:448248] elif name in ('ADD','SUB','MUL','DIV','AND','OR','XOR','EQ','LT','GT','SLT','SGT','EXP'):
[codex:448248] b=pop(); a=pop(); push(f\"({a}{name}{b})\")
[codex:448248] elif name=='JUMPI':
[codex:448248] dest=pop(); cond=pop();
[codex:448248] if off==0x034d:
[codex:448248] pc=int(dest,16); continue
[codex:448248] if off==0x0dd2:
[codex:448248] pc=int(dest,16); continue
[codex:448248] elif name=='JUMP':
[codex:448248] dest=pop();
[codex:448248] pc=int(dest,16); continue
[codex:448248] elif name=='CALL':
[codex:448248] gas=pop(); to=pop(); value=pop(); in_off=pop(); in_sz=pop(); out_off=pop(); out_sz=pop();
[codex:448248] print('CALL args:', gas,to,value,in_off,in_sz,out_off,out_sz)
[codex:448248] break
[codex:448248] elif name=='REVERT':
[codex:448248] print('revert'); break
[codex:448248] pc=ops[idx_by_off[pc]+1][0]
[codex:448248] visited+=1
[codex:448248] if visited>9000:
[codex:448248] print('loop'); break
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 33ms:
[codex:448248] 0e3a CALLER | stack before: ['0x022e', 'extcodesize(caller)', 'caller']
[codex:448248] 0e3b PUSH1 00 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller']
[codex:448248] 0e3d DUP2 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00']
[codex:448248] 0e3e DUP2 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', 'caller']
[codex:448248] 0e3f MSTORE | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', 'caller', '0x00']
[codex:448248] 0e40 PUSH1 05 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00']
[codex:448248] 0e42 PUSH1 20 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x05']
[codex:448248] 0e44 MSTORE | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x05', '0x20']
[codex:448248] 0e45 PUSH1 40 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00']
[codex:448248] 0e47 DUP1 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40']
[codex:448248] 0e48 DUP3 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', '0x40']
[codex:448248] 0e49 SHA3 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', '0x40', '0x00']
[codex:448248] 0e4a DUP1 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', 'keccak(0x40,0x00)']
[codex:448248] 0e4b SLOAD | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', 'keccak(0x40,0x00)', 'keccak(0x40,0x00)']
[codex:448248] 0e4c SWAP1 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', 'keccak(0x40,0x00)', 'sload(keccak(0x40,0x00))']
[codex:448248] 0e4d DUP4 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', 'sload(keccak(0x40,0x00))', 'keccak(0x40,0x00)']
[codex:448248] 0e4e SWAP1 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', 'sload(keccak(0x40,0x00))', 'keccak(0x40,0x00)', '0x00']
[codex:448248] 0e4f SSTORE | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', 'sload(keccak(0x40,0x00))', '0x00', 'keccak(0x40,0x00)']
[codex:448248] 0e50 SWAP1 | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', '0x40', 'sload(keccak(0x40,0x00))']
[codex:448248] 0e51 MLOAD | stack before: ['0x022e', 'extcodesize(caller)', 'caller', 'caller', '0x00', 'sload(keccak(0x40,0x00))', '0x40']
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing CALL opcodes for value transfers**
[codex:448248]
[codex:448248] I'm examining the bytecode to find all CALL instructions to identify potential value transfers, focusing on withdrawals and external calls that might enable unauthorized ETH or token transfers, since the withdrawal function seems to only revert and not offer profit. I'll script a scan for all CALL opcodes to get their locations and analyze their behavior next.
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # find CALL opcode 0xf1
[codex:448248] idx=0
[codex:448248] offsets=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] if 0x60 <= op <= 0x7f:
[codex:448248] n=op-0x5f
[codex:448248] idx+=2*n
[codex:448248] continue
[codex:448248] if op==0xf1:
[codex:448248] offsets.append(off)
[codex:448248]
[codex:448248] print('CALL offsets:', [hex(o) for o in offsets])
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 25ms:
[codex:448248] CALL offsets: ['0xe64']
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing withdraw function logic and delegatecall risks**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] idx=0
[codex:448248] off=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] if 0x60 <= op <= 0x7f:
[codex:448248] idx+=2*(op-0x5f); continue
[codex:448248] if op==0xf4:
[codex:448248] off.append(off)
[codex:448248] print('DELEGATECALL offsets:', [hex(o) for o in off])
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 exited 1 in 29ms:
[codex:448248] Traceback (most recent call last):
[codex:448248] File "<stdin>", line 12, in <module>
[codex:448248] AttributeError: 'int' object has no attribute 'append'
[codex:448248]
[codex:448248] thinking
[codex:448248] **Fixing variable name bug**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] idx=0
[codex:448248] offs=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] if 0x60 <= op <= 0x7f:
[codex:448248] idx+=2*(op-0x5f); continue
[codex:448248] if op==0xf4:
[codex:448248] offs.append(off)
[codex:448248] print('DELEGATECALL offsets:', [hex(o) for o in offs])
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 25ms:
[codex:448248] DELEGATECALL offsets: ['0x818']
[codex:448248]
[codex:448248] thinking
[codex:448248] **Investigating delegatecall usage**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] idx=0
[codex:448248] offs=[]
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] if 0x60 <= op <= 0x7f:
[codex:448248] idx+=2*(op-0x5f); continue
[codex:448248] if op==0xff:
[codex:448248] offs.append(off)
[codex:448248] print(offs)
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 35ms:
[codex:448248] []
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing storage slot modifications for exploits**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] # simple disasm list of (off, op, imm)
[codex:448248] ops=[]
[codex:448248] idx=0
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] imm=None
[codex:448248] if 0x60 <= op <= 0x7f:
[codex:448248] n=op-0x5f
[codex:448248] imm=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] ops.append((off,op,imm))
[codex:448248]
[codex:448248] # find SSTORE and print previous few ops
[codex:448248] for i,(off,op,imm) in enumerate(ops):
[codex:448248] if op==0x55: # SSTORE
[codex:448248] prev=ops[max(0,i-5):i]
[codex:448248] seq=' '.join([f\"{hex(p[0])}:{hex(p[1])}{(' '+p[2]) if p[2] else ''}\" for p in prev])
[codex:448248] print(hex(off), 'prev:', seq)
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 33ms:
[codex:448248] 0xec prev: 0xe7:0x90 0xe8:0x81 0xe9:0x1 0xea:0x90 0xeb:0x91
[codex:448248] 0xf5 prev: 0xf0:0x54 0xf1:0x90 0xf2:0x91 0xf3:0x1 0xf4:0x90
[codex:448248] 0x8f1 prev: 0x8eb:0x54 0x8ec:0x60 01 0x8ee:0x81 0x8ef:0x1 0x8f0:0x82
[codex:448248] 0x941 prev: 0x93c:0x91 0x93d:0x90 0x93e:0x91 0x93f:0x17 0x940:0x90
[codex:448248] 0xd64 prev: 0xd5f:0x91 0xd60:0x90 0xd61:0x91 0xd62:0x17 0xd63:0x90
[codex:448248] 0xda4 prev: 0xd8b:0x54 0xd8c:0x73 ffffffffffffffffffffffffffffffffffffffff 0xda1:0x19 0xda2:0x16 0xda3:0x90
[codex:448248] 0xe4f prev: 0xe4a:0x80 0xe4b:0x54 0xe4c:0x90 0xe4d:0x83 0xe4e:0x90
[codex:448248] 0xecf prev: 0xeca:0x54 0xecb:0x90 0xecc:0x91 0xecd:0x1 0xece:0x90
[codex:448248] 0xed6 prev: 0xecf:0x55 0xed0:0x56 0xed1:0x5b 0xed2:0x60 00 0xed4:0x60 04
[codex:448248] 0xedd prev: 0xed8:0x5b 0xed9:0x81 0xeda:0x54 0xedb:0x81 0xedc:0x83
[codex:448248] 0xf09 prev: 0xf01:0x15 0xf02:0x61 0f11 0xf05:0x57 0xf06:0x60 00 0xf08:0x81
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing contract storage and potential exploits**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] ops=[]
[codex:448248] idx=0
[codex:448248] while idx < len(hexstr):
[codex:448248] off=idx//2
[codex:448248] op=int(hexstr[idx:idx+2],16); idx+=2
[codex:448248] imm=None
[codex:448248] if 0x60<=op<=0x7f:
[codex:448248] n=op-0x5f; imm=hexstr[idx:idx+2*n]; idx+=2*n
[codex:448248] ops.append((off,op,imm))
[codex:448248]
[codex:448248] # check SSTORE with recent PUSH1 07
[codex:448248] for i,(off,op,imm) in enumerate(ops):
[codex:448248] if op==0x55:
[codex:448248] # look back up to 5 ops for push1 07
[codex:448248] for j in range(max(0,i-6), i):
[codex:448248] if ops[j][1]==0x60 and ops[j][2]=='07':
[codex:448248] print('SSTORE near PUSH1 07 at', hex(off), 'context', [(hex(o[0]),hex(o[1]),o[2]) for o in ops[j:i+1]])
[codex:448248] break
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 27ms:
[codex:448248]
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing storage slot updates and membership control**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import hashlib
[codex:448248] slot=1
[codex:448248] k=hashlib.sha3_256(slot.to_bytes(32,'big')).hexdigest()
[codex:448248] print(k)
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 21ms:
[codex:448248] b79151ec5d30a80b78789805f293fa4fb8fd1eebc0c9367e7c9106678a893df1
[codex:448248]
[codex:448248] thinking
[codex:448248] **Exploring Keccak vs SHA3 differences**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] from eth_utils import keccak
[codex:448248] print(keccak((0).to_bytes(32,'big')).hex())
[codex:448248] print(keccak((1).to_bytes(32,'big')).hex())
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 247ms:
[codex:448248] 290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563
[codex:448248] b10e2d527612073b26eecdfd717e6a320cf44b4afac2b0732d9fcbe2b7fa0cf6
[codex:448248]
[codex:448248] thinking
[codex:448248] **Searching for keccak hash in bytecode**
[codex:448248] exec
[codex:448248] /bin/bash -lc "python - <<'PY'
[codex:448248] import re
[codex:448248] code=open('BYTECODE_BUNDLE.txt').read()
[codex:448248] hexstr=re.search(r'0x[0-9a-fA-F]+', code).group(0)[2:]
[codex:448248] if 'b10e2d527612073b26eecdfd717e6a320cf44b4afac2b0732d9fcbe2b7fa0cf6' in hexstr:
[codex:448248] print('found')
[codex:448248] else:
[codex:448248] print('not found')
[codex:448248] PY" in /tmp/codex-multi-wduvfb94 succeeded in 22ms:
[codex:448248] not found
[codex:448248]
[codex:448248] thinking
[codex:448248] **Analyzing storage writes and exploit feasibility**
[codex:448248] codex
[codex:448248] {"no_findings":true,"summary":"No concrete, exploitable profit path identified from the bytecode alone.","findings":[]}
[codex:448248] tokens used
[codex:448248] 128,347
[codex:448248] {"no_findings":true,"summary":"No concrete, exploitable profit path identified from the bytecode alone.","findings":[]}
{
"codex": {
"ran_at": "2026-01-04T09:12:49.822946+00:00",
"returncode": 0
},
"summary": "No concrete, exploitable profit path identified from the bytecode alone.",
"raw_final": {
"summary": "No concrete, exploitable profit path identified from the bytecode alone.",
"findings": [],
"no_findings": true
},
"no_findings": true,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x00e1 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH1 0xe0 00000012: PUSH1 0x02 00000014: EXP 00000015: SWAP1 00000016: DIV 00000017: DUP1 00000018: PUSH4 0x92e35aac 0000001d: GT 0000001e: PUSH2 0x0083 00000021: JUMPI 00000022: DUP1 00000023: PUSH4 0xe3247648 00000028: GT 00000029: PUSH2 0x005d 0000002c: JUMPI 0000002d: DUP1 0000002e: PUSH4 0xe3247648 00000033: EQ 00000034: PUSH2 0x02e9 00000037: JUMPI 00000038: DUP1 00000039: PUSH4 0xedaad3c3 0000003e: EQ 0000003f: PUSH2 0x02fe 00000042: JUMPI 00000043: DUP1 00000044: PUSH4 0xf602dd06 00000049: EQ 0000004a: PUSH2 0x0313 0000004d: JUMPI 0000004e: DUP1 0000004f: PUSH4 0xfeea0226 00000054: EQ 00000055: PUSH2 0x0346 00000058: JUMPI 00000059: PUSH2 0x00e1 0000005c: JUMP 0000005d: JUMPDEST 0000005e: DUP1 0000005f: PUSH4 0x92e35aac 00000064: EQ 00000065: PUSH2 0x0245 00000068: JUMPI 00000069: DUP1 0000006a: PUSH4 0x9570f901 0000006f: EQ 00000070: PUSH2 0x026f 00000073: JUMPI 00000074: DUP1 00000075: PUSH4 0xd7f3de83 0000007a: EQ 0000007b: PUSH2 0x02d4 0000007e: JUMPI 0000007f: PUSH2 0x00e1 00000082: JUMP 00000083: JUMPDEST 00000084: DUP1 00000085: PUSH4 0x45f09ce9 0000008a: GT 0000008b: PUSH2 0x00bf 0000008e: JUMPI 0000008f: DUP1 00000090: PUSH4 0x45f09ce9 00000095: EQ 00000096: PUSH2 0x0164 00000099: JUMPI 0000009a: DUP1 0000009b: PUSH4 0x5a49f471 000000a0: EQ 000000a1: PUSH2 0x01d1 000000a4: JUMPI 000000a5: DUP1 000000a6: PUSH4 0x785df1a1 000000ab: EQ 000000ac: PUSH2 0x01fb 000000af: JUMPI 000000b0: DUP1 000000b1: PUSH4 0x82426619 000000b6: EQ 000000b7: PUSH2 0x0230 000000ba: JUMPI 000000bb: PUSH2 0x00e1 000000be: JUMP 000000bf: JUMPDEST 000000c0: DUP1 000000c1: PUSH4 0x182d37e3 000000c6: EQ 000000c7: PUSH2 0x00f7 000000ca: JUMPI 000000cb: DUP1 000000cc: PUSH4 0x2626921b 000000d1: EQ 000000d2: PUSH2 0x011e 000000d5: JUMPI 000000d6: DUP1 000000d7: PUSH4 0x31430c8b 000000dc: EQ 000000dd: PUSH2 0x0133 000000e0: JUMPI 000000e1: JUMPDEST 000000e2: PUSH1 0x04 000000e4: DUP1 000000e5: SLOAD 000000e6: CALLVALUE 000000e7: SWAP1 000000e8: DUP2 000000e9: ADD 000000ea: SWAP1 000000eb: SWAP2 000000ec: SSTORE 000000ed: PUSH1 0x03 000000ef: DUP1 000000f0: SLOAD 000000f1: SWAP1 000000f2: SWAP2 000000f3: ADD 000000f4: SWAP1 000000f5: SSTORE 000000f6: STOP 000000f7: JUMPDEST 000000f8: CALLVALUE 000000f9: DUP1 000000fa: ISZERO 000000fb: PUSH2 0x0103 000000fe: JUMPI 000000ff: PUSH1 0x00 00000101: DUP1 00000102: REVERT 00000103: JUMPDEST 00000104: POP 00000105: PUSH2 0x010c 00000108: PUSH2 0x035b 0000010b: JUMP 0000010c: JUMPDEST 0000010d: PUSH1 0x40 0000010f: DUP1 00000110: MLOAD 00000111: SWAP2 00000112: DUP3 00000113: MSTORE 00000114: MLOAD 00000115: SWAP1 00000116: DUP2 00000117: SWAP1 00000118: SUB 00000119: PUSH1 0x20 0000011b: ADD 0000011c: SWAP1 0000011d: RETURN 0000011e: JUMPDEST 0000011f: CALLVALUE 00000120: DUP1 00000121: ISZERO 00000122: PUSH2 0x012a 00000125: JUMPI 00000126: PUSH1 0x00 00000128: DUP1 00000129: REVERT 0000012a: JUMPDEST 0000012b: POP 0000012c: PUSH2 0x010c 0000012f: PUSH2 0x0361 00000132: JUMP 00000133: JUMPDEST 00000134: CALLVALUE 00000135: DUP1 00000136: ISZERO 00000137: PUSH2 0x013f 0000013a: JUMPI 0000013b: PUSH1 0x00 0000013d: DUP1 0000013e: REVERT 0000013f: JUMPDEST 00000140: POP 00000141: PUSH2 0x0148 00000144: PUSH2 0x0367 00000147: JUMP 00000148: JUMPDEST 00000149: PUSH1 0x40 0000014b: DUP1 0000014c: MLOAD 0000014d: PUSH1 0x01 0000014f: PUSH1 0xa0 00000151: PUSH1 0x02 00000153: EXP 00000154: SUB 00000155: SWAP1 00000156: SWAP3 00000157: AND 00000158: DUP3 00000159: MSTORE 0000015a: MLOAD 0000015b: SWAP1 0000015c: DUP2 0000015d: SWAP1 0000015e: SUB 0000015f: PUSH1 0x20 00000161: ADD 00000162: SWAP1 00000163: RETURN 00000164: JUMPDEST 00000165: CALLVALUE 00000166: DUP1 00000167: ISZERO 00000168: PUSH2 0x0170 0000016b: JUMPI 0000016c: PUSH1 0x00 0000016e: DUP1 0000016f: REVERT 00000170: JUMPDEST 00000171: POP 00000172: PUSH2 0x0179 00000175: PUSH2 0x0376 00000178: JUMP 00000179: JUMPDEST 0000017a: PUSH1 0x40 0000017c: DUP1 0000017d: MLOAD 0000017e: SWAP12 0000017f: DUP13 00000180: MSTORE 00000181: PUSH1 0x20 00000183: DUP13 00000184: ADD 00000185: SWAP11 00000186: SWAP1 00000187: SWAP11 00000188: MSTORE 00000189: DUP11 0000018a: DUP11 0000018b: ADD 0000018c: SWAP9 0000018d: SWAP1 0000018e: SWAP9 0000018f: MSTORE 00000190: PUSH1 0x60 00000192: DUP11 00000193: ADD 00000194: SWAP7 00000195: SWAP1 00000196: SWAP7 00000197: MSTORE 00000198: PUSH1 0x80 0000019a: DUP10 0000019b: ADD 0000019c: SWAP5 0000019d: SWAP1 0000019e: SWAP5 0000019f: MSTORE 000001a0: PUSH1 0xa0 000001a2: DUP9 000001a3: ADD 000001a4: SWAP3 000001a5: SWAP1 000001a6: SWAP3 000001a7: MSTORE 000001a8: PUSH1 0xc0 000001aa: DUP8 000001ab: ADD 000001ac: MSTORE 000001ad: PUSH1 0xe0 000001af: DUP7 000001b0: ADD 000001b1: MSTORE 000001b2: PUSH2 0x0100 000001b5: DUP6 000001b6: ADD 000001b7: MSTORE 000001b8: PUSH2 0x0120 000001bb: DUP5 000001bc: ADD 000001bd: MSTORE 000001be: ISZERO 000001bf: ISZERO 000001c0: PUSH2 0x0140 000001c3: DUP4 000001c4: ADD 000001c5: MSTORE 000001c6: MLOAD 000001c7: SWAP1 000001c8: DUP2 000001c9: SWAP1 000001ca: SUB 000001cb: PUSH2 0x0160 000001ce: ADD 000001cf: SWAP1 000001d0: RETURN 000001d1: JUMPDEST 000001d2: CALLVALUE 000001d3: DUP1 000001d4: ISZERO 000001d5: PUSH2 0x01dd 000001d8: JUMPI 000001d9: PUSH1 0x00 000001db: DUP1 000001dc: REVERT 000001dd: JUMPDEST 000001de: POP 000001df: PUSH2 0x0148 000001e2: PUSH1 0x04 000001e4: DUP1 000001e5: CALLDATASIZE 000001e6: SUB 000001e7: PUSH1 0x20 000001e9: DUP2 000001ea: LT 000001eb: ISZERO 000001ec: PUSH2 0x01f4 000001ef: JUMPI 000001f0: PUSH1 0x00 000001f2: DUP1 000001f3: REVERT 000001f4: JUMPDEST 000001f5: POP 000001f6: CALLDATALOAD 000001f7: PUSH2 0x0863 000001fa: JUMP 000001fb: JUMPDEST 000001fc: CALLVALUE 000001fd: DUP1 000001fe: ISZERO 000001ff: PUSH2 0x0207 00000202: JUMPI 00000203: PUSH1 0x00 00000205: DUP1 00000206: REVERT 00000207: JUMPDEST 00000208: POP 00000209: PUSH2 0x022e 0000020c: PUSH1 0x04 0000020e: DUP1 0000020f: CALLDATASIZE 00000210: SUB 00000211: PUSH1 0x20 00000213: DUP2 00000214: LT 00000215: ISZERO 00000216: PUSH2 0x021e 00000219: JUMPI 0000021a: PUSH1 0x00 0000021c: DUP1 0000021d: REVERT 0000021e: JUMPDEST 0000021f: POP 00000220: CALLDATALOAD 00000221: PUSH1 0x01 00000223: PUSH1 0xa0 00000225: PUSH1 0x02 00000227: EXP 00000228: SUB 00000229: AND 0000022a: PUSH2 0x088a 0000022d: JUMP 0000022e: JUMPDEST 0000022f: STOP 00000230: JUMPDEST 00000231: CALLVALUE 00000232: DUP1 00000233: ISZERO 00000234: PUSH2 0x023c 00000237: JUMPI 00000238: PUSH1 0x00 0000023a: DUP1 0000023b: REVERT 0000023c: JUMPDEST 0000023d: POP 0000023e: PUSH2 0x010c 00000241: PUSH2 0x0943 00000244: JUMP 00000245: JUMPDEST 00000246: CALLVALUE 00000247: DUP1 00000248: ISZERO 00000249: PUSH2 0x0251 0000024c: JUMPI 0000024d: PUSH1 0x00 0000024f: DUP1 00000250: REVERT 00000251: JUMPDEST 00000252: POP 00000253: PUSH2 0x010c 00000256: PUSH1 0x04 00000258: DUP1 00000259: CALLDATASIZE 0000025a: SUB 0000025b: PUSH1 0x20 0000025d: DUP2 0000025e: LT 0000025f: ISZERO 00000260: PUSH2 0x0268 00000263: JUMPI 00000264: PUSH1 0x00 00000266: DUP1 00000267: REVERT 00000268: JUMPDEST 00000269: POP 0000026a: CALLDATALOAD 0000026b: PUSH2 0x0949 0000026e: JUMP 0000026f: JUMPDEST 00000270: CALLVALUE 00000271: DUP1 00000272: ISZERO 00000273: PUSH2 0x027b 00000276: JUMPI 00000277: PUSH1 0x00 00000279: DUP1 0000027a: REVERT 0000027b: JUMPDEST 0000027c: POP 0000027d: PUSH2 0x0284 00000280: PUSH2 0x0967 00000283: JUMP 00000284: JUMPDEST 00000285: PUSH1 0x40 00000287: DUP1 00000288: MLOAD 00000289: PUSH1 0x20 0000028b: DUP1 0000028c: DUP3 0000028d: MSTORE 0000028e: DUP4 0000028f: MLOAD 00000290: DUP2 00000291: DUP4 00000292: ADD 00000293: MSTORE 00000294: DUP4 00000295: MLOAD 00000296: SWAP2 00000297: SWAP3 00000298: DUP4 00000299: SWAP3 0000029a: SWAP1 0000029b: DUP4 0000029c: ADD 0000029d: SWAP2 0000029e: DUP6 0000029f: DUP2 000002a0: ADD 000002a1: SWAP2 000002a2: MUL 000002a3: DUP1 000002a4: DUP4 000002a5: DUP4 000002a6: PUSH1 0x00 000002a8: JUMPDEST 000002a9: DUP4 000002aa: DUP2 000002ab: LT 000002ac: ISZERO 000002ad: PUSH2 0x02c0 000002b0: JUMPI 000002b1: DUP2 000002b2: DUP2 000002b3: ADD 000002b4: MLOAD 000002b5: DUP4 000002b6: DUP3 000002b7: ADD 000002b8: MSTORE 000002b9: PUSH1 0x20 000002bb: ADD 000002bc: PUSH2 0x02a8 000002bf: JUMP 000002c0: JUMPDEST 000002c1: POP 000002c2: POP 000002c3: POP 000002c4: POP 000002c5: SWAP1 000002c6: POP 000002c7: ADD 000002c8: SWAP3 000002c9: POP 000002ca: POP 000002cb: POP 000002cc: PUSH1 0x40 000002ce: MLOAD 000002cf: DUP1 000002d0: SWAP2 000002d1: SUB 000002d2: SWAP1 000002d3: RETURN 000002d4: JUMPDEST 000002d5: CALLVALUE 000002d6: DUP1 000002d7: ISZERO 000002d8: PUSH2 0x02e0 000002db: JUMPI 000002dc: PUSH1 0x00 000002de: DUP1 000002df: REVERT 000002e0: JUMPDEST 000002e1: POP 000002e2: PUSH2 0x0148 000002e5: PUSH2 0x09ca 000002e8: JUMP 000002e9: JUMPDEST 000002ea: CALLVALUE 000002eb: DUP1 000002ec: ISZERO 000002ed: PUSH2 0x02f5 000002f0: JUMPI 000002f1: PUSH1 0x00 000002f3: DUP1 000002f4: REVERT 000002f5: JUMPDEST 000002f6: POP 000002f7: PUSH2 0x022e 000002fa: PUSH2 0x09d9 000002fd: JUMP 000002fe: JUMPDEST 000002ff: CALLVALUE 00000300: DUP1 00000301: ISZERO 00000302: PUSH2 0x030a 00000305: JUMPI 00000306: PUSH1 0x00 00000308: DUP1 00000309: REVERT 0000030a: JUMPDEST 0000030b: POP 0000030c: PUSH2 0x010c 0000030f: PUSH2 0x0c3b 00000312: JUMP 00000313: JUMPDEST 00000314: CALLVALUE 00000315: DUP1 00000316: ISZERO 00000317: PUSH2 0x031f 0000031a: JUMPI 0000031b: PUSH1 0x00 0000031d: DUP1 0000031e: REVERT 0000031f: JUMPDEST 00000320: POP 00000321: PUSH2 0x022e 00000324: PUSH1 0x04 00000326: DUP1 00000327: CALLDATASIZE 00000328: SUB 00000329: PUSH1 0x20 0000032b: DUP2 0000032c: LT 0000032d: ISZERO 0000032e: PUSH2 0x0336 00000331: JUMPI 00000332: PUSH1 0x00 00000334: DUP1 00000335: REVERT 00000336: JUMPDEST 00000337: POP 00000338: CALLDATALOAD 00000339: PUSH1 0x01 0000033b: PUSH1 0xa0 0000033d: PUSH1 0x02 0000033f: EXP 00000340: SUB 00000341: AND 00000342: PUSH2 0x0c4e 00000345: JUMP 00000346: JUMPDEST 00000347: CALLVALUE 00000348: DUP1 00000349: ISZERO 0000034a: PUSH2 0x0352 0000034d: JUMPI 0000034e: PUSH1 0x00 00000350: DUP1 00000351: REVERT 00000352: JUMPDEST 00000353: POP 00000354: PUSH2 0x022e 00000357: PUSH2 0x0dc8 0000035a: JUMP 0000035b: JUMPDEST 0000035c: PUSH1 0x04 0000035e: SLOAD 0000035f: DUP2 00000360: JUMP 00000361: JUMPDEST 00000362: PUSH1 0x06 00000364: SLOAD 00000365: DUP2 00000366: JUMP 00000367: JUMPDEST 00000368: PUSH1 0x07 0000036a: SLOAD 0000036b: PUSH1 0x01 0000036d: PUSH1 0xa0 0000036f: PUSH1 0x02 00000371: EXP 00000372: SUB 00000373: AND 00000374: DUP2 00000375: JUMP 00000376: JUMPDEST 00000377: PUSH1 0x00 00000379: DUP1 0000037a: PUSH1 0x00 0000037c: DUP1 0000037d: PUSH1 0x00 0000037f: DUP1 00000380: PUSH1 0x00 00000382: DUP1 00000383: PUSH1 0x00 00000385: DUP1 00000386: PUSH1 0x00 00000388: PUSH1 0x04 0000038a: SLOAD 0000038b: SWAP11 0000038c: POP 0000038d: PUSH1 0x07 0000038f: PUSH1 0x00 00000391: SWAP1 00000392: SLOAD 00000393: SWAP1 00000394: PUSH2 0x0100 00000397: EXP 00000398: SWAP1 00000399: DIV 0000039a: PUSH1 0x01 0000039c: PUSH1 0xa0 0000039e: PUSH1 0x02 000003a0: EXP 000003a1: SUB 000003a2: AND 000003a3: PUSH1 0x01 000003a5: PUSH1 0xa0 000003a7: PUSH1 0x02 000003a9: EXP 000003aa: SUB 000003ab: AND 000003ac: PUSH4 0xf6afe4f7 000003b1: PUSH1 0x01 000003b3: PUSH1 0x40 000003b5: MLOAD 000003b6: DUP3 000003b7: PUSH4 0xffffffff 000003bc: AND 000003bd: PUSH1 0xe0 000003bf: PUSH1 0x02 000003c1: EXP 000003c2: MUL 000003c3: DUP2 000003c4: MSTORE 000003c5: PUSH1 0x04 000003c7: ADD 000003c8: DUP1 000003c9: DUP3 000003ca: DUP2 000003cb: MSTORE 000003cc: PUSH1 0x20 000003ce: ADD 000003cf: SWAP2 000003d0: POP 000003d1: POP 000003d2: PUSH1 0x00 000003d4: PUSH1 0x40 000003d6: MLOAD 000003d7: DUP1 000003d8: DUP4 000003d9: SUB 000003da: DUP2 000003db: DUP7 000003dc: DUP1 000003dd: EXTCODESIZE 000003de: ISZERO 000003df: DUP1 000003e0: ISZERO 000003e1: PUSH2 0x03e9 000003e4: JUMPI 000003e5: PUSH1 0x00 000003e7: DUP1 000003e8: REVERT 000003e9: JUMPDEST 000003ea: POP 000003eb: GAS 000003ec: STATICCALL 000003ed: ISZERO 000003ee: DUP1 000003ef: ISZERO 000003f0: PUSH2 0x03fd 000003f3: JUMPI 000003f4: RETURNDATASIZE 000003f5: PUSH1 0x00 000003f7: DUP1 000003f8: RETURNDATACOPY 000003f9: RETURNDATASIZE 000003fa: PUSH1 0x00 000003fc: REVERT 000003fd: JUMPDEST 000003fe: POP 000003ff: POP 00000400: POP 00000401: POP 00000402: PUSH1 0x40 00000404: MLOAD 00000405: RETURNDATASIZE 00000406: PUSH1 0x00 00000408: DUP3 00000409: RETURNDATACOPY 0000040a: PUSH1 0x1f 0000040c: RETURNDATASIZE 0000040d: SWAP1 0000040e: DUP2 0000040f: ADD 00000410: PUSH1 0x1f 00000412: NOT 00000413: AND 00000414: DUP3 00000415: ADD 00000416: PUSH1 0x40 00000418: MSTORE 00000419: PUSH1 0x20 0000041b: DUP2 0000041c: LT 0000041d: ISZERO 0000041e: PUSH2 0x0426 00000421: JUMPI 00000422: PUSH1 0x00 00000424: DUP1 00000425: REVERT 00000426: JUMPDEST 00000427: DUP2 00000428: ADD 00000429: SWAP1 0000042a: DUP1 0000042b: DUP1 0000042c: MLOAD 0000042d: PUSH5 0x0100000000 00000433: DUP2 00000434: GT 00000435: ISZERO 00000436: PUSH2 0x043e 00000439: JUMPI 0000043a: PUSH1 0x00 0000043c: DUP1 0000043d: REVERT 0000043e: JUMPDEST 0000043f: DUP3 00000440: ADD 00000441: PUSH1 0x20 00000443: DUP2 00000444: ADD 00000445: DUP5 00000446: DUP2 00000447: GT 00000448: ISZERO 00000449: PUSH2 0x0451 0000044c: JUMPI 0000044d: PUSH1 0x00 0000044f: DUP1 00000450: REVERT 00000451: JUMPDEST 00000452: DUP2 00000453: MLOAD 00000454: DUP6 00000455: PUSH1 0x20 00000457: DUP3 00000458: MUL 00000459: DUP4 0000045a: ADD 0000045b: GT 0000045c: PUSH5 0x0100000000 00000462: DUP3 00000463: GT 00000464: OR 00000465: ISZERO 00000466: PUSH2 0x046e 00000469: JUMPI 0000046a: PUSH1 0x00 0000046c: DUP1 0000046d: REVERT 0000046e: JUMPDEST 0000046f: POP 00000470: POP 00000471: MLOAD 00000472: PUSH1 0x07 00000474: SLOAD 00000475: PUSH1 0x40 00000477: DUP1 00000478: MLOAD 00000479: PUSH1 0xe0 0000047b: PUSH1 0x02 0000047d: EXP 0000047e: PUSH4 0xf6afe4f7 00000483: MUL 00000484: DUP2 00000485: MSTORE 00000486: PUSH1 0x02 00000488: PUSH1 0x04 0000048a: DUP3 0000048b: ADD 0000048c: MSTORE 0000048d: SWAP1 0000048e: MLOAD 0000048f: SWAP3 00000490: SWAP16 00000491: POP 00000492: PUSH1 0x01 00000494: PUSH1 0xa0 00000496: PUSH1 0x02 00000498: EXP 00000499: SUB 0000049a: SWAP1 0000049b: SWAP2 0000049c: AND 0000049d: SWAP5 0000049e: POP 0000049f: PUSH4 0xf6afe4f7 000004a4: SWAP4 000004a5: POP 000004a6: PUSH1 0x24 000004a8: DUP1 000004a9: DUP3 000004aa: ADD 000004ab: SWAP4 000004ac: POP 000004ad: PUSH1 0x00 000004af: SWAP3 000004b0: SWAP2 000004b1: DUP3 000004b2: SWAP1 000004b3: SUB 000004b4: ADD 000004b5: DUP2 000004b6: DUP7 000004b7: DUP1 000004b8: EXTCODESIZE 000004b9: ISZERO 000004ba: DUP1 000004bb: ISZERO 000004bc: PUSH2 0x04c4 000004bf: JUMPI 000004c0: PUSH1 0x00 000004c2: DUP1 000004c3: REVERT 000004c4: JUMPDEST 000004c5: POP 000004c6: GAS 000004c7: STATICCALL 000004c8: ISZERO 000004c9: DUP1 000004ca: ISZERO 000004cb: PUSH2 0x04d8 000004ce: JUMPI 000004cf: RETURNDATASIZE 000004d0: PUSH1 0x00 000004d2: DUP1 000004d3: RETURNDATACOPY 000004d4: RETURNDATASIZE 000004d5: PUSH1 0x00 000004d7: REVERT 000004d8: JUMPDEST 000004d9: POP 000004da: POP 000004db: POP 000004dc: POP 000004dd: PUSH1 0x40 000004df: MLOAD 000004e0: RETURNDATASIZE 000004e1: PUSH1 0x00 000004e3: DUP3 000004e4: RETURNDATACOPY 000004e5: PUSH1 0x1f 000004e7: RETURNDATASIZE 000004e8: SWAP1 000004e9: DUP2 000004ea: ADD 000004eb: PUSH1 0x1f 000004ed: NOT 000004ee: AND 000004ef: DUP3 000004f0: ADD 000004f1: PUSH1 0x40 000004f3: MSTORE 000004f4: PUSH1 0x20 000004f6: DUP2 000004f7: LT 000004f8: ISZERO 000004f9: PUSH2 0x0501 000004fc: JUMPI 000004fd: PUSH1 0x00 000004ff: DUP1 00000500: REVERT 00000501: JUMPDEST 00000502: DUP2 00000503: ADD 00000504: SWAP1 00000505: DUP1 00000506: DUP1 00000507: MLOAD 00000508: PUSH5 0x0100000000 0000050e: DUP2 0000050f: GT 00000510: ISZERO 00000511: PUSH2 0x0519 00000514: JUMPI 00000515: PUSH1 0x00 00000517: DUP1 00000518: REVERT 00000519: JUMPDEST 0000051a: DUP3 0000051b: ADD 0000051c: PUSH1 0x20 0000051e: DUP2 0000051f: ADD 00000520: DUP5 00000521: DUP2 00000522: GT 00000523: ISZERO 00000524: PUSH2 0x052c 00000527: JUMPI 00000528: PUSH1 0x00 0000052a: DUP1 0000052b: REVERT 0000052c: JUMPDEST 0000052d: DUP2 0000052e: MLOAD 0000052f: DUP6 00000530: PUSH1 0x20 00000532: DUP3 00000533: MUL 00000534: DUP4 00000535: ADD 00000536: GT 00000537: PUSH5 0x0100000000 0000053d: DUP3 0000053e: GT 0000053f: OR 00000540: ISZERO 00000541: PUSH2 0x0549 00000544: JUMPI 00000545: PUSH1 0x00 00000547: DUP1 00000548: REVERT 00000549: JUMPDEST 0000054a: POP 0000054b: POP 0000054c: MLOAD 0000054d: PUSH1 0x07 0000054f: SLOAD 00000550: PUSH1 0x40 00000552: DUP1 00000553: MLOAD 00000554: PUSH1 0xe0 00000556: PUSH1 0x02 00000558: EXP 00000559: PUSH4 0xf6afe4f7 0000055e: MUL 0000055f: DUP2 00000560: MSTORE 00000561: PUSH1 0x03 00000563: PUSH1 0x04 00000565: DUP3 00000566: ADD 00000567: MSTORE 00000568: SWAP1 00000569: MLOAD 0000056a: SWAP3 0000056b: SWAP15 0000056c: POP 0000056d: PUSH1 0x01 0000056f: PUSH1 0xa0 00000571: PUSH1 0x02 00000573: EXP 00000574: SUB 00000575: SWAP1 00000576: SWAP2 00000577: AND 00000578: SWAP5 00000579: POP 0000057a: PUSH4 0xf6afe4f7 0000057f: SWAP4 00000580: POP 00000581: PUSH1 0x24 00000583: DUP1 00000584: DUP3 00000585: ADD 00000586: SWAP4 00000587: POP 00000588: PUSH1 0x00 0000058a: SWAP3 0000058b: SWAP2 0000058c: DUP3 0000058d: SWAP1 0000058e: SUB 0000058f: ADD 00000590: DUP2 00000591: DUP7 00000592: DUP1 00000593: EXTCODESIZE 00000594: ISZERO 00000595: DUP1 00000596: ISZERO 00000597: PUSH2 0x059f 0000059a: JUMPI 0000059b: PUSH1 0x00 0000059d: DUP1 0000059e: REVERT 0000059f: JUMPDEST 000005a0: POP 000005a1: GAS 000005a2: STATICCALL 000005a3: ISZERO 000005a4: DUP1 000005a5: ISZERO 000005a6: PUSH2 0x05b3 000005a9: JUMPI 000005aa: RETURNDATASIZE 000005ab: PUSH1 0x00 000005ad: DUP1 000005ae: RETURNDATACOPY 000005af: RETURNDATASIZE 000005b0: PUSH1 0x00 000005b2: REVERT 000005b3: JUMPDEST 000005b4: POP 000005b5: POP 000005b6: POP 000005b7: POP 000005b8: PUSH1 0x40 000005ba: MLOAD 000005bb: RETURNDATASIZE 000005bc: PUSH1 0x00 000005be: DUP3 000005bf: RETURNDATACOPY 000005c0: PUSH1 0x1f 000005c2: RETURNDATASIZE 000005c3: SWAP1 000005c4: DUP2 000005c5: ADD 000005c6: PUSH1 0x1f 000005c8: NOT 000005c9: AND 000005ca: DUP3 000005cb: ADD 000005cc: PUSH1 0x40 000005ce: MSTORE 000005cf: PUSH1 0x20 000005d1: DUP2 000005d2: LT 000005d3: ISZERO 000005d4: PUSH2 0x05dc 000005d7: JUMPI 000005d8: PUSH1 0x00 000005da: DUP1 000005db: REVERT 000005dc: JUMPDEST 000005dd: DUP2 000005de: ADD 000005df: SWAP1 000005e0: DUP1 000005e1: DUP1 000005e2: MLOAD 000005e3: PUSH5 0x0100000000 000005e9: DUP2 000005ea: GT 000005eb: ISZERO 000005ec: PUSH2 0x05f4 000005ef: JUMPI 000005f0: PUSH1 0x00 000005f2: DUP1 000005f3: REVERT 000005f4: JUMPDEST 000005f5: DUP3 000005f6: ADD 000005f7: PUSH1 0x20 000005f9: DUP2 000005fa: ADD 000005fb: DUP5 000005fc: DUP2 000005fd: GT 000005fe: ISZERO 000005ff: PUSH2 0x0607 00000602: JUMPI 00000603: PUSH1 0x00 00000605: DUP1 00000606: REVERT 00000607: JUMPDEST 00000608: DUP2 00000609: MLOAD 0000060a: DUP6 0000060b: PUSH1 0x20 0000060d: DUP3 0000060e: MUL 0000060f: DUP4 00000610: ADD 00000611: GT 00000612: PUSH5 0x0100000000 00000618: DUP3 00000619: GT 0000061a: OR 0000061b: ISZERO 0000061c: PUSH2 0x0624 0000061f: JUMPI 00000620: PUSH1 0x00 00000622: DUP1 00000623: REVERT 00000624: JUMPDEST 00000625: POP 00000626: POP 00000627: MLOAD 00000628: PUSH1 0x07 0000062a: SLOAD 0000062b: PUSH1 0x40 0000062d: DUP1 0000062e: MLOAD 0000062f: PUSH1 0xe0 00000631: PUSH1 0x02 00000633: EXP 00000634: PUSH4 0xf6afe4f7 00000639: MUL 0000063a: DUP2 0000063b: MSTORE 0000063c: PUSH1 0x04 0000063e: DUP2 0000063f: DUP2 00000640: ADD 00000641: MSTORE 00000642: SWAP1 00000643: MLOAD 00000644: SWAP3 00000645: SWAP14 00000646: POP 00000647: PUSH1 0x01 00000649: PUSH1 0xa0 0000064b: PUSH1 0x02 0000064d: EXP 0000064e: SUB 0000064f: SWAP1 00000650: SWAP2 00000651: AND 00000652: SWAP5 00000653: POP 00000654: PUSH4 0xf6afe4f7 00000659: SWAP4 0000065a: POP 0000065b: PUSH1 0x24 0000065d: DUP1 0000065e: DUP3 0000065f: ADD 00000660: SWAP4 00000661: POP 00000662: PUSH1 0x00 00000664: SWAP3 00000665: SWAP2 00000666: DUP3 00000667: SWAP1 00000668: SUB 00000669: ADD 0000066a: DUP2 0000066b: DUP7 0000066c: DUP1 0000066d: EXTCODESIZE 0000066e: ISZERO 0000066f: DUP1 00000670: ISZERO 00000671: PUSH2 0x0679 00000674: JUMPI 00000675: PUSH1 0x00 00000677: DUP1 00000678: REVERT 00000679: JUMPDEST 0000067a: POP 0000067b: GAS 0000067c: STATICCALL 0000067d: ISZERO 0000067e: DUP1 0000067f: ISZERO 00000680: PUSH2 0x068d 00000683: JUMPI 00000684: RETURNDATASIZE 00000685: PUSH1 0x00 00000687: DUP1 00000688: RETURNDATACOPY 00000689: RETURNDATASIZE 0000068a: PUSH1 0x00 0000068c: REVERT 0000068d: JUMPDEST 0000068e: POP 0000068f: POP 00000690: POP 00000691: POP 00000692: PUSH1 0x40 00000694: MLOAD 00000695: RETURNDATASIZE 00000696: PUSH1 0x00 00000698: DUP3 00000699: RETURNDATACOPY 0000069a: PUSH1 0x1f 0000069c: RETURNDATASIZE 0000069d: SWAP1 0000069e: DUP2 0000069f: ADD 000006a0: PUSH1 0x1f 000006a2: NOT 000006a3: AND 000006a4: DUP3 000006a5: ADD 000006a6: PUSH1 0x40 000006a8: MSTORE 000006a9: PUSH1 0x20 000006ab: DUP2 000006ac: LT 000006ad: ISZERO 000006ae: PUSH2 0x06b6 000006b1: JUMPI 000006b2: PUSH1 0x00 000006b4: DUP1 000006b5: REVERT 000006b6: JUMPDEST 000006b7: DUP2 000006b8: ADD 000006b9: SWAP1 000006ba: DUP1 000006bb: DUP1 000006bc: MLOAD 000006bd: PUSH5 0x0100000000 000006c3: DUP2 000006c4: GT 000006c5: ISZERO 000006c6: PUSH2 0x06ce 000006c9: JUMPI 000006ca: PUSH1 0x00 000006cc: DUP1 000006cd: REVERT 000006ce: JUMPDEST 000006cf: DUP3 000006d0: ADD 000006d1: PUSH1 0x20 000006d3: DUP2 000006d4: ADD 000006d5: DUP5 000006d6: DUP2 000006d7: GT 000006d8: ISZERO 000006d9: PUSH2 0x06e1 000006dc: JUMPI 000006dd: PUSH1 0x00 000006df: DUP1 000006e0: REVERT 000006e1: JUMPDEST 000006e2: DUP2 000006e3: MLOAD 000006e4: DUP6 000006e5: PUSH1 0x20 000006e7: DUP3 000006e8: MUL 000006e9: DUP4 000006ea: ADD 000006eb: GT 000006ec: PUSH5 0x0100000000 000006f2: DUP3 000006f3: GT 000006f4: OR 000006f5: ISZERO 000006f6: PUSH2 0x06fe 000006f9: JUMPI 000006fa: PUSH1 0x00 000006fc: DUP1 000006fd: REVERT 000006fe: JUMPDEST 000006ff: POP 00000700: POP 00000701: SWAP3 00000702: SWAP2 00000703: SWAP1 00000704: POP 00000705: POP 00000706: POP 00000707: MLOAD 00000708: SWAP7 00000709: POP 0000070a: DUP10 0000070b: PUSH1 0x64 0000070d: PUSH1 0x08 0000070f: PUSH1 0x01 00000711: DUP2 00000712: SLOAD 00000713: DUP2 00000714: LT 00000715: PUSH2 0x071a 00000718: JUMPI 00000719: INVALID 0000071a: JUMPDEST 0000071b: SWAP1 0000071c: PUSH1 0x00 0000071e: MSTORE 0000071f: PUSH1 0x20 00000721: PUSH1 0x00 00000723: KECCAK256 00000724: ADD 00000725: SLOAD 00000726: DUP14 00000727: MUL 00000728: DUP2 00000729: PUSH2 0x072e 0000072c: JUMPI 0000072d: INVALID 0000072e: JUMPDEST 0000072f: DIV 00000730: DUP2 00000731: PUSH2 0x0736 00000734: JUMPI 00000735: INVALID 00000736: JUMPDEST 00000737: DIV 00000738: SWAP6 00000739: POP 0000073a: DUP9 0000073b: PUSH1 0x64 0000073d: PUSH1 0x08 0000073f: PUSH1 0x02 00000741: DUP2 00000742: SLOAD 00000743: DUP2 00000744: LT 00000745: PUSH2 0x074a 00000748: JUMPI 00000749: INVALID 0000074a: JUMPDEST 0000074b: SWAP1 0000074c: PUSH1 0x00 0000074e: MSTORE 0000074f: PUSH1 0x20 00000751: PUSH1 0x00 00000753: KECCAK256 00000754: ADD 00000755: SLOAD 00000756: DUP14 00000757: MUL 00000758: DUP2 00000759: PUSH2 0x075e 0000075c: JUMPI 0000075d: INVALID 0000075e: JUMPDEST 0000075f: DIV 00000760: DUP2 00000761: PUSH2 0x0766 00000764: JUMPI 00000765: INVALID 00000766: JUMPDEST 00000767: DIV 00000768: SWAP5 00000769: POP 0000076a: DUP8 0000076b: PUSH1 0x64 0000076d: PUSH1 0x08 0000076f: PUSH1 0x03 00000771: DUP2 00000772: SLOAD 00000773: DUP2 00000774: LT 00000775: PUSH2 0x077a 00000778: JUMPI 00000779: INVALID 0000077a: JUMPDEST 0000077b: SWAP1 0000077c: PUSH1 0x00 0000077e: MSTORE 0000077f: PUSH1 0x20 00000781: PUSH1 0x00 00000783: KECCAK256 00000784: ADD 00000785: SLOAD 00000786: DUP14 00000787: MUL 00000788: DUP2 00000789: PUSH2 0x078e 0000078c: JUMPI 0000078d: INVALID 0000078e: JUMPDEST 0000078f: DIV 00000790: DUP2 00000791: PUSH2 0x0796 00000794: JUMPI 00000795: INVALID 00000796: JUMPDEST 00000797: DIV 00000798: SWAP4 00000799: POP 0000079a: DUP7 0000079b: PUSH1 0x64 0000079d: PUSH1 0x08 0000079f: PUSH1 0x04 000007a1: DUP2 000007a2: SLOAD 000007a3: DUP2 000007a4: LT 000007a5: PUSH2 0x07aa 000007a8: JUMPI 000007a9: INVALID 000007aa: JUMPDEST 000007ab: SWAP1 000007ac: PUSH1 0x00 000007ae: MSTORE 000007af: PUSH1 0x20 000007b1: PUSH1 0x00 000007b3: KECCAK256 000007b4: ADD 000007b5: SLOAD 000007b6: DUP14 000007b7: MUL 000007b8: DUP2 000007b9: PUSH2 0x07be 000007bc: JUMPI 000007bd: INVALID 000007be: JUMPDEST 000007bf: DIV 000007c0: DUP2 000007c1: PUSH2 0x07c6 000007c4: JUMPI 000007c5: INVALID 000007c6: JUMPDEST 000007c7: DIV 000007c8: SWAP3 000007c9: POP 000007ca: PUSH1 0x06 000007cc: SLOAD 000007cd: SWAP2 000007ce: POP 000007cf: PUSH20 0x3bd98cd3499d084bf9eda554bca6a4d8a608a429 000007e4: PUSH4 0xcb151112 000007e9: PUSH1 0x40 000007eb: MLOAD 000007ec: DUP2 000007ed: PUSH4 0xffffffff 000007f2: AND 000007f3: PUSH1 0xe0 000007f5: PUSH1 0x02 000007f7: EXP 000007f8: MUL 000007f9: DUP2 000007fa: MSTORE 000007fb: PUSH1 0x04 000007fd: ADD 000007fe: PUSH1 0x20 00000800: PUSH1 0x40 00000802: MLOAD 00000803: DUP1 00000804: DUP4 00000805: SUB 00000806: DUP2 00000807: DUP7 00000808: DUP1 00000809: EXTCODESIZE 0000080a: ISZERO 0000080b: DUP1 0000080c: ISZERO 0000080d: PUSH2 0x0815 00000810: JUMPI 00000811: PUSH1 0x00 00000813: DUP1 00000814: REVERT 00000815: JUMPDEST 00000816: POP 00000817: GAS 00000818: DELEGATECALL 00000819: ISZERO 0000081a: DUP1 0000081b: ISZERO 0000081c: PUSH2 0x0829 0000081f: JUMPI 00000820: RETURNDATASIZE 00000821: PUSH1 0x00 00000823: DUP1 00000824: RETURNDATACOPY 00000825: RETURNDATASIZE 00000826: PUSH1 0x00 00000828: REVERT 00000829: JUMPDEST 0000082a: POP 0000082b: POP 0000082c: POP 0000082d: POP 0000082e: PUSH1 0x40 00000830: MLOAD 00000831: RETURNDATASIZE 00000832: PUSH1 0x20 00000834: DUP2 00000835: LT 00000836: ISZERO 00000837: PUSH2 0x083f 0000083a: JUMPI 0000083b: PUSH1 0x00 0000083d: DUP1 0000083e: REVERT 0000083f: JUMPDEST 00000840: POP 00000841: MLOAD 00000842: SWAP11 00000843: SWAP12 00000844: SWAP10 00000845: SWAP11 00000846: SWAP9 00000847: SWAP10 00000848: SWAP8 00000849: SWAP9 0000084a: SWAP7 0000084b: SWAP8 0000084c: SWAP6 0000084d: SWAP7 0000084e: SWAP5 0000084f: SWAP6 00000850: SWAP4 00000851: SWAP5 00000852: SWAP3 00000853: SWAP4 00000854: SWAP2 00000855: SWAP3 00000856: PUSH1 0x07 00000858: MUL 00000859: TIMESTAMP 0000085a: DUP5 0000085b: SWAP1 0000085c: SUB 0000085d: LT 0000085e: ISZERO 0000085f: SWAP2 00000860: SWAP1 00000861: POP 00000862: JUMP 00000863: JUMPDEST 00000864: PUSH1 0x01 00000866: DUP2 00000867: DUP2 00000868: SLOAD 00000869: DUP2 0000086a: LT 0000086b: PUSH2 0x0870 0000086e: JUMPI 0000086f: INVALID 00000870: JUMPDEST 00000871: PUSH1 0x00 00000873: SWAP2 00000874: DUP3 00000875: MSTORE 00000876: PUSH1 0x20 00000878: SWAP1 00000879: SWAP2 0000087a: KECCAK256 0000087b: ADD 0000087c: SLOAD 0000087d: PUSH1 0x01 0000087f: PUSH1 0xa0 00000881: PUSH1 0x02 00000883: EXP 00000884: SUB 00000885: AND 00000886: SWAP1 00000887: POP 00000888: DUP2 00000889: JUMP 0000088a: JUMPDEST 0000088b: PUSH1 0x00 0000088d: DUP1 0000088e: JUMPDEST 0000088f: PUSH1 0x01 00000891: SLOAD 00000892: DUP2 00000893: LT 00000894: ISZERO 00000895: PUSH2 0x08db 00000898: JUMPI 00000899: CALLER 0000089a: PUSH1 0x01 0000089c: PUSH1 0xa0 0000089e: PUSH1 0x02 000008a0: EXP 000008a1: SUB 000008a2: AND 000008a3: PUSH1 0x01 000008a5: DUP3 000008a6: DUP2 000008a7: SLOAD 000008a8: DUP2 000008a9: LT 000008aa: PUSH2 0x08af 000008ad: JUMPI 000008ae: INVALID 000008af: JUMPDEST 000008b0: PUSH1 0x00 000008b2: SWAP2 000008b3: DUP3 000008b4: MSTORE 000008b5: PUSH1 0x20 000008b7: SWAP1 000008b8: SWAP2 000008b9: KECCAK256 000008ba: ADD 000008bb: SLOAD 000008bc: PUSH1 0x01 000008be: PUSH1 0xa0 000008c0: PUSH1 0x02 000008c2: EXP 000008c3: SUB 000008c4: AND 000008c5: EQ 000008c6: ISZERO 000008c7: PUSH2 0x08d3 000008ca: JUMPI 000008cb: PUSH1 0x01 000008cd: SWAP2 000008ce: POP 000008cf: PUSH2 0x08db 000008d2: JUMP 000008d3: JUMPDEST 000008d4: PUSH1 0x01 000008d6: ADD 000008d7: PUSH2 0x088e 000008da: JUMP 000008db: JUMPDEST 000008dc: POP 000008dd: DUP1 000008de: PUSH2 0x08e6 000008e1: JUMPI 000008e2: PUSH1 0x00 000008e4: DUP1 000008e5: REVERT 000008e6: JUMPDEST 000008e7: POP 000008e8: PUSH1 0x00 000008ea: DUP1 000008eb: SLOAD 000008ec: PUSH1 0x01 000008ee: DUP2 000008ef: ADD 000008f0: DUP3 000008f1: SSTORE 000008f2: SWAP1 000008f3: DUP1 000008f4: MSTORE 000008f5: PUSH32 0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563 00000916: ADD 00000917: DUP1 00000918: SLOAD 00000919: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 0000092e: NOT 0000092f: AND 00000930: PUSH1 0x01 00000932: PUSH1 0xa0 00000934: PUSH1 0x02 00000936: EXP 00000937: SUB 00000938: SWAP3 00000939: SWAP1 0000093a: SWAP3 0000093b: AND 0000093c: SWAP2 0000093d: SWAP1 0000093e: SWAP2 0000093f: OR 00000940: SWAP1 00000941: SSTORE 00000942: JUMP 00000943: JUMPDEST 00000944: PUSH1 0x03 00000946: SLOAD 00000947: DUP2 00000948: JUMP 00000949: JUMPDEST 0000094a: PUSH1 0x08 0000094c: DUP2 0000094d: DUP2 0000094e: SLOAD 0000094f: DUP2 00000950: LT 00000951: PUSH2 0x0956 00000954: JUMPI 00000955: INVALID 00000956: JUMPDEST 00000957: PUSH1 0x00 00000959: SWAP2 0000095a: DUP3 0000095b: MSTORE 0000095c: PUSH1 0x20 0000095e: SWAP1 0000095f: SWAP2 00000960: KECCAK256 00000961: ADD 00000962: SLOAD 00000963: SWAP1 00000964: POP 00000965: DUP2 00000966: JUMP 00000967: JUMPDEST 00000968: PUSH1 0x60 0000096a: PUSH1 0x00 0000096c: DUP1 0000096d: SLOAD 0000096e: DUP1 0000096f: PUSH1 0x20 00000971: MUL 00000972: PUSH1 0x20 00000974: ADD 00000975: PUSH1 0x40 00000977: MLOAD 00000978: SWAP1 00000979: DUP2 0000097a: ADD 0000097b: PUSH1 0x40 0000097d: MSTORE 0000097e: DUP1 0000097f: SWAP3 00000980: SWAP2 00000981: SWAP1 00000982: DUP2 00000983: DUP2 00000984: MSTORE 00000985: PUSH1 0x20 00000987: ADD 00000988: DUP3 00000989: DUP1 0000098a: SLOAD 0000098b: DUP1 0000098c: ISZERO 0000098d: PUSH2 0x09bf 00000990: JUMPI 00000991: PUSH1 0x20 00000993: MUL 00000994: DUP3 00000995: ADD 00000996: SWAP2 00000997: SWAP1 00000998: PUSH1 0x00 0000099a: MSTORE 0000099b: PUSH1 0x20 0000099d: PUSH1 0x00 0000099f: KECCAK256 000009a0: SWAP1 000009a1: JUMPDEST 000009a2: DUP2 000009a3: SLOAD 000009a4: PUSH1 0x01 000009a6: PUSH1 0xa0 000009a8: PUSH1 0x02 000009aa: EXP 000009ab: SUB 000009ac: AND 000009ad: DUP2 000009ae: MSTORE 000009af: PUSH1 0x01 000009b1: SWAP1 000009b2: SWAP2 000009b3: ADD 000009b4: SWAP1 000009b5: PUSH1 0x20 000009b7: ADD 000009b8: DUP1 000009b9: DUP4 000009ba: GT 000009bb: PUSH2 0x09a1 000009be: JUMPI 000009bf: JUMPDEST 000009c0: POP 000009c1: POP 000009c2: POP 000009c3: POP 000009c4: POP 000009c5: SWAP1 000009c6: POP 000009c7: JUMPDEST 000009c8: SWAP1 000009c9: JUMP 000009ca: JUMPDEST 000009cb: PUSH1 0x02 000009cd: SLOAD 000009ce: PUSH1 0x01 000009d0: PUSH1 0xa0 000009d2: PUSH1 0x02 000009d4: EXP 000009d5: SUB 000009d6: AND 000009d7: DUP2 000009d8: JUMP 000009d9: JUMPDEST 000009da: PUSH1 0x00 000009dc: DUP1 000009dd: JUMPDEST 000009de: PUSH1 0x01 000009e0: SLOAD 000009e1: DUP2 000009e2: LT 000009e3: ISZERO 000009e4: PUSH2 0x0a2a 000009e7: JUMPI 000009e8: CALLER 000009e9: PUSH1 0x01 000009eb: PUSH1 0xa0 000009ed: PUSH1 0x02 000009ef: EXP 000009f0: SUB 000009f1: AND 000009f2: PUSH1 0x01 000009f4: DUP3 000009f5: DUP2 000009f6: SLOAD 000009f7: DUP2 000009f8: LT 000009f9: PUSH2 0x09fe 000009fc: JUMPI 000009fd: INVALID 000009fe: JUMPDEST 000009ff: PUSH1 0x00 00000a01: SWAP2 00000a02: DUP3 00000a03: MSTORE 00000a04: PUSH1 0x20 00000a06: SWAP1 00000a07: SWAP2 00000a08: KECCAK256 00000a09: ADD 00000a0a: SLOAD 00000a0b: PUSH1 0x01 00000a0d: PUSH1 0xa0 00000a0f: PUSH1 0x02 00000a11: EXP 00000a12: SUB 00000a13: AND 00000a14: EQ 00000a15: ISZERO 00000a16: PUSH2 0x0a22 00000a19: JUMPI 00000a1a: PUSH1 0x01 00000a1c: SWAP2 00000a1d: POP 00000a1e: PUSH2 0x0a2a 00000a21: JUMP 00000a22: JUMPDEST 00000a23: PUSH1 0x01 00000a25: ADD 00000a26: PUSH2 0x09dd 00000a29: JUMP 00000a2a: JUMPDEST 00000a2b: POP 00000a2c: DUP1 00000a2d: PUSH2 0x0a35 00000a30: JUMPI 00000a31: PUSH1 0x00 00000a33: DUP1 00000a34: REVERT 00000a35: JUMPDEST 00000a36: PUSH1 0x04 00000a38: SLOAD 00000a39: PUSH1 0x00 00000a3b: PUSH1 0x01 00000a3d: JUMPDEST 00000a3e: PUSH1 0x05 00000a40: DUP2 00000a41: LT 00000a42: ISZERO 00000a43: PUSH2 0x0bf3 00000a46: JUMPI 00000a47: PUSH1 0x07 00000a49: SLOAD 00000a4a: PUSH1 0x40 00000a4c: DUP1 00000a4d: MLOAD 00000a4e: PUSH1 0xe0 00000a50: PUSH1 0x02 00000a52: EXP 00000a53: PUSH4 0xf6afe4f7 00000a58: MUL 00000a59: DUP2 00000a5a: MSTORE 00000a5b: PUSH1 0x04 00000a5d: DUP2 00000a5e: ADD 00000a5f: DUP5 00000a60: SWAP1 00000a61: MSTORE 00000a62: SWAP1 00000a63: MLOAD 00000a64: PUSH1 0x60 00000a66: SWAP3 00000a67: PUSH1 0x01 00000a69: PUSH1 0xa0 00000a6b: PUSH1 0x02 00000a6d: EXP 00000a6e: SUB 00000a6f: AND 00000a70: SWAP2 00000a71: PUSH4 0xf6afe4f7 00000a76: SWAP2 00000a77: PUSH1 0x24 00000a79: DUP1 00000a7a: DUP4 00000a7b: ADD 00000a7c: SWAP3 00000a7d: PUSH1 0x00 00000a7f: SWAP3 00000a80: SWAP2 00000a81: SWAP1 00000a82: DUP3 00000a83: SWAP1 00000a84: SUB 00000a85: ADD 00000a86: DUP2 00000a87: DUP7 00000a88: DUP1 00000a89: EXTCODESIZE 00000a8a: ISZERO 00000a8b: DUP1 00000a8c: ISZERO 00000a8d: PUSH2 0x0a95 00000a90: JUMPI 00000a91: PUSH1 0x00 00000a93: DUP1 00000a94: REVERT 00000a95: JUMPDEST 00000a96: POP 00000a97: GAS 00000a98: STATICCALL 00000a99: ISZERO 00000a9a: DUP1 00000a9b: ISZERO 00000a9c: PUSH2 0x0aa9 00000a9f: JUMPI 00000aa0: RETURNDATASIZE 00000aa1: PUSH1 0x00 00000aa3: DUP1 00000aa4: RETURNDATACOPY 00000aa5: RETURNDATASIZE 00000aa6: PUSH1 0x00 00000aa8: REVERT 00000aa9: JUMPDEST 00000aaa: POP 00000aab: POP 00000aac: POP 00000aad: POP 00000aae: PUSH1 0x40 00000ab0: MLOAD 00000ab1: RETURNDATASIZE 00000ab2: PUSH1 0x00 00000ab4: DUP3 00000ab5: RETURNDATACOPY 00000ab6: PUSH1 0x1f 00000ab8: RETURNDATASIZE 00000ab9: SWAP1 00000aba: DUP2 00000abb: ADD 00000abc: PUSH1 0x1f 00000abe: NOT 00000abf: AND 00000ac0: DUP3 00000ac1: ADD 00000ac2: PUSH1 0x40 00000ac4: MSTORE 00000ac5: PUSH1 0x20 00000ac7: DUP2 00000ac8: LT 00000ac9: ISZERO 00000aca: PUSH2 0x0ad2 00000acd: JUMPI 00000ace: PUSH1 0x00 00000ad0: DUP1 00000ad1: REVERT 00000ad2: JUMPDEST 00000ad3: DUP2 00000ad4: ADD 00000ad5: SWAP1 00000ad6: DUP1 00000ad7: DUP1 00000ad8: MLOAD 00000ad9: PUSH5 0x0100000000 00000adf: DUP2 00000ae0: GT 00000ae1: ISZERO 00000ae2: PUSH2 0x0aea 00000ae5: JUMPI 00000ae6: PUSH1 0x00 00000ae8: DUP1 00000ae9: REVERT 00000aea: JUMPDEST 00000aeb: DUP3 00000aec: ADD 00000aed: PUSH1 0x20 00000aef: DUP2 00000af0: ADD 00000af1: DUP5 00000af2: DUP2 00000af3: GT 00000af4: ISZERO 00000af5: PUSH2 0x0afd 00000af8: JUMPI 00000af9: PUSH1 0x00 00000afb: DUP1 00000afc: REVERT 00000afd: JUMPDEST 00000afe: DUP2 00000aff: MLOAD 00000b00: DUP6 00000b01: PUSH1 0x20 00000b03: DUP3 00000b04: MUL 00000b05: DUP4 00000b06: ADD 00000b07: GT 00000b08: PUSH5 0x0100000000 00000b0e: DUP3 00000b0f: GT 00000b10: OR 00000b11: ISZERO 00000b12: PUSH2 0x0b1a 00000b15: JUMPI 00000b16: PUSH1 0x00 00000b18: DUP1 00000b19: REVERT 00000b1a: JUMPDEST 00000b1b: POP 00000b1c: POP 00000b1d: DUP1 00000b1e: MLOAD 00000b1f: SWAP1 00000b20: SWAP5 00000b21: POP 00000b22: ISZERO 00000b23: ISZERO 00000b24: SWAP3 00000b25: POP 00000b26: PUSH2 0x0b32 00000b29: SWAP2 00000b2a: POP 00000b2b: POP 00000b2c: JUMPI 00000b2d: POP 00000b2e: PUSH2 0x0beb 00000b31: JUMP 00000b32: JUMPDEST 00000b33: PUSH1 0x00 00000b35: DUP2 00000b36: MLOAD 00000b37: PUSH1 0x64 00000b39: PUSH1 0x08 00000b3b: DUP6 00000b3c: DUP2 00000b3d: SLOAD 00000b3e: DUP2 00000b3f: LT 00000b40: PUSH2 0x0b45 00000b43: JUMPI 00000b44: INVALID 00000b45: JUMPDEST 00000b46: SWAP1 00000b47: PUSH1 0x00 00000b49: MSTORE 00000b4a: PUSH1 0x20 00000b4c: PUSH1 0x00 00000b4e: KECCAK256 00000b4f: ADD 00000b50: SLOAD 00000b51: DUP8 00000b52: MUL 00000b53: DUP2 00000b54: PUSH2 0x0b59 00000b57: JUMPI 00000b58: INVALID 00000b59: JUMPDEST 00000b5a: DIV 00000b5b: DUP2 00000b5c: PUSH2 0x0b61 00000b5f: JUMPI 00000b60: INVALID 00000b61: JUMPDEST 00000b62: DUP4 00000b63: MLOAD 00000b64: SWAP6 00000b65: SWAP1 00000b66: SWAP6 00000b67: ADD 00000b68: SWAP5 00000b69: DIV 00000b6a: SWAP1 00000b6b: POP 00000b6c: PUSH1 0x00 00000b6e: JUMPDEST 00000b6f: DUP3 00000b70: MLOAD 00000b71: DUP2 00000b72: LT 00000b73: ISZERO 00000b74: PUSH2 0x0be7 00000b77: JUMPI 00000b78: PUSH2 0x0b94 00000b7b: DUP4 00000b7c: DUP3 00000b7d: DUP2 00000b7e: MLOAD 00000b7f: DUP2 00000b80: LT 00000b81: PUSH2 0x0b86 00000b84: JUMPI 00000b85: INVALID 00000b86: JUMPDEST 00000b87: PUSH1 0x20 00000b89: MUL 00000b8a: PUSH1 0x20 00000b8c: ADD 00000b8d: ADD 00000b8e: MLOAD 00000b8f: DUP4 00000b90: PUSH2 0x0eaf 00000b93: JUMP 00000b94: JUMPDEST 00000b95: DUP2 00000b96: TIMESTAMP 00000b97: DUP5 00000b98: DUP4 00000b99: DUP2 00000b9a: MLOAD 00000b9b: DUP2 00000b9c: LT 00000b9d: PUSH2 0x0ba2 00000ba0: JUMPI 00000ba1: INVALID 00000ba2: JUMPDEST 00000ba3: PUSH1 0x20 00000ba5: MUL 00000ba6: PUSH1 0x20 00000ba8: ADD 00000ba9: ADD 00000baa: MLOAD 00000bab: PUSH1 0x01 00000bad: PUSH1 0xa0 00000baf: PUSH1 0x02 00000bb1: EXP 00000bb2: SUB 00000bb3: AND 00000bb4: PUSH32 0x577849f524d7a258c2926155a2654340b4c9b7c0491dbf34f0c508488f913907 00000bd5: PUSH1 0x40 00000bd7: MLOAD 00000bd8: PUSH1 0x40 00000bda: MLOAD 00000bdb: DUP1 00000bdc: SWAP2 00000bdd: SUB 00000bde: SWAP1 00000bdf: LOG4 00000be0: PUSH1 0x01 00000be2: ADD 00000be3: PUSH2 0x0b6e 00000be6: JUMP 00000be7: JUMPDEST 00000be8: POP 00000be9: POP 00000bea: POP 00000beb: JUMPDEST 00000bec: PUSH1 0x01 00000bee: ADD 00000bef: PUSH2 0x0a3d 00000bf2: JUMP 00000bf3: JUMPDEST 00000bf4: POP 00000bf5: PUSH1 0x40 00000bf7: DUP1 00000bf8: MLOAD 00000bf9: DUP3 00000bfa: DUP2 00000bfb: MSTORE 00000bfc: PUSH1 0x20 00000bfe: DUP2 00000bff: ADD 00000c00: DUP5 00000c01: SWAP1 00000c02: MSTORE 00000c03: DUP2 00000c04: MLOAD 00000c05: TIMESTAMP 00000c06: SWAP3 00000c07: PUSH32 0x6948b798f16f0e63888c1ac32860b1a94d311658719b7c7fb6953227b37c28b3 00000c28: SWAP3 00000c29: DUP3 00000c2a: SWAP1 00000c2b: SUB 00000c2c: ADD 00000c2d: SWAP1 00000c2e: LOG2 00000c2f: PUSH2 0x0c36 00000c32: PUSH2 0x0ed1 00000c35: JUMP 00000c36: JUMPDEST 00000c37: POP 00000c38: POP 00000c39: POP 00000c3a: JUMP 00000c3b: JUMPDEST 00000c3c: CALLER 00000c3d: PUSH1 0x00 00000c3f: SWAP1 00000c40: DUP2 00000c41: MSTORE 00000c42: PUSH1 0x05 00000c44: PUSH1 0x20 00000c46: MSTORE 00000c47: PUSH1 0x40 00000c49: SWAP1 00000c4a: KECCAK256 00000c4b: SLOAD 00000c4c: SWAP1 00000c4d: JUMP 00000c4e: JUMPDEST 00000c4f: PUSH1 0x00 00000c51: DUP1 00000c52: JUMPDEST 00000c53: PUSH1 0x01 00000c55: SLOAD 00000c56: DUP2 00000c57: LT 00000c58: ISZERO 00000c59: PUSH2 0x0c9f 00000c5c: JUMPI 00000c5d: CALLER 00000c5e: PUSH1 0x01 00000c60: PUSH1 0xa0 00000c62: PUSH1 0x02 00000c64: EXP 00000c65: SUB 00000c66: AND 00000c67: PUSH1 0x01 00000c69: DUP3 00000c6a: DUP2 00000c6b: SLOAD 00000c6c: DUP2 00000c6d: LT 00000c6e: PUSH2 0x0c73 00000c71: JUMPI 00000c72: INVALID 00000c73: JUMPDEST 00000c74: PUSH1 0x00 00000c76: SWAP2 00000c77: DUP3 00000c78: MSTORE 00000c79: PUSH1 0x20 00000c7b: SWAP1 00000c7c: SWAP2 00000c7d: KECCAK256 00000c7e: ADD 00000c7f: SLOAD 00000c80: PUSH1 0x01 00000c82: PUSH1 0xa0 00000c84: PUSH1 0x02 00000c86: EXP 00000c87: SUB 00000c88: AND 00000c89: EQ 00000c8a: ISZERO 00000c8b: PUSH2 0x0c97 00000c8e: JUMPI 00000c8f: PUSH1 0x01 00000c91: SWAP2 00000c92: POP 00000c93: PUSH2 0x0c9f 00000c96: JUMP 00000c97: JUMPDEST 00000c98: PUSH1 0x01 00000c9a: ADD 00000c9b: PUSH2 0x0c52 00000c9e: JUMP 00000c9f: JUMPDEST 00000ca0: POP 00000ca1: DUP1 00000ca2: PUSH2 0x0caa 00000ca5: JUMPI 00000ca6: PUSH1 0x00 00000ca8: DUP1 00000ca9: REVERT 00000caa: JUMPDEST 00000cab: PUSH1 0x00 00000cad: JUMPDEST 00000cae: PUSH1 0x00 00000cb0: SLOAD 00000cb1: DUP2 00000cb2: LT 00000cb3: ISZERO 00000cb4: PUSH2 0x0c36 00000cb7: JUMPI 00000cb8: DUP3 00000cb9: PUSH1 0x01 00000cbb: PUSH1 0xa0 00000cbd: PUSH1 0x02 00000cbf: EXP 00000cc0: SUB 00000cc1: AND 00000cc2: PUSH1 0x00 00000cc4: DUP3 00000cc5: DUP2 00000cc6: SLOAD 00000cc7: DUP2 00000cc8: LT 00000cc9: PUSH2 0x0cce 00000ccc: JUMPI 00000ccd: INVALID 00000cce: JUMPDEST 00000ccf: PUSH1 0x00 00000cd1: SWAP2 00000cd2: DUP3 00000cd3: MSTORE 00000cd4: PUSH1 0x20 00000cd6: SWAP1 00000cd7: SWAP2 00000cd8: KECCAK256 00000cd9: ADD 00000cda: SLOAD 00000cdb: PUSH1 0x01 00000cdd: PUSH1 0xa0 00000cdf: PUSH1 0x02 00000ce1: EXP 00000ce2: SUB 00000ce3: AND 00000ce4: EQ 00000ce5: ISZERO 00000ce6: PUSH2 0x0dbc 00000ce9: JUMPI 00000cea: PUSH1 0x00 00000cec: JUMPDEST 00000ced: PUSH1 0x00 00000cef: SLOAD 00000cf0: PUSH1 0x00 00000cf2: NOT 00000cf3: ADD 00000cf4: DUP2 00000cf5: LT 00000cf6: ISZERO 00000cf7: PUSH2 0x0d6c 00000cfa: JUMPI 00000cfb: PUSH1 0x00 00000cfd: DUP2 00000cfe: PUSH1 0x01 00000d00: ADD 00000d01: DUP2 00000d02: SLOAD 00000d03: DUP2 00000d04: LT 00000d05: PUSH2 0x0d0a 00000d08: JUMPI 00000d09: INVALID 00000d0a: JUMPDEST 00000d0b: PUSH1 0x00 00000d0d: SWAP2 00000d0e: DUP3 00000d0f: MSTORE 00000d10: PUSH1 0x20 00000d12: DUP3 00000d13: KECCAK256 00000d14: ADD 00000d15: SLOAD 00000d16: DUP2 00000d17: SLOAD 00000d18: PUSH1 0x01 00000d1a: PUSH1 0xa0 00000d1c: PUSH1 0x02 00000d1e: EXP 00000d1f: SUB 00000d20: SWAP1 00000d21: SWAP2 00000d22: AND 00000d23: SWAP2 00000d24: SWAP1 00000d25: DUP4 00000d26: SWAP1 00000d27: DUP2 00000d28: LT 00000d29: PUSH2 0x0d2e 00000d2c: JUMPI 00000d2d: INVALID 00000d2e: JUMPDEST 00000d2f: PUSH1 0x00 00000d31: SWAP2 00000d32: DUP3 00000d33: MSTORE 00000d34: PUSH1 0x20 00000d36: SWAP1 00000d37: SWAP2 00000d38: KECCAK256 00000d39: ADD 00000d3a: DUP1 00000d3b: SLOAD 00000d3c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000d51: NOT 00000d52: AND 00000d53: PUSH1 0x01 00000d55: PUSH1 0xa0 00000d57: PUSH1 0x02 00000d59: EXP 00000d5a: SUB 00000d5b: SWAP3 00000d5c: SWAP1 00000d5d: SWAP3 00000d5e: AND 00000d5f: SWAP2 00000d60: SWAP1 00000d61: SWAP2 00000d62: OR 00000d63: SWAP1 00000d64: SSTORE 00000d65: PUSH1 0x01 00000d67: ADD 00000d68: PUSH2 0x0cec 00000d6b: JUMP 00000d6c: JUMPDEST 00000d6d: POP 00000d6e: PUSH1 0x00 00000d70: DUP1 00000d71: SLOAD 00000d72: PUSH1 0x00 00000d74: NOT 00000d75: DUP2 00000d76: ADD 00000d77: SWAP1 00000d78: DUP2 00000d79: LT 00000d7a: PUSH2 0x0d7f 00000d7d: JUMPI 00000d7e: INVALID 00000d7f: JUMPDEST 00000d80: PUSH1 0x00 00000d82: SWAP2 00000d83: DUP3 00000d84: MSTORE 00000d85: PUSH1 0x20 00000d87: DUP3 00000d88: KECCAK256 00000d89: ADD 00000d8a: DUP1 00000d8b: SLOAD 00000d8c: PUSH20 0xffffffffffffffffffffffffffffffffffffffff 00000da1: NOT 00000da2: AND 00000da3: SWAP1 00000da4: SSTORE 00000da5: DUP1 00000da6: SLOAD 00000da7: SWAP1 00000da8: PUSH2 0x0db5 00000dab: SWAP1 00000dac: PUSH1 0x00 00000dae: NOT 00000daf: DUP4 00000db0: ADD 00000db1: PUSH2 0x0ed8 00000db4: JUMP 00000db5: JUMPDEST 00000db6: POP 00000db7: POP 00000db8: PUSH2 0x0dc4 00000dbb: JUMP 00000dbc: JUMPDEST 00000dbd: PUSH1 0x01 00000dbf: ADD 00000dc0: PUSH2 0x0cad 00000dc3: JUMP 00000dc4: JUMPDEST 00000dc5: POP 00000dc6: POP 00000dc7: JUMP 00000dc8: JUMPDEST 00000dc9: CALLER 00000dca: DUP1 00000dcb: EXTCODESIZE 00000dcc: SWAP1 00000dcd: DUP2 00000dce: ISZERO 00000dcf: PUSH2 0x0e39 00000dd2: JUMPI 00000dd3: PUSH1 0x40 00000dd5: DUP1 00000dd6: MLOAD 00000dd7: PUSH32 0x08c379a000000000000000000000000000000000000000000000000000000000 00000df8: DUP2 00000df9: MSTORE 00000dfa: PUSH1 0x20 00000dfc: PUSH1 0x04 00000dfe: DUP3 00000dff: ADD 00000e00: MSTORE 00000e01: PUSH1 0x0b 00000e03: PUSH1 0x24 00000e05: DUP3 00000e06: ADD 00000e07: MSTORE 00000e08: PUSH32 0x44414f5f5761726e696e67000000000000000000000000000000000000000000 00000e29: PUSH1 0x44 00000e2b: DUP3 00000e2c: ADD 00000e2d: MSTORE 00000e2e: SWAP1 00000e2f: MLOAD 00000e30: SWAP1 00000e31: DUP2 00000e32: SWAP1 00000e33: SUB 00000e34: PUSH1 0x64 00000e36: ADD 00000e37: SWAP1 00000e38: REVERT 00000e39: JUMPDEST 00000e3a: CALLER 00000e3b: PUSH1 0x00 00000e3d: DUP2 00000e3e: DUP2 00000e3f: MSTORE 00000e40: PUSH1 0x05 00000e42: PUSH1 0x20 00000e44: MSTORE 00000e45: PUSH1 0x40 00000e47: DUP1 00000e48: DUP3 00000e49: KECCAK256 00000e4a: DUP1 00000e4b: SLOAD 00000e4c: SWAP1 00000e4d: DUP4 00000e4e: SWAP1 00000e4f: SSTORE 00000e50: SWAP1 00000e51: MLOAD 00000e52: SWAP1 00000e53: SWAP3 00000e54: SWAP2 00000e55: DUP4 00000e56: ISZERO 00000e57: PUSH2 0x08fc 00000e5a: MUL 00000e5b: SWAP2 00000e5c: DUP5 00000e5d: SWAP2 00000e5e: DUP2 00000e5f: DUP2 00000e60: DUP2 00000e61: DUP6 00000e62: DUP9 00000e63: DUP9 00000e64: CALL 00000e65: SWAP4 00000e66: POP 00000e67: POP 00000e68: POP 00000e69: POP 00000e6a: ISZERO 00000e6b: DUP1 00000e6c: ISZERO 00000e6d: PUSH2 0x0e7a 00000e70: JUMPI 00000e71: RETURNDATASIZE 00000e72: PUSH1 0x00 00000e74: DUP1 00000e75: RETURNDATACOPY 00000e76: RETURNDATASIZE 00000e77: PUSH1 0x00 00000e79: REVERT 00000e7a: JUMPDEST 00000e7b: POP 00000e7c: PUSH1 0x40 00000e7e: MLOAD 00000e7f: DUP2 00000e80: SWAP1 00000e81: TIMESTAMP 00000e82: SWAP1 00000e83: CALLER 00000e84: SWAP1 00000e85: PUSH32 0xbddd1ccdc906c307cb4efb86d73316b7d08fed8f446e5a863761b92155fe15aa 00000ea6: SWAP1 00000ea7: PUSH1 0x00 00000ea9: SWAP1 00000eaa: LOG4 00000eab: POP 00000eac: POP 00000ead: POP 00000eae: JUMP 00000eaf: JUMPDEST 00000eb0: PUSH1 0x01 00000eb2: PUSH1 0xa0 00000eb4: PUSH1 0x02 00000eb6: EXP 00000eb7: SUB 00000eb8: SWAP1 00000eb9: SWAP2 00000eba: AND 00000ebb: PUSH1 0x00 00000ebd: SWAP1 00000ebe: DUP2 00000ebf: MSTORE 00000ec0: PUSH1 0x05 00000ec2: PUSH1 0x20 00000ec4: MSTORE 00000ec5: PUSH1 0x40 00000ec7: SWAP1 00000ec8: KECCAK256 00000ec9: DUP1 00000eca: SLOAD 00000ecb: SWAP1 00000ecc: SWAP2 00000ecd: ADD 00000ece: SWAP1 00000ecf: SSTORE 00000ed0: JUMP 00000ed1: JUMPDEST 00000ed2: PUSH1 0x00 00000ed4: PUSH1 0x04 00000ed6: SSTORE 00000ed7: JUMP 00000ed8: JUMPDEST 00000ed9: DUP2 00000eda: SLOAD 00000edb: DUP2 00000edc: DUP4 00000edd: SSTORE 00000ede: DUP2 00000edf: DUP2 00000ee0: GT 00000ee1: ISZERO 00000ee2: PUSH2 0x0c36 00000ee5: JUMPI 00000ee6: PUSH1 0x00 00000ee8: DUP4 00000ee9: DUP2 00000eea: MSTORE 00000eeb: PUSH1 0x20 00000eed: SWAP1 00000eee: KECCAK256 00000eef: PUSH2 0x0c36 00000ef2: SWAP2 00000ef3: DUP2 00000ef4: ADD 00000ef5: SWAP1 00000ef6: DUP4 00000ef7: ADD 00000ef8: PUSH2 0x09c7 00000efb: SWAP2 00000efc: SWAP1 00000efd: JUMPDEST 00000efe: DUP1 00000eff: DUP3 00000f00: GT 00000f01: ISZERO 00000f02: PUSH2 0x0f11 00000f05: JUMPI 00000f06: PUSH1 0x00 00000f08: DUP2 00000f09: SSTORE 00000f0a: PUSH1 0x01 00000f0c: ADD 00000f0d: PUSH2 0x0efd 00000f10: JUMP 00000f11: JUMPDEST 00000f12: POP 00000f13: SWAP1 00000f14: JUMP 00000f15: INVALID 00000f16: LOG1 00000f17: PUSH6 0x627a7a723058 00000f1e: KECCAK256 00000f1f: UNKNOWN(0x0D) 00000f20: UNKNOWN(0xAE) 00000f21: UNKNOWN(0x21) 00000f22: BLOBHASH 00000f23: UNKNOWN(0x1F) 00000f24: UNKNOWN(0xDC) 00000f25: SWAP8 00000f26: MULMOD 00000f27: PUSH9 0x5aa626e24f6fb70e47 00000f31: UNKNOWN(0xB7) 00000f32: CLZ 00000f33: PUSH8 0x755db9809f8a2f4d 00000f3c: MLOAD 00000f3d: UNKNOWN(0xDA) 00000f3e: UNKNOWN(0xD9) 00000f3f: STOP 00000f40: UNKNOWN(0x29)
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | upgradeability | detector | Untrusted DELEGATECALL target reachable | 70 | no | no |
viewtrace_id: 0xa01c7dba622404a4d553bf11e07aaa7283d3f204d993e5dce45b04af2c5c6bf7
call_targets:
0x3bd98cd3499d084bf9eda554bca6a4d8a608a429
target_varies:
no
classification:
constant_target
validation_json{
"sink": "DELEGATECALL",
"errors": 0,
"status": "sink_reached",
"attempts": 85,
"trace_id": "0xa01c7dba622404a4d553bf11e07aaa7283d3f204d993e5dce45b04af2c5c6bf7",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0x3bd98cd3499d084bf9eda554bca6a4d8a608a429"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xe3247648",
"selector": "0xe3247648",
"calldata_variants": [
"0xe3247648",
"0xe32476480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xedaad3c3",
"selector": "0xedaad3c3",
"calldata_variants": [
"0xedaad3c3",
"0xedaad3c30000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf602dd06",
"selector": "0xf602dd06",
"calldata_variants": [
"0xf602dd06",
"0xf602dd060000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfeea0226",
"selector": "0xfeea0226",
"calldata_variants": [
"0xfeea0226",
"0xfeea02260000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x92e35aac",
"selector": "0x92e35aac",
"calldata_variants": [
"0x92e35aac",
"0x92e35aac0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x9570f901",
"selector": "0x9570f901",
"calldata_variants": [
"0x9570f901",
"0x9570f9010000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd7f3de83",
"selector": "0xd7f3de83",
"calldata_variants": [
"0xd7f3de83",
"0xd7f3de830000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x45f09ce9",
"selector": "0x45f09ce9",
"calldata_variants": [
"0x45f09ce9",
"0x45f09ce90000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 2072,
"opcode": "DELEGATECALL",
"returndata_checked": null,
"value_expression_category": "n/a",
"target_expression_category": "computed"
}
],
"guards_detected": [],
"delegatecall_count": 1,
"untrusted_delegatecall_count": 1
}
|
| high | other | detector | Untrusted CALL target/value reachable | 60 | no | no |
viewtrace_id: 0x697f3ddd4aa919484112e4f3ff49df345e86df7feabd394d31e16db8f14ab725
call_targets:
0xaa012cb378ac19977d8c2a048ac2ca07b2419732
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x697f3ddd4aa919484112e4f3ff49df345e86df7feabd394d31e16db8f14ab725",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xaa012cb378ac19977d8c2a048ac2ca07b2419732"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xe3247648",
"selector": "0xe3247648",
"calldata_variants": [
"0xe3247648",
"0xe32476480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xedaad3c3",
"selector": "0xedaad3c3",
"calldata_variants": [
"0xedaad3c3",
"0xedaad3c30000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf602dd06",
"selector": "0xf602dd06",
"calldata_variants": [
"0xf602dd06",
"0xf602dd060000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfeea0226",
"selector": "0xfeea0226",
"calldata_variants": [
"0xfeea0226",
"0xfeea02260000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x92e35aac",
"selector": "0x92e35aac",
"calldata_variants": [
"0x92e35aac",
"0x92e35aac0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x9570f901",
"selector": "0x9570f901",
"calldata_variants": [
"0x9570f901",
"0x9570f9010000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd7f3de83",
"selector": "0xd7f3de83",
"calldata_variants": [
"0xd7f3de83",
"0xd7f3de830000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x45f09ce9",
"selector": "0x45f09ce9",
"calldata_variants": [
"0x45f09ce9",
"0x45f09ce90000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 3684,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 1,
"guards_detected": [],
"untrusted_call_count": 1
}
|
| high | other | detector | ETH value transfer possible | 55 | no | no |
viewtrace_id: 0x697f3ddd4aa919484112e4f3ff49df345e86df7feabd394d31e16db8f14ab725
call_targets:
0xaa012cb378ac19977d8c2a048ac2ca07b2419732
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x697f3ddd4aa919484112e4f3ff49df345e86df7feabd394d31e16db8f14ab725",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xaa012cb378ac19977d8c2a048ac2ca07b2419732"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0xe3247648",
"selector": "0xe3247648",
"calldata_variants": [
"0xe3247648",
"0xe32476480000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xedaad3c3",
"selector": "0xedaad3c3",
"calldata_variants": [
"0xedaad3c3",
"0xedaad3c30000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf602dd06",
"selector": "0xf602dd06",
"calldata_variants": [
"0xf602dd06",
"0xf602dd060000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfeea0226",
"selector": "0xfeea0226",
"calldata_variants": [
"0xfeea0226",
"0xfeea02260000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x92e35aac",
"selector": "0x92e35aac",
"calldata_variants": [
"0x92e35aac",
"0x92e35aac0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x9570f901",
"selector": "0x9570f901",
"calldata_variants": [
"0x9570f901",
"0x9570f9010000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xd7f3de83",
"selector": "0xd7f3de83",
"calldata_variants": [
"0xd7f3de83",
"0xd7f3de830000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x45f09ce9",
"selector": "0x45f09ce9",
"calldata_variants": [
"0x45f09ce9",
"0x45f09ce90000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 3684,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 1,
"guards_detected": []
}
|
| medium | upgradeability | cast | DELEGATECALL present | 80 | no | — |
viewevidence_json{
"notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
"delegatecall_count": 1
}
|
| info | other | cast | Heavy EXTCODE*/BALANCE usage | 55 | no | — |
viewevidence_json{
"notes": "frequent external code or balance checks; may indicate introspection or validation logic",
"ext_balance_count": 7
}
|