TW
Tripwire
Find contracts. Test them. Review real vulns.

Analysis Run

edcc155b-17a1-450d-b845-c79d9f717d86

failed
Chain ID
1
Address
0xe1653109e79a5014f62287104428e6e2a79125a2
Block Number
—
Created
Mon, Dec 29, 2025 9:52 PM
Review Summary

What survived the funnel

Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?

back to vulns open contract
Confirmed
0
Validated
0
Source
Verified
Review Backing
Not yet
Best current signal
Untrusted DELEGATECALL target reachable
crit 0 high 0 direct contract
Review Checklist
1. Read the findings table first. Ignore raw jobs until the result looks real.
2. Confirm attacker control, not just the existence of a sink.
3. Confirm money or privilege impact.
4. Keep it if the behavior is real. Kill it if this is normal proxy, admin, or upgrade plumbing.

Processing Jobs

Status & attempts
ID Type Status Attempts Heartbeat
30586 report.consolidate complete 1 / 1 3 months ago
104375 artifact.fetch failed 1 / 3 1 week ago
104376 tool.cast_disasm complete 1 / 3 1 week ago
104377 analysis.bundle complete 1 / 3 1 week ago
104378 capability.graph complete 1 / 3 1 week ago
104379 detector.run complete 1 / 3 1 week ago
104380 validation.fork complete 1 / 3 1 week ago

Artifact

Runtime bytecode: available
Creation TX: —
Deployer: —
Proxy: no
Implementation:
—
Verified Source: yes

Slither

tool.slither

No slither job recorded yet.

Codex

report.consolidate
Job Status
complete
Attempts
1 / 1
Findings
0
No findings?
yes
Summary
Reviewed `contracts/src/Stream.sol` and `contracts/src/IStream.sol`; no exploitable vulnerabilities found in scope. Assumes the factory enforces valid stream parameters and standard ERC20 behavior.
View stderr 
[codex:1037723] OpenAI Codex v0.77.0 (research preview)
[codex:1037723] --------
[codex:1037723] workdir: /tmp/codex-multi-l7aloro8
[codex:1037723] model: gpt-5.2-codex
[codex:1037723] provider: openai
[codex:1037723] approval: never
[codex:1037723] sandbox: read-only
[codex:1037723] reasoning effort: xhigh
[codex:1037723] reasoning summaries: auto
[codex:1037723] session id: 019b6c14-593d-7202-a56a-e5ec842fd8e1
[codex:1037723] --------
[codex:1037723] user
[codex:1037723] You are a security auditor. Audit this Solidity codebase for exploitable vulnerabilities.
[codex:1037723] Focus on: reentrancy, access control, upgradeability/proxy issues, signature validation, oracle manipulation,
[codex:1037723] accounting/invariant breaks, external call patterns, unchecked return values, and dangerous delegatecall.
[codex:1037723] 
[codex:1037723] Scope rules:
[codex:1037723] - You MUST fully read `AUDIT_BUNDLE.txt` before concluding. It contains the complete contents of all first-party `contracts/**/*.sol` files.
[codex:1037723] - Treat `lib/` and `@openzeppelin/` as third-party dependencies; skip them unless there is a concrete misuse angle in first-party code.
[codex:1037723] 
[codex:1037723] Output MUST be valid JSON matching the provided schema.
[codex:1037723] - If you find nothing meaningful: set no_findings=true and findings=[].
[codex:1037723] - Otherwise: set no_findings=false and include findings with severity/category/title and file/line locations when possible.
[codex:1037723] 
[codex:1037723] Output constraints (IMPORTANT):
[codex:1037723] - severity MUST be exactly one of: info, low, medium, high, critical (lowercase).
[codex:1037723] - category MUST be exactly one of: access_control, reentrancy, math, oracle, upgradeability, auth, other.
[codex:1037723] mcp startup: no servers
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Preparing to read AUDIT_BUNDLE**
[codex:1037723] exec
[codex:1037723] /bin/bash -lc ls in /tmp/codex-multi-l7aloro8 succeeded in 5ms:
[codex:1037723] AUDIT_BUNDLE.txt
[codex:1037723] codex-output-schema.json
[codex:1037723] contracts
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Reading file**
[codex:1037723] exec
[codex:1037723] /bin/bash -lc 'cat AUDIT_BUNDLE.txt' in /tmp/codex-multi-l7aloro8 succeeded in 5ms:
[codex:1037723] This file concatenates the full contents of first-party Solidity sources for auditing.
[codex:1037723] 
[codex:1037723] ================================================================================
[codex:1037723] FILE: contracts/lib/openzeppelin-contracts/contracts/interfaces/IERC20.sol
[codex:1037723] ================================================================================
[codex:1037723] // SPDX-License-Identifier: MIT
[codex:1037723] // OpenZeppelin Contracts v4.4.1 (interfaces/IERC20.sol)
[codex:1037723] 
[codex:1037723] pragma solidity ^0.8.0;
[codex:1037723] 
[codex:1037723] import "../token/ERC20/IERC20.sol";
[codex:1037723] 
[codex:1037723] ================================================================================
[codex:1037723] FILE: contracts/lib/openzeppelin-contracts/contracts/token/ERC20/IERC20.sol
[codex:1037723] ================================================================================
[codex:1037723] // SPDX-License-Identifier: MIT
[codex:1037723] // OpenZeppelin Contracts (last updated v4.6.0) (token/ERC20/IERC20.sol)
[codex:1037723] 
[codex:1037723] pragma solidity ^0.8.0;
[codex:1037723] 
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Ensuring complete AUDIT_BUNDLE reading**
[codex:1037723] exec
[codex:1037723] /bin/bash -lc "sed -n '1,200p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-l7aloro8 succeeded in 6ms:
[codex:1037723] This file concatenates the full contents of first-party Solidity sources for auditing.
[codex:1037723] 
[codex:1037723] ================================================================================
[codex:1037723] FILE: contracts/lib/openzeppelin-contracts/contracts/interfaces/IERC20.sol
[codex:1037723] ================================================================================
[codex:1037723] // SPDX-License-Identifier: MIT
[codex:1037723] // OpenZeppelin Contracts v4.4.1 (interfaces/IERC20.sol)
[codex:1037723] 
[codex:1037723] pragma solidity ^0.8.0;
[codex:1037723] 
[codex:1037723] import "../token/ERC20/IERC20.sol";
[codex:1037723] 
[codex:1037723] ================================================================================
[codex:1037723] FILE: contracts/lib/openzeppelin-contracts/contracts/token/ERC20/IERC20.sol
[codex:1037723] ================================================================================
[codex:1037723] // SPDX-License-Identifier: MIT
[codex:1037723] // OpenZeppelin Contracts (last updated v4.6.0) (token/ERC20/IERC20.sol)
[codex:1037723] 
[codex:1037723] pragma solidity ^0.8.0;
[codex:1037723] 
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Requesting more file content**
[codex:1037723] exec
[codex:1037723] /bin/bash -lc "sed -n '200,400p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-l7aloro8 succeeded in 6ms:
[codex:1037723]     ) internal {
[codex:1037723]         _callOptionalReturn(token, abi.encodeWithSelector(token.transferFrom.selector, from, to, value));
[codex:1037723]     }
[codex:1037723] 
[codex:1037723]     /**
[codex:1037723]      * @dev Deprecated. This function has issues similar to the ones found in
[codex:1037723]      * {IERC20-approve}, and its usage is discouraged.
[codex:1037723]      *
[codex:1037723]      * Whenever possible, use {safeIncreaseAllowance} and
[codex:1037723]      * {safeDecreaseAllowance} instead.
[codex:1037723]      */
[codex:1037723]     function safeApprove(
[codex:1037723]         IERC20 token,
[codex:1037723]         address spender,
[codex:1037723]         uint256 value
[codex:1037723]     ) internal {
[codex:1037723]         // safeApprove should only be called when setting an initial allowance,
[codex:1037723]         // or when resetting it to zero. To increase and decrease it, use
[codex:1037723]         // 'safeIncreaseAllowance' and 'safeDecreaseAllowance'
[codex:1037723]         require(
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Continuing exploration**
[codex:1037723] exec
[codex:1037723] /bin/bash -lc "sed -n '400,800p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-l7aloro8 succeeded in 5ms:
[codex:1037723]         address target,
[codex:1037723]         bytes memory data,
[codex:1037723]         uint256 value
[codex:1037723]     ) internal returns (bytes memory) {
[codex:1037723]         return functionCallWithValue(target, data, value, "Address: low-level call with value failed");
[codex:1037723]     }
[codex:1037723] 
[codex:1037723]     /**
[codex:1037723]      * @dev Same as {xref-Address-functionCallWithValue-address-bytes-uint256-}[`functionCallWithValue`], but
[codex:1037723]      * with `errorMessage` as a fallback revert reason when `target` reverts.
[codex:1037723]      *
[codex:1037723]      * _Available since v3.1._
[codex:1037723]      */
[codex:1037723]     function functionCallWithValue(
[codex:1037723]         address target,
[codex:1037723]         bytes memory data,
[codex:1037723]         uint256 value,
[codex:1037723]         string memory errorMessage
[codex:1037723]     ) internal returns (bytes memory) {
[codex:1037723]         require(address(this).balance >= value, "Address: insufficient balance for call");
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Finishing exploration**
[codex:1037723] exec
[codex:1037723] /bin/bash -lc "sed -n '800,1200p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-l7aloro8 succeeded in 5ms:
[codex:1037723]                 result += 32;
[codex:1037723]             }
[codex:1037723]             if (value >= 10**16) {
[codex:1037723]                 value /= 10**16;
[codex:1037723]                 result += 16;
[codex:1037723]             }
[codex:1037723]             if (value >= 10**8) {
[codex:1037723]                 value /= 10**8;
[codex:1037723]                 result += 8;
[codex:1037723]             }
[codex:1037723]             if (value >= 10**4) {
[codex:1037723]                 value /= 10**4;
[codex:1037723]                 result += 4;
[codex:1037723]             }
[codex:1037723]             if (value >= 10**2) {
[codex:1037723]                 value /= 10**2;
[codex:1037723]                 result += 2;
[codex:1037723]             }
[codex:1037723]             if (value >= 10**1) {
[codex:1037723]                 result += 1;
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Finishing reading remaining content**
[codex:1037723] exec
[codex:1037723] /bin/bash -lc "sed -n '1200,1423p' AUDIT_BUNDLE.txt" in /tmp/codex-multi-l7aloro8 succeeded in 5ms:
[codex:1037723]         emit TokensWithdrawn(msg.sender, recipient_, amount);
[codex:1037723]     }
[codex:1037723] 
[codex:1037723]     /**
[codex:1037723]      * @notice Cancel the stream and update recipient's fair share of the funds to their current balance.
[codex:1037723]      * Each party must take additional action to withdraw their funds:
[codex:1037723]      * recipient must call `withdrawAfterCancel`.
[codex:1037723]      * payer must call `recoverTokens`.
[codex:1037723]      * Only this stream's payer or recipient can call this function.
[codex:1037723]      * Reverts if executed after recipient has withdrawn the full stream amount, or if executed more than once.
[codex:1037723]      */
[codex:1037723]     function cancel() external onlyPayerOrRecipient {
[codex:1037723]         address payer_ = payer();
[codex:1037723]         address recipient_ = recipient();
[codex:1037723] 
[codex:1037723]         if (remainingBalance == 0) revert StreamNotActive();
[codex:1037723] 
[codex:1037723]         uint256 recipientActiveBalance_ = recipientActiveBalance();
[codex:1037723] 
[codex:1037723]         // This token amount is available to recipient to withdraw via `withdrawAfterCancel`.
[codex:1037723] 
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Reviewing Stream contract for vulnerabilities**
[codex:1037723] thinking
[codex:1037723] **Evaluating risks of direct calls to implementation contract**
[codex:1037723] 
[codex:1037723] I'm examining how the immutable args cloning pattern may allow attackers to spoof access control by calling the implementation contract directly with crafted calldata, potentially letting them manipulate immutables and withdraw tokens if any are sent accidentally to the implementation. This is a known clone pattern risk but might warrant mitigation in this code.
[codex:1037723] exec
[codex:1037723] /bin/bash -lc 'rg --files contracts/src' in /tmp/codex-multi-l7aloro8 succeeded in 17ms:
[codex:1037723] contracts/src/Stream.sol
[codex:1037723] contracts/src/IStream.sol
[codex:1037723] 
[codex:1037723] 
[codex:1037723] 
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Analyzing token stream security nuances**
[codex:1037723] 
[codex:1037723] I'm carefully examining potential vulnerabilities around token withdrawals, recoveries, and clone initialization, focusing on subtle access control and reentrancy concerns—especially relating to delegated tokens, timestamp validations, and the implementation contract’s exposure to crafted calldata that could lead to unintended token drains.
[codex:1037723] thinking
[codex:1037723] **Evaluating token transfer and initialization risks**
[codex:1037723] 
[codex:1037723] I’m exploring issues involving deflationary tokens affecting payouts, the lack of initialization guards that could enable reinitialization by the factory allowing double withdrawals, unchecked arithmetic possibly causing balance miscalculations, and the security implications of calling the implementation contract directly versus via clones with immutable arguments.
[codex:1037723] thinking
[codex:1037723] **Reviewing reentrancy and arithmetic safety**
[codex:1037723] 
[codex:1037723] I’m analyzing reentrancy scenarios around token transfers, especially with ERC777 hooks, verifying internal modifier enforcement, and closely inspecting unchecked arithmetic in balance calculations that could impact withdrawal limits under extreme inputs or configuration errors.
[codex:1037723] thinking
[codex:1037723] **Summarizing final assessment and output format**
[codex:1037723] 
[codex:1037723] I’m concluding that there are no significant exploitable vulnerabilities given assumptions about factory trust and token standards, and I’m preparing a concise JSON summary with no findings to match the required output schema.
[codex:1037723] exec
[codex:1037723] /bin/bash -lc 'cat codex-output-schema.json' in /tmp/codex-multi-l7aloro8 succeeded in 7ms:
[codex:1037723] {"type": "object", "additionalProperties": false, "required": ["no_findings", "summary", "findings"], "properties": {"no_findings": {"type": "boolean"}, "summary": {"type": "string"}, "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["severity", "category", "title", "evidence", "locations", "exploit_scenario", "recommendation"], "properties": {"severity": {"type": "string", "enum": ["info", "low", "medium", "high", "critical"]}, "category": {"type": "string", "enum": ["access_control", "reentrancy", "math", "oracle", "upgradeability", "auth", "other"]}, "title": {"type": "string"}, "exploit_scenario": {"type": "string"}, "recommendation": {"type": "string"}, "evidence": {"type": "string"}, "locations": {"type": "array", "items": {"type": "string"}}}}}}}
[codex:1037723] 
[codex:1037723] thinking
[codex:1037723] **Preparing final JSON summary**
[codex:1037723] codex
[codex:1037723] {"no_findings":true,"summary":"Reviewed `contracts/src/Stream.sol` and `contracts/src/IStream.sol`; no exploitable vulnerabilities found in scope. Assumes the factory enforces valid stream parameters and standard ERC20 behavior.","findings":[]}
[codex:1037723] tokens used
[codex:1037723] 44,556
[codex:1037723] {"no_findings":true,"summary":"Reviewed `contracts/src/Stream.sol` and `contracts/src/IStream.sol`; no exploitable vulnerabilities found in scope. Assumes the factory enforces valid stream parameters and standard ERC20 behavior.","findings":[]}
Metadata 
{
    "codex": {
        "ran_at": "2025-12-29T21:52:32.466403+00:00",
        "returncode": 0
    },
    "summary": "Reviewed `contracts/src/Stream.sol` and `contracts/src/IStream.sol`; no exploitable vulnerabilities found in scope. Assumes the factory enforces valid stream parameters and standard ERC20 behavior.",
    "raw_final": {
        "summary": "Reviewed `contracts/src/Stream.sol` and `contracts/src/IStream.sol`; no exploitable vulnerabilities found in scope. Assumes the factory enforces valid stream parameters and standard ERC20 behavior.",
        "findings": [],
        "no_findings": true
    },
    "no_findings": true,
    "schema_version": 1
}

Opcode Heuristics

tool.cast_disasm
Delegatecall
1
Selfdestruct
0
CREATE2
0
CALL-family (heavy)
0
EXT*/BALANCE
1
Total opcodes
140
Flags
delegatecall_present create_opcodes_present
View cast disassembly output 
00000000: CALLDATASIZE
00000001: PUSH1 0x2c
00000003: JUMPI
00000004: CALLVALUE
00000005: RETURNDATASIZE
00000006: MSTORE
00000007: PUSH32 0x9e4ac34f21c619cefc926c8bd93b54bf5a39c7ab2127a895af1cc0691d7e3dff
00000028: MSIZE
00000029: RETURNDATASIZE
0000002a: LOG1
0000002b: STOP
0000002c: JUMPDEST
0000002d: CALLDATASIZE
0000002e: RETURNDATASIZE
0000002f: RETURNDATASIZE
00000030: CALLDATACOPY
00000031: RETURNDATASIZE
00000032: RETURNDATASIZE
00000033: RETURNDATASIZE
00000034: RETURNDATASIZE
00000035: PUSH2 0x00b2
00000038: DUP1
00000039: PUSH1 0x62
0000003b: CALLDATASIZE
0000003c: CODECOPY
0000003d: CALLDATASIZE
0000003e: ADD
0000003f: RETURNDATASIZE
00000040: PUSH20 0x0b9dff1aba32a9fa95011c7f097ec672f689038f
00000055: GAS
00000056: DELEGATECALL
00000057: RETURNDATASIZE
00000058: RETURNDATASIZE
00000059: SWAP4
0000005a: DUP1
0000005b: RETURNDATACOPY
0000005c: PUSH1 0x60
0000005e: JUMPI
0000005f: REVERT
00000060: JUMPDEST
00000061: RETURN
00000062: UNKNOWN(0x0F)
00000063: UNKNOWN(0xD2)
00000064: MOD
00000065: UNKNOWN(0xFC)
00000066: PUSH27 0x7dbcd5661157edcb1ffdd0d02a61ffb1a32fc9f9d8b2cf86c068ca
00000082: UNKNOWN(0xE1)
00000083: BALANCE
00000084: ADDMOD
00000085: DUP1
00000086: SWAP6
00000087: SELFBALANCE
00000088: UNKNOWN(0xEF)
00000089: PUSH18 0x8d2a84300d6ce230ed3fffc23dbcdf1e6c78
0000009c: UNKNOWN(0x1F)
0000009d: CREATE
0000009e: STOP
0000009f: STOP
000000a0: STOP
000000a1: STOP
000000a2: STOP
000000a3: STOP
000000a4: STOP
000000a5: STOP
000000a6: STOP
000000a7: STOP
000000a8: STOP
000000a9: STOP
000000aa: STOP
000000ab: STOP
000000ac: STOP
000000ad: STOP
000000ae: STOP
000000af: STOP
000000b0: STOP
000000b1: STOP
000000b2: STOP
000000b3: STOP
000000b4: STOP
000000b5: MOD
000000b6: DUP2
000000b7: SSTORE
000000b8: LOG4
000000b9: CALLDATASIZE
000000ba: PUSH23 0xe00000c02aaa39b223fe8d0a0e5c4f27ead9083c756cc2
000000d2: STOP
000000d3: STOP
000000d4: STOP
000000d5: STOP
000000d6: STOP
000000d7: STOP
000000d8: STOP
000000d9: STOP
000000da: STOP
000000db: STOP
000000dc: STOP
000000dd: STOP
000000de: STOP
000000df: STOP
000000e0: STOP
000000e1: STOP
000000e2: STOP
000000e3: STOP
000000e4: STOP
000000e5: STOP
000000e6: STOP
000000e7: STOP
000000e8: STOP
000000e9: STOP
000000ea: STOP
000000eb: STOP
000000ec: STOP
000000ed: STOP
000000ee: PUSH6 0x90af00000000
000000f5: STOP
000000f6: STOP
000000f7: STOP
000000f8: STOP
000000f9: STOP
000000fa: STOP
000000fb: STOP
000000fc: STOP
000000fd: STOP
000000fe: STOP
000000ff: STOP
00000100: STOP
00000101: STOP
00000102: STOP
00000103: STOP
00000104: STOP
00000105: STOP
00000106: STOP
00000107: STOP
00000108: STOP
00000109: STOP
0000010a: STOP
0000010b: STOP
0000010c: STOP
0000010d: STOP
0000010e: PUSH25

Findings

validated = confirmed for call sinks; sink observed for others
Severity Category Tool Title Confidence Validated Confirmed Details
critical upgradeability detector Untrusted DELEGATECALL target reachable 70 no no
view
validation_json 
{
    "sink": "DELEGATECALL",
    "errors": 10,
    "status": "unknown",
    "attempts": 11,
    "confirmed": false,
    "trace_mode": "callTracer",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x",
            "selector": "fallback",
            "calldata_variants": [
                "0x"
            ]
        }
    ]
}
evidence_json 
{
    "examples": [
        {
            "pc": 86,
            "opcode": "DELEGATECALL",
            "returndata_checked": null,
            "value_expression_category": "n/a",
            "target_expression_category": "computed"
        }
    ],
    "guards_detected": [],
    "delegatecall_count": 1,
    "untrusted_delegatecall_count": 1
}
medium upgradeability cast DELEGATECALL present 80 no —
view
evidence_json 
{
    "notes": "delegatecall enables execution in caller context; common in proxies/upgradeable patterns",
    "delegatecall_count": 1
}
medium other detector CREATE/CREATE2 reachable 45 no no
view
trace_id: 0x2ae27ba674f293e872ceebd7c3113768b623b6c5c12ad7a6a354567ab8d337c1
validation_json 
{
    "sink": "CREATE",
    "errors": 0,
    "status": "unknown",
    "attempts": 1,
    "trace_id": "0x2ae27ba674f293e872ceebd7c3113768b623b6c5c12ad7a6a354567ab8d337c1",
    "confirmed": false,
    "trace_mode": "structLogs",
    "call_targets": null,
    "matched_probe": null,
    "target_varies": null,
    "classification": "no_sink"
}
witness_json 
{
    "notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
    "constraints": [],
    "entrypoints": [
        {
            "calldata": "0x",
            "selector": "fallback",
            "calldata_variants": [
                "0x"
            ]
        }
    ]
}
evidence_json 
{
    "create_count": 1,
    "create2_count": 0
}
low other cast Contract creation opcode present 60 no —
view
evidence_json 
{
    "notes": "runtime can deploy contracts dynamically via CREATE/CREATE2",
    "create_count": 1,
    "create2_count": 0
}