f517204f-a968-4a9f-8960-e187c975c3b2
Open this run to answer one question: is this real attacker-relevant behavior with real impact, or just normal contract plumbing?
| ID | Type | Status | Attempts | Heartbeat |
|---|---|---|---|---|
| 31715 | report.consolidate | complete | 1 / 1 | 3 months ago |
| 95713 | artifact.fetch | complete | 1 / 3 | 1 week ago |
| 95714 | tool.cast_disasm | complete | 1 / 3 | 1 week ago |
| 95715 | analysis.bundle | complete | 1 / 3 | 1 week ago |
| 95716 | capability.graph | complete | 1 / 3 | 1 week ago |
| 95717 | detector.run | complete | 1 / 3 | 1 week ago |
| 95718 | validation.fork | complete | 1 / 3 | 1 week ago |
No slither job recorded yet.
[codex:1409703] OpenAI Codex v0.77.0 (research preview)
[codex:1409703] --------
[codex:1409703] workdir: /tmp/codex-multi-ptdmrz8c
[codex:1409703] model: gpt-5.2-codex
[codex:1409703] provider: openai
[codex:1409703] approval: never
[codex:1409703] sandbox: read-only
[codex:1409703] reasoning effort: xhigh
[codex:1409703] reasoning summaries: auto
[codex:1409703] session id: 019b8cd6-f9e3-7b52-b0d4-6747e2243c15
[codex:1409703] --------
[codex:1409703] user
[codex:1409703] You are a profit-focused exploit hunter analyzing EVM bytecode. Your ONLY goal is finding ways to extract value (ETH, tokens, NFTs) from this contract.
[codex:1409703]
[codex:1409703] Read `BYTECODE_BUNDLE.txt` completely before concluding.
[codex:1409703]
[codex:1409703] ONLY REPORT if you find a CONCRETE, EXPLOITABLE path to profit. We do NOT care about:
[codex:1409703] - Gas inefficiency, code quality, or best practices
[codex:1409703] - Theoretical vulnerabilities without a clear extraction path
[codex:1409703] - Generic footguns (unchecked return values, etc.) unless they enable theft
[codex:1409703] - Issues requiring social engineering or off-chain coordination
[codex:1409703]
[codex:1409703] PATTERNS WORTH INVESTIGATING in bytecode:
[codex:1409703] - CALL/DELEGATECALL with controllable destination or calldata
[codex:1409703] - Value transfers (CALL with non-zero value) without prior CALLER/ORIGIN checks
[codex:1409703] - SSTORE to low slots (0-10) that might be owner/admin storage
[codex:1409703] - ecrecover (signature validation) - look for missing nonce/replay protection
[codex:1409703] - External calls before state updates (reentrancy)
[codex:1409703] - SELFDESTRUCT with controllable beneficiary
[codex:1409703] - Proxy patterns (DELEGATECALL to storage slot) with unprotected upgrade paths
[codex:1409703]
[codex:1409703] For each finding, you MUST explain:
[codex:1409703] 1. The specific bytecode pattern/offsets that indicate the vulnerability
[codex:1409703] 2. The concrete sequence of transactions to extract value
[codex:1409703] 3. Why you believe this is exploitable (not just suspicious)
[codex:1409703]
[codex:1409703] If you cannot identify a concrete profit path from bytecode alone: set no_findings=true.
[codex:1409703] Do NOT hallucinate. Bytecode-only analysis is limited - be honest about uncertainty.
[codex:1409703]
[codex:1409703] Output MUST be valid JSON matching the provided schema.
[codex:1409703] - severity: info, low, medium, high, critical (use high/critical ONLY for clear extraction paths)
[codex:1409703] - category: access_control, reentrancy, math, oracle, upgradeability, auth, other
[codex:1409703] mcp startup: no servers
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Preparing to audit bytecode**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc ls in /tmp/codex-multi-ptdmrz8c succeeded in 6ms:
[codex:1409703] BYTECODE_BUNDLE.txt
[codex:1409703] codex-output-schema.json
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Reading file**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cat BYTECODE_BUNDLE.txt' in /tmp/codex-multi-ptdmrz8c succeeded in 5ms:
[codex:1409703] Runtime bytecode bundle for best-effort auditing.
[codex:1409703] Note: without verified source, conclusions are low-confidence unless a concrete pattern is visible.
[codex:1409703]
[codex:1409703] FILE: runtime_bytecode.hex
[codex:1409703] 0x6080604052600436106100945760003560e01c80638040fcb1116100595780638040fcb1146101425780638da5cb5b14610162578063c45a01551461019e578063f09a4016146101be578063fdcc0822146101de57600080fd5b8062f714ce146100a0578063434f94df146100c25780635fc3ea0b146100e257806368638cdf146101025780637c7a518d1461012257600080fd5b3661009b57005b600080fd5b3480156100ac57600080fd5b506100c06100bb3660046108d5565b6101fe565b005b3480156100ce57600080fd5b506100c06100dd366004610905565b61025d565b3480156100ee57600080fd5b506100c06100fd366004610905565b6102c7565b34801561010e57600080fd5b506100c061011d366004610905565b610306565b34801561012e57600080fd5b506100c061013d3660046108d5565b61039b565b34801561014e57600080fd5b506100c061015d366004610993565b6103ea565b34801561016e57600080fd5b50600054610182906001600160a01b031681565b6040516001600160a01b03909116815260200160405180910390f35b3480156101aa57600080fd5b50600154610182906001600160a01b031681565b3480156101ca57600080fd5b506100c06101d93660046109e8565b61047b565b3480156101ea57600080fd5b506100c06101f9366004610a16565b6105b3565b6000546001600160a01b031633148061022157506001546001600160a01b031633145b6102465760405162461bcd60e51b815260040161023d90610a58565b60405180910390fd5b6102596001600160a01b03821683610643565b5050565b6000546001600160a01b0316156102ac5760405162461bcd60e51b8152602060048201526013602482015272105b1c9958591e481a5b9a5d1a585b1a5e9959606a1b604482015260640161023d565b826102c16001600160a01b03821683856106da565b50505050565b6000546001600160a01b03163314806102ea57506001546001600160a01b031633145b6102ac5760405162461bcd60e51b815260040161023d90610a58565b6000546001600160a01b031633146103305760405162461bcd60e51b815260040161023d90610a58565b60405163a9059cbb60e01b81526001600160a01b0382811660048301526024820184905284919082169063a9059cbb90604401600060405180830381600087803b15801561037d57600080fd5b505af1158015610391573d6000803e3d6000fd5b5050505050505050565b6000546001600160a01b0316156102465760405162461bcd60e51b8152602060048201526013602482015272105b1c9958591e481a5b9a5d1a585b1a5e9959606a1b604482015260640161023d565b6000546001600160a01b031633146104145760405162461bcd60e51b815260040161023d90610a58565b8260005b82811015610474573684848381811061043357610433610a8f565b90506040020190506104638160200160208101906104519190610aa5565b6001600160a01b0385169083356106da565b5061046d81610ac2565b9050610418565b5050505050565b7ff0c57e16840df040f15088dc2f81fe391c3923bec73e23a9662efc9c229c6a008054600160401b810460ff16159067ffffffffffffffff166000811580156104c15750825b905060008267ffffffffffffffff1660011480156104de5750303b155b9050811580156104ec575080155b1561050a5760405163f92ee8a960e01b815260040160405180910390fd5b845467ffffffffffffffff19166001178555831561053457845460ff60401b1916600160401b1785555b600080546001600160a01b03808a166001600160a01b031992831617909255600180549289169290911691909117905583156105aa57845460ff60401b19168555604051600181527fc7f505b2f371ae2175ee4913f4499e1f2633a7b5936321eed1cdaeb6115181d29060200160405180910390a15b50505050505050565b6000546001600160a01b031633146105dd5760405162461bcd60e51b815260040161023d90610a58565b60005b8181101561063e57368383838181106105fb576105fb610a8f565b905060400201905061062d816000013582602001602081019061061e9190610aa5565b6001600160a01b031690610643565b5061063781610ac2565b90506105e0565b505050565b804710156106665760405163cd78605960e01b815230600482015260240161023d565b6000826001600160a01b03168260405160006040518083038185875af1925050503d80600081146106b3576040519150601f19603f3d011682016040523d82523d6000602084013e6106b8565b606091505b505090508061063e57604051630a12f52160e11b815260040160405180910390fd5b604080516001600160a01b03848116602483015260448083018590528351808403909101815260649092019092526020810180516001600160e01b031663a9059cbb60e01b17905261063e9185919060009061073890841683610786565b9050805160001415801561075d57508080602001905181019061075b9190610ae9565b155b1561063e57604051635274afe760e01b81526001600160a01b038416600482015260240161023d565b60606107948383600061079b565b9392505050565b6060814710156107c05760405163cd78605960e01b815230600482015260240161023d565b600080856001600160a01b031684866040516107dc9190610b0b565b60006040518083038185875af1925050503d8060008114610819576040519150601f19603f3d011682016040523d82523d6000602084013e61081e565b606091505b509150915061082e868383610838565b9695505050505050565b60608261084d5761084882610894565b610794565b815115801561086457506001600160a01b0384163b155b1561088d57604051639996b31560e01b81526001600160a01b038516600482015260240161023d565b5080610794565b8051156108a45780518082602001fd5b604051630a12f52160e11b815260040160405180910390fd5b50565b6001600160a01b03811681146108bd57600080fd5b600080604083850312156108e857600080fd5b8235915060208301356108fa816108c0565b809150509250929050565b60008060006060848603121561091a57600080fd5b8335610925816108c0565b925060208401359150604084013561093c816108c0565b809150509250925092565b60008083601f84011261095957600080fd5b50813567ffffffffffffffff81111561097157600080fd5b6020830191508360208260061b850101111561098c57600080fd5b9250929050565b6000806000604084860312156109a857600080fd5b83356109b3816108c0565b9250602084013567ffffffffffffffff8111156109cf57600080fd5b6109db86828701610947565b9497909650939450505050565b600080604083850312156109fb57600080fd5b8235610a06816108c0565b915060208301356108fa816108c0565b60008060208385031215610a2957600080fd5b823567ffffffffffffffff811115610a4057600080fd5b610a4c85828601610947565b90969095509350505050565b60208082526017908201527f4f6e6c79206f776e65722063616e207769746864726177000000000000000000604082015260600190565b634e487b7160e01b600052603260045260246000fd5b600060208284031215610ab757600080fd5b8135610794816108c0565b600060018201610ae257634e487b7160e01b600052601160045260246000fd5b5060010190565b600060208284031215610afb57600080fd5b8151801515811461079457600080fd5b6000825160005b81811015610b2c5760208186018101518583015201610b12565b50600092019182525091905056fea26469706673582212201f30ee02e8690367ce84c0020f2a4225f0fe60e58552d8d808d6cdfe36a9c5d664736f6c63430008140033
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Analyzing contract bytecode for vulnerabilities**
[codex:1409703]
[codex:1409703] I’m focusing on decoding the contract’s runtime bytecode by mapping function selectors to offsets and checking for patterns like onlyOwner and critical opcodes like CALL or DELEGATECALL. I want to detect any exploitable paths, so I’m parsing function usage, storage slots, and possible state mutations, considering offline tools like `evm disasm` to assist. Let’s see if the bytecode reveals any actual vulnerabilities or just standard functionality.
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'which evm || which hevm || which cast || which forge || which solc' in /tmp/codex-multi-ptdmrz8c succeeded in 8ms:
[codex:1409703] /home/noahkuhn/.foundry/bin/cast
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Exploring cast disassemble command**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cast --help | head -n 40' in /tmp/codex-multi-ptdmrz8c succeeded in 23ms:
[codex:1409703] A Swiss Army knife for interacting with Ethereum applications from the command line
[codex:1409703]
[codex:1409703] Usage: cast [OPTIONS] <COMMAND>
[codex:1409703]
[codex:1409703] Commands:
[codex:1409703] 4byte Get the function signatures for the given selector from
[codex:1409703] <https://openchain.xyz> [aliases: 4, 4b]
[codex:1409703] 4byte-calldata Decode ABI-encoded calldata using <https://openchain.xyz> [aliases: 4c,
[codex:1409703] 4bc]
[codex:1409703] 4byte-event Get the event signature for a given topic 0 from <https://openchain.xyz>
[codex:1409703] [aliases: 4e, 4be, topic0-event, t0e]
[codex:1409703] abi-encode ABI encode the given function argument, excluding the selector [aliases:
[codex:1409703] ae]
[codex:1409703] abi-encode-event ABI encode an event and its arguments to generate topics and data [aliases:
[codex:1409703] aee]
[codex:1409703] access-list Create an access list for a transaction [aliases: ac, acl]
[codex:1409703] address-zero Prints the zero address [aliases: --address-zero, az]
[codex:1409703] admin Fetch the EIP-1967 admin account [aliases: adm]
[codex:1409703] age Get the timestamp of a block [aliases: a]
[codex:1409703] artifact Generate an artifact file, that can be used to deploy a contract locally
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Checking disassemble options**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cast --help | rg -n "dis"' in /tmp/codex-multi-ptdmrz8c succeeded in 10ms:
[codex:1409703] 53: disassemble Disassembles a hex-encoded bytecode into a human-readable representation
[codex:1409703] 155: - never: Force disable color output
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Investigating cast disassemble command**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cast disassemble --help' in /tmp/codex-multi-ptdmrz8c succeeded in 9ms:
[codex:1409703] Disassembles a hex-encoded bytecode into a human-readable representation
[codex:1409703]
[codex:1409703] Usage: cast disassemble [OPTIONS] [BYTECODE]
[codex:1409703]
[codex:1409703] Arguments:
[codex:1409703] [BYTECODE]
[codex:1409703] The hex-encoded bytecode
[codex:1409703]
[codex:1409703] Options:
[codex:1409703] -h, --help
[codex:1409703] Print help (see a summary with '-h')
[codex:1409703]
[codex:1409703] -j, --threads <THREADS>
[codex:1409703] Number of threads to use. Specifying 0 defaults to the number of logical cores
[codex:1409703]
[codex:1409703] [aliases: --jobs]
[codex:1409703]
[codex:1409703] Display options:
[codex:1409703] --color <COLOR>
[codex:1409703] The color of the log messages
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Planning bytecode disassembly**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cast disassemble $(sed -n '"'s/"'^0x//p'"' BYTECODE_BUNDLE.txt | head -n 1)" in /tmp/codex-multi-ptdmrz8c succeeded in 16ms:
[codex:1409703] 00000000: PUSH1 0x80
[codex:1409703] 00000002: PUSH1 0x40
[codex:1409703] 00000004: MSTORE
[codex:1409703] 00000005: PUSH1 0x04
[codex:1409703] 00000007: CALLDATASIZE
[codex:1409703] 00000008: LT
[codex:1409703] 00000009: PUSH2 0x0094
[codex:1409703] 0000000c: JUMPI
[codex:1409703] 0000000d: PUSH1 0x00
[codex:1409703] 0000000f: CALLDATALOAD
[codex:1409703] 00000010: PUSH1 0xe0
[codex:1409703] 00000012: SHR
[codex:1409703] 00000013: DUP1
[codex:1409703] 00000014: PUSH4 0x8040fcb1
[codex:1409703] 00000019: GT
[codex:1409703] 0000001a: PUSH2 0x0059
[codex:1409703] 0000001d: JUMPI
[codex:1409703] 0000001e: DUP1
[codex:1409703] 0000001f: PUSH4 0x8040fcb1
[codex:1409703] 00000024: EQ
[codex:1409703]
[codex:1409703]
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Analyzing function selectors and parameters**
[codex:1409703] thinking
[codex:1409703] **Mapping token transfer and initializer functions**
[codex:1409703]
[codex:1409703] The user’s contract has multiple functions to transfer ETH or tokens guarded by owner or secondary roles, with an initializer function that sets owner addresses and flags. Some functions allow transfers only if owner is unset, possibly to recover funds pre-initialization. I’m piecing together which selectors correspond to withdraw, transfer, or initialize, focusing on access controls and potential unprotected initializers. This could hint at exploitation if the contract was never initialized properly.
[codex:1409703] thinking
[codex:1409703] **Analyzing initializer function logic and gating**
[codex:1409703]
[codex:1409703] I’m unpacking the initializer at 0x047b, interpreting its storage flags and gating logic that matches OpenZeppelin’s initializer pattern. It sets owner and operator addresses if not already initialized, allowing a one-time call by anyone to set these. This likely means the initializer is public but protected by an initialization status check, which could let someone claim ownership if the contract isn’t initialized yet.
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cast keccak "Initialized(uint8)"' in /tmp/codex-multi-ptdmrz8c succeeded in 11ms:
[codex:1409703] 0x7f26b83ff96e1f2b6a682f133852f6798a09c465da95921460cefb3847402498
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Analyzing event topic discrepancies**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cast keccak "Initialized(uint64)"' in /tmp/codex-multi-ptdmrz8c succeeded in 10ms:
[codex:1409703] 0xc7f505b2f371ae2175ee4913f4499e1f2633a7b5936321eed1cdaeb6115181d2
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Analyzing unprotected initializer vulnerability**
[codex:1409703] exec
[codex:1409703] /bin/bash -lc 'cat codex-output-schema.json' in /tmp/codex-multi-ptdmrz8c succeeded in 5ms:
[codex:1409703] {"type": "object", "additionalProperties": false, "required": ["no_findings", "summary", "findings"], "properties": {"no_findings": {"type": "boolean"}, "summary": {"type": "string"}, "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["severity", "category", "title", "evidence", "locations", "exploit_scenario", "recommendation"], "properties": {"severity": {"type": "string", "enum": ["info", "low", "medium", "high", "critical"]}, "category": {"type": "string", "enum": ["access_control", "reentrancy", "math", "oracle", "upgradeability", "auth", "other"]}, "title": {"type": "string"}, "exploit_scenario": {"type": "string"}, "recommendation": {"type": "string"}, "evidence": {"type": "string"}, "locations": {"type": "array", "items": {"type": "string"}}}}}}}
[codex:1409703]
[codex:1409703] thinking
[codex:1409703] **Composing final JSON report**
[codex:1409703] codex
[codex:1409703] {"no_findings":false,"summary":"Public initializer can set owner/secondary when uninitialized, enabling ETH/ERC20 withdrawals by an attacker.","findings":[{"severity":"critical","category":"auth","title":"Unprotected initializer allows ownership takeover if the contract is uninitialized","exploit_scenario":"If the Initializable slot indicates `_initialized == 0` (e.g., freshly deployed proxy or implementation left uninitialized), any address can call selector `0xf09a4016` with attacker-controlled addresses to set slot0/slot1. The attacker then calls `0x62f714ce` to withdraw ETH (or `0x5fc3ea0b`/`0x68638cdf` to transfer ERC20s) to their own address. While slot0==0, the owner==0-gated paths (`0x7c7a518d`/`0x434f94df`) also allow direct ETH/token withdrawal without setting ownership.","recommendation":"Initialize in the deployment flow (or proxy constructor) and/or add access control to the initializer; consider calling `_disableInitializers()` on the implementation to prevent takeovers.","evidence":"At 0x047b the function loads the Initializable storage slot `0xf0c57e...` and checks `_initialized/_initializing` plus `ADDRESS EXTCODESIZE` (initializer guard) but never checks CALLER. It then writes calldata-provided addresses into slot0 and slot1 (SSTORE at ~0x0553 and ~0x0564) and emits `Initialized(uint64)` (topic `0xc7f505...`). Withdraw paths at 0x01fe (ETH via 0x0643 CALL with value) and 0x02c7 (ERC20 transfer via 0x06da) authorize only slot0/slot1, so a caller who initializes themselves can drain funds.","locations":["BYTECODE_BUNDLE.txt:0x047b","BYTECODE_BUNDLE.txt:0x04db","BYTECODE_BUNDLE.txt:0x0535","BYTECODE_BUNDLE.txt:0x0554","BYTECODE_BUNDLE.txt:0x01fe","BYTECODE_BUNDLE.txt:0x02c7","BYTECODE_BUNDLE.txt:0x0643","BYTECODE_BUNDLE.txt:0x06da"]}]}
[codex:1409703] tokens used
[codex:1409703] 46,036
[codex:1409703] {"no_findings":false,"summary":"Public initializer can set owner/secondary when uninitialized, enabling ETH/ERC20 withdrawals by an attacker.","findings":[{"severity":"critical","category":"auth","title":"Unprotected initializer allows ownership takeover if the contract is uninitialized","exploit_scenario":"If the Initializable slot indicates `_initialized == 0` (e.g., freshly deployed proxy or implementation left uninitialized), any address can call selector `0xf09a4016` with attacker-controlled addresses to set slot0/slot1. The attacker then calls `0x62f714ce` to withdraw ETH (or `0x5fc3ea0b`/`0x68638cdf` to transfer ERC20s) to their own address. While slot0==0, the owner==0-gated paths (`0x7c7a518d`/`0x434f94df`) also allow direct ETH/token withdrawal without setting ownership.","recommendation":"Initialize in the deployment flow (or proxy constructor) and/or add access control to the initializer; consider calling `_disableInitializers()` on the implementation to prevent takeovers.","evidence":"At 0x047b the function loads the Initializable storage slot `0xf0c57e...` and checks `_initialized/_initializing` plus `ADDRESS EXTCODESIZE` (initializer guard) but never checks CALLER. It then writes calldata-provided addresses into slot0 and slot1 (SSTORE at ~0x0553 and ~0x0564) and emits `Initialized(uint64)` (topic `0xc7f505...`). Withdraw paths at 0x01fe (ETH via 0x0643 CALL with value) and 0x02c7 (ERC20 transfer via 0x06da) authorize only slot0/slot1, so a caller who initializes themselves can drain funds.","locations":["BYTECODE_BUNDLE.txt:0x047b","BYTECODE_BUNDLE.txt:0x04db","BYTECODE_BUNDLE.txt:0x0535","BYTECODE_BUNDLE.txt:0x0554","BYTECODE_BUNDLE.txt:0x01fe","BYTECODE_BUNDLE.txt:0x02c7","BYTECODE_BUNDLE.txt:0x0643","BYTECODE_BUNDLE.txt:0x06da"]}]}
{
"codex": {
"ran_at": "2026-01-05T06:33:34.573359+00:00",
"returncode": 0
},
"summary": "Public initializer can set owner/secondary when uninitialized, enabling ETH/ERC20 withdrawals by an attacker.",
"raw_final": {
"summary": "Public initializer can set owner/secondary when uninitialized, enabling ETH/ERC20 withdrawals by an attacker.",
"findings": [
{
"title": "Unprotected initializer allows ownership takeover if the contract is uninitialized",
"category": "auth",
"evidence": "At 0x047b the function loads the Initializable storage slot `0xf0c57e...` and checks `_initialized/_initializing` plus `ADDRESS EXTCODESIZE` (initializer guard) but never checks CALLER. It then writes calldata-provided addresses into slot0 and slot1 (SSTORE at ~0x0553 and ~0x0564) and emits `Initialized(uint64)` (topic `0xc7f505...`). Withdraw paths at 0x01fe (ETH via 0x0643 CALL with value) and 0x02c7 (ERC20 transfer via 0x06da) authorize only slot0/slot1, so a caller who initializes themselves can drain funds.",
"severity": "critical",
"locations": [
"BYTECODE_BUNDLE.txt:0x047b",
"BYTECODE_BUNDLE.txt:0x04db",
"BYTECODE_BUNDLE.txt:0x0535",
"BYTECODE_BUNDLE.txt:0x0554",
"BYTECODE_BUNDLE.txt:0x01fe",
"BYTECODE_BUNDLE.txt:0x02c7",
"BYTECODE_BUNDLE.txt:0x0643",
"BYTECODE_BUNDLE.txt:0x06da"
],
"recommendation": "Initialize in the deployment flow (or proxy constructor) and/or add access control to the initializer; consider calling `_disableInitializers()` on the implementation to prevent takeovers.",
"exploit_scenario": "If the Initializable slot indicates `_initialized == 0` (e.g., freshly deployed proxy or implementation left uninitialized), any address can call selector `0xf09a4016` with attacker-controlled addresses to set slot0/slot1. The attacker then calls `0x62f714ce` to withdraw ETH (or `0x5fc3ea0b`/`0x68638cdf` to transfer ERC20s) to their own address. While slot0==0, the owner==0-gated paths (`0x7c7a518d`/`0x434f94df`) also allow direct ETH/token withdrawal without setting ownership."
}
],
"no_findings": false
},
"no_findings": false,
"schema_version": 1
}
00000000: PUSH1 0x80 00000002: PUSH1 0x40 00000004: MSTORE 00000005: PUSH1 0x04 00000007: CALLDATASIZE 00000008: LT 00000009: PUSH2 0x0094 0000000c: JUMPI 0000000d: PUSH1 0x00 0000000f: CALLDATALOAD 00000010: PUSH1 0xe0 00000012: SHR 00000013: DUP1 00000014: PUSH4 0x8040fcb1 00000019: GT 0000001a: PUSH2 0x0059 0000001d: JUMPI 0000001e: DUP1 0000001f: PUSH4 0x8040fcb1 00000024: EQ 00000025: PUSH2 0x0142 00000028: JUMPI 00000029: DUP1 0000002a: PUSH4 0x8da5cb5b 0000002f: EQ 00000030: PUSH2 0x0162 00000033: JUMPI 00000034: DUP1 00000035: PUSH4 0xc45a0155 0000003a: EQ 0000003b: PUSH2 0x019e 0000003e: JUMPI 0000003f: DUP1 00000040: PUSH4 0xf09a4016 00000045: EQ 00000046: PUSH2 0x01be 00000049: JUMPI 0000004a: DUP1 0000004b: PUSH4 0xfdcc0822 00000050: EQ 00000051: PUSH2 0x01de 00000054: JUMPI 00000055: PUSH1 0x00 00000057: DUP1 00000058: REVERT 00000059: JUMPDEST 0000005a: DUP1 0000005b: PUSH3 0xf714ce 0000005f: EQ 00000060: PUSH2 0x00a0 00000063: JUMPI 00000064: DUP1 00000065: PUSH4 0x434f94df 0000006a: EQ 0000006b: PUSH2 0x00c2 0000006e: JUMPI 0000006f: DUP1 00000070: PUSH4 0x5fc3ea0b 00000075: EQ 00000076: PUSH2 0x00e2 00000079: JUMPI 0000007a: DUP1 0000007b: PUSH4 0x68638cdf 00000080: EQ 00000081: PUSH2 0x0102 00000084: JUMPI 00000085: DUP1 00000086: PUSH4 0x7c7a518d 0000008b: EQ 0000008c: PUSH2 0x0122 0000008f: JUMPI 00000090: PUSH1 0x00 00000092: DUP1 00000093: REVERT 00000094: JUMPDEST 00000095: CALLDATASIZE 00000096: PUSH2 0x009b 00000099: JUMPI 0000009a: STOP 0000009b: JUMPDEST 0000009c: PUSH1 0x00 0000009e: DUP1 0000009f: REVERT 000000a0: JUMPDEST 000000a1: CALLVALUE 000000a2: DUP1 000000a3: ISZERO 000000a4: PUSH2 0x00ac 000000a7: JUMPI 000000a8: PUSH1 0x00 000000aa: DUP1 000000ab: REVERT 000000ac: JUMPDEST 000000ad: POP 000000ae: PUSH2 0x00c0 000000b1: PUSH2 0x00bb 000000b4: CALLDATASIZE 000000b5: PUSH1 0x04 000000b7: PUSH2 0x08d5 000000ba: JUMP 000000bb: JUMPDEST 000000bc: PUSH2 0x01fe 000000bf: JUMP 000000c0: JUMPDEST 000000c1: STOP 000000c2: JUMPDEST 000000c3: CALLVALUE 000000c4: DUP1 000000c5: ISZERO 000000c6: PUSH2 0x00ce 000000c9: JUMPI 000000ca: PUSH1 0x00 000000cc: DUP1 000000cd: REVERT 000000ce: JUMPDEST 000000cf: POP 000000d0: PUSH2 0x00c0 000000d3: PUSH2 0x00dd 000000d6: CALLDATASIZE 000000d7: PUSH1 0x04 000000d9: PUSH2 0x0905 000000dc: JUMP 000000dd: JUMPDEST 000000de: PUSH2 0x025d 000000e1: JUMP 000000e2: JUMPDEST 000000e3: CALLVALUE 000000e4: DUP1 000000e5: ISZERO 000000e6: PUSH2 0x00ee 000000e9: JUMPI 000000ea: PUSH1 0x00 000000ec: DUP1 000000ed: REVERT 000000ee: JUMPDEST 000000ef: POP 000000f0: PUSH2 0x00c0 000000f3: PUSH2 0x00fd 000000f6: CALLDATASIZE 000000f7: PUSH1 0x04 000000f9: PUSH2 0x0905 000000fc: JUMP 000000fd: JUMPDEST 000000fe: PUSH2 0x02c7 00000101: JUMP 00000102: JUMPDEST 00000103: CALLVALUE 00000104: DUP1 00000105: ISZERO 00000106: PUSH2 0x010e 00000109: JUMPI 0000010a: PUSH1 0x00 0000010c: DUP1 0000010d: REVERT 0000010e: JUMPDEST 0000010f: POP 00000110: PUSH2 0x00c0 00000113: PUSH2 0x011d 00000116: CALLDATASIZE 00000117: PUSH1 0x04 00000119: PUSH2 0x0905 0000011c: JUMP 0000011d: JUMPDEST 0000011e: PUSH2 0x0306 00000121: JUMP 00000122: JUMPDEST 00000123: CALLVALUE 00000124: DUP1 00000125: ISZERO 00000126: PUSH2 0x012e 00000129: JUMPI 0000012a: PUSH1 0x00 0000012c: DUP1 0000012d: REVERT 0000012e: JUMPDEST 0000012f: POP 00000130: PUSH2 0x00c0 00000133: PUSH2 0x013d 00000136: CALLDATASIZE 00000137: PUSH1 0x04 00000139: PUSH2 0x08d5 0000013c: JUMP 0000013d: JUMPDEST 0000013e: PUSH2 0x039b 00000141: JUMP 00000142: JUMPDEST 00000143: CALLVALUE 00000144: DUP1 00000145: ISZERO 00000146: PUSH2 0x014e 00000149: JUMPI 0000014a: PUSH1 0x00 0000014c: DUP1 0000014d: REVERT 0000014e: JUMPDEST 0000014f: POP 00000150: PUSH2 0x00c0 00000153: PUSH2 0x015d 00000156: CALLDATASIZE 00000157: PUSH1 0x04 00000159: PUSH2 0x0993 0000015c: JUMP 0000015d: JUMPDEST 0000015e: PUSH2 0x03ea 00000161: JUMP 00000162: JUMPDEST 00000163: CALLVALUE 00000164: DUP1 00000165: ISZERO 00000166: PUSH2 0x016e 00000169: JUMPI 0000016a: PUSH1 0x00 0000016c: DUP1 0000016d: REVERT 0000016e: JUMPDEST 0000016f: POP 00000170: PUSH1 0x00 00000172: SLOAD 00000173: PUSH2 0x0182 00000176: SWAP1 00000177: PUSH1 0x01 00000179: PUSH1 0x01 0000017b: PUSH1 0xa0 0000017d: SHL 0000017e: SUB 0000017f: AND 00000180: DUP2 00000181: JUMP 00000182: JUMPDEST 00000183: PUSH1 0x40 00000185: MLOAD 00000186: PUSH1 0x01 00000188: PUSH1 0x01 0000018a: PUSH1 0xa0 0000018c: SHL 0000018d: SUB 0000018e: SWAP1 0000018f: SWAP2 00000190: AND 00000191: DUP2 00000192: MSTORE 00000193: PUSH1 0x20 00000195: ADD 00000196: PUSH1 0x40 00000198: MLOAD 00000199: DUP1 0000019a: SWAP2 0000019b: SUB 0000019c: SWAP1 0000019d: RETURN 0000019e: JUMPDEST 0000019f: CALLVALUE 000001a0: DUP1 000001a1: ISZERO 000001a2: PUSH2 0x01aa 000001a5: JUMPI 000001a6: PUSH1 0x00 000001a8: DUP1 000001a9: REVERT 000001aa: JUMPDEST 000001ab: POP 000001ac: PUSH1 0x01 000001ae: SLOAD 000001af: PUSH2 0x0182 000001b2: SWAP1 000001b3: PUSH1 0x01 000001b5: PUSH1 0x01 000001b7: PUSH1 0xa0 000001b9: SHL 000001ba: SUB 000001bb: AND 000001bc: DUP2 000001bd: JUMP 000001be: JUMPDEST 000001bf: CALLVALUE 000001c0: DUP1 000001c1: ISZERO 000001c2: PUSH2 0x01ca 000001c5: JUMPI 000001c6: PUSH1 0x00 000001c8: DUP1 000001c9: REVERT 000001ca: JUMPDEST 000001cb: POP 000001cc: PUSH2 0x00c0 000001cf: PUSH2 0x01d9 000001d2: CALLDATASIZE 000001d3: PUSH1 0x04 000001d5: PUSH2 0x09e8 000001d8: JUMP 000001d9: JUMPDEST 000001da: PUSH2 0x047b 000001dd: JUMP 000001de: JUMPDEST 000001df: CALLVALUE 000001e0: DUP1 000001e1: ISZERO 000001e2: PUSH2 0x01ea 000001e5: JUMPI 000001e6: PUSH1 0x00 000001e8: DUP1 000001e9: REVERT 000001ea: JUMPDEST 000001eb: POP 000001ec: PUSH2 0x00c0 000001ef: PUSH2 0x01f9 000001f2: CALLDATASIZE 000001f3: PUSH1 0x04 000001f5: PUSH2 0x0a16 000001f8: JUMP 000001f9: JUMPDEST 000001fa: PUSH2 0x05b3 000001fd: JUMP 000001fe: JUMPDEST 000001ff: PUSH1 0x00 00000201: SLOAD 00000202: PUSH1 0x01 00000204: PUSH1 0x01 00000206: PUSH1 0xa0 00000208: SHL 00000209: SUB 0000020a: AND 0000020b: CALLER 0000020c: EQ 0000020d: DUP1 0000020e: PUSH2 0x0221 00000211: JUMPI 00000212: POP 00000213: PUSH1 0x01 00000215: SLOAD 00000216: PUSH1 0x01 00000218: PUSH1 0x01 0000021a: PUSH1 0xa0 0000021c: SHL 0000021d: SUB 0000021e: AND 0000021f: CALLER 00000220: EQ 00000221: JUMPDEST 00000222: PUSH2 0x0246 00000225: JUMPI 00000226: PUSH1 0x40 00000228: MLOAD 00000229: PUSH3 0x461bcd 0000022d: PUSH1 0xe5 0000022f: SHL 00000230: DUP2 00000231: MSTORE 00000232: PUSH1 0x04 00000234: ADD 00000235: PUSH2 0x023d 00000238: SWAP1 00000239: PUSH2 0x0a58 0000023c: JUMP 0000023d: JUMPDEST 0000023e: PUSH1 0x40 00000240: MLOAD 00000241: DUP1 00000242: SWAP2 00000243: SUB 00000244: SWAP1 00000245: REVERT 00000246: JUMPDEST 00000247: PUSH2 0x0259 0000024a: PUSH1 0x01 0000024c: PUSH1 0x01 0000024e: PUSH1 0xa0 00000250: SHL 00000251: SUB 00000252: DUP3 00000253: AND 00000254: DUP4 00000255: PUSH2 0x0643 00000258: JUMP 00000259: JUMPDEST 0000025a: POP 0000025b: POP 0000025c: JUMP 0000025d: JUMPDEST 0000025e: PUSH1 0x00 00000260: SLOAD 00000261: PUSH1 0x01 00000263: PUSH1 0x01 00000265: PUSH1 0xa0 00000267: SHL 00000268: SUB 00000269: AND 0000026a: ISZERO 0000026b: PUSH2 0x02ac 0000026e: JUMPI 0000026f: PUSH1 0x40 00000271: MLOAD 00000272: PUSH3 0x461bcd 00000276: PUSH1 0xe5 00000278: SHL 00000279: DUP2 0000027a: MSTORE 0000027b: PUSH1 0x20 0000027d: PUSH1 0x04 0000027f: DUP3 00000280: ADD 00000281: MSTORE 00000282: PUSH1 0x13 00000284: PUSH1 0x24 00000286: DUP3 00000287: ADD 00000288: MSTORE 00000289: PUSH19 0x105b1c9958591e481a5b9a5d1a585b1a5e9959 0000029d: PUSH1 0x6a 0000029f: SHL 000002a0: PUSH1 0x44 000002a2: DUP3 000002a3: ADD 000002a4: MSTORE 000002a5: PUSH1 0x64 000002a7: ADD 000002a8: PUSH2 0x023d 000002ab: JUMP 000002ac: JUMPDEST 000002ad: DUP3 000002ae: PUSH2 0x02c1 000002b1: PUSH1 0x01 000002b3: PUSH1 0x01 000002b5: PUSH1 0xa0 000002b7: SHL 000002b8: SUB 000002b9: DUP3 000002ba: AND 000002bb: DUP4 000002bc: DUP6 000002bd: PUSH2 0x06da 000002c0: JUMP 000002c1: JUMPDEST 000002c2: POP 000002c3: POP 000002c4: POP 000002c5: POP 000002c6: JUMP 000002c7: JUMPDEST 000002c8: PUSH1 0x00 000002ca: SLOAD 000002cb: PUSH1 0x01 000002cd: PUSH1 0x01 000002cf: PUSH1 0xa0 000002d1: SHL 000002d2: SUB 000002d3: AND 000002d4: CALLER 000002d5: EQ 000002d6: DUP1 000002d7: PUSH2 0x02ea 000002da: JUMPI 000002db: POP 000002dc: PUSH1 0x01 000002de: SLOAD 000002df: PUSH1 0x01 000002e1: PUSH1 0x01 000002e3: PUSH1 0xa0 000002e5: SHL 000002e6: SUB 000002e7: AND 000002e8: CALLER 000002e9: EQ 000002ea: JUMPDEST 000002eb: PUSH2 0x02ac 000002ee: JUMPI 000002ef: PUSH1 0x40 000002f1: MLOAD 000002f2: PUSH3 0x461bcd 000002f6: PUSH1 0xe5 000002f8: SHL 000002f9: DUP2 000002fa: MSTORE 000002fb: PUSH1 0x04 000002fd: ADD 000002fe: PUSH2 0x023d 00000301: SWAP1 00000302: PUSH2 0x0a58 00000305: JUMP 00000306: JUMPDEST 00000307: PUSH1 0x00 00000309: SLOAD 0000030a: PUSH1 0x01 0000030c: PUSH1 0x01 0000030e: PUSH1 0xa0 00000310: SHL 00000311: SUB 00000312: AND 00000313: CALLER 00000314: EQ 00000315: PUSH2 0x0330 00000318: JUMPI 00000319: PUSH1 0x40 0000031b: MLOAD 0000031c: PUSH3 0x461bcd 00000320: PUSH1 0xe5 00000322: SHL 00000323: DUP2 00000324: MSTORE 00000325: PUSH1 0x04 00000327: ADD 00000328: PUSH2 0x023d 0000032b: SWAP1 0000032c: PUSH2 0x0a58 0000032f: JUMP 00000330: JUMPDEST 00000331: PUSH1 0x40 00000333: MLOAD 00000334: PUSH4 0xa9059cbb 00000339: PUSH1 0xe0 0000033b: SHL 0000033c: DUP2 0000033d: MSTORE 0000033e: PUSH1 0x01 00000340: PUSH1 0x01 00000342: PUSH1 0xa0 00000344: SHL 00000345: SUB 00000346: DUP3 00000347: DUP2 00000348: AND 00000349: PUSH1 0x04 0000034b: DUP4 0000034c: ADD 0000034d: MSTORE 0000034e: PUSH1 0x24 00000350: DUP3 00000351: ADD 00000352: DUP5 00000353: SWAP1 00000354: MSTORE 00000355: DUP5 00000356: SWAP2 00000357: SWAP1 00000358: DUP3 00000359: AND 0000035a: SWAP1 0000035b: PUSH4 0xa9059cbb 00000360: SWAP1 00000361: PUSH1 0x44 00000363: ADD 00000364: PUSH1 0x00 00000366: PUSH1 0x40 00000368: MLOAD 00000369: DUP1 0000036a: DUP4 0000036b: SUB 0000036c: DUP2 0000036d: PUSH1 0x00 0000036f: DUP8 00000370: DUP1 00000371: EXTCODESIZE 00000372: ISZERO 00000373: DUP1 00000374: ISZERO 00000375: PUSH2 0x037d 00000378: JUMPI 00000379: PUSH1 0x00 0000037b: DUP1 0000037c: REVERT 0000037d: JUMPDEST 0000037e: POP 0000037f: GAS 00000380: CALL 00000381: ISZERO 00000382: DUP1 00000383: ISZERO 00000384: PUSH2 0x0391 00000387: JUMPI 00000388: RETURNDATASIZE 00000389: PUSH1 0x00 0000038b: DUP1 0000038c: RETURNDATACOPY 0000038d: RETURNDATASIZE 0000038e: PUSH1 0x00 00000390: REVERT 00000391: JUMPDEST 00000392: POP 00000393: POP 00000394: POP 00000395: POP 00000396: POP 00000397: POP 00000398: POP 00000399: POP 0000039a: JUMP 0000039b: JUMPDEST 0000039c: PUSH1 0x00 0000039e: SLOAD 0000039f: PUSH1 0x01 000003a1: PUSH1 0x01 000003a3: PUSH1 0xa0 000003a5: SHL 000003a6: SUB 000003a7: AND 000003a8: ISZERO 000003a9: PUSH2 0x0246 000003ac: JUMPI 000003ad: PUSH1 0x40 000003af: MLOAD 000003b0: PUSH3 0x461bcd 000003b4: PUSH1 0xe5 000003b6: SHL 000003b7: DUP2 000003b8: MSTORE 000003b9: PUSH1 0x20 000003bb: PUSH1 0x04 000003bd: DUP3 000003be: ADD 000003bf: MSTORE 000003c0: PUSH1 0x13 000003c2: PUSH1 0x24 000003c4: DUP3 000003c5: ADD 000003c6: MSTORE 000003c7: PUSH19 0x105b1c9958591e481a5b9a5d1a585b1a5e9959 000003db: PUSH1 0x6a 000003dd: SHL 000003de: PUSH1 0x44 000003e0: DUP3 000003e1: ADD 000003e2: MSTORE 000003e3: PUSH1 0x64 000003e5: ADD 000003e6: PUSH2 0x023d 000003e9: JUMP 000003ea: JUMPDEST 000003eb: PUSH1 0x00 000003ed: SLOAD 000003ee: PUSH1 0x01 000003f0: PUSH1 0x01 000003f2: PUSH1 0xa0 000003f4: SHL 000003f5: SUB 000003f6: AND 000003f7: CALLER 000003f8: EQ 000003f9: PUSH2 0x0414 000003fc: JUMPI 000003fd: PUSH1 0x40 000003ff: MLOAD 00000400: PUSH3 0x461bcd 00000404: PUSH1 0xe5 00000406: SHL 00000407: DUP2 00000408: MSTORE 00000409: PUSH1 0x04 0000040b: ADD 0000040c: PUSH2 0x023d 0000040f: SWAP1 00000410: PUSH2 0x0a58 00000413: JUMP 00000414: JUMPDEST 00000415: DUP3 00000416: PUSH1 0x00 00000418: JUMPDEST 00000419: DUP3 0000041a: DUP2 0000041b: LT 0000041c: ISZERO 0000041d: PUSH2 0x0474 00000420: JUMPI 00000421: CALLDATASIZE 00000422: DUP5 00000423: DUP5 00000424: DUP4 00000425: DUP2 00000426: DUP2 00000427: LT 00000428: PUSH2 0x0433 0000042b: JUMPI 0000042c: PUSH2 0x0433 0000042f: PUSH2 0x0a8f 00000432: JUMP 00000433: JUMPDEST 00000434: SWAP1 00000435: POP 00000436: PUSH1 0x40 00000438: MUL 00000439: ADD 0000043a: SWAP1 0000043b: POP 0000043c: PUSH2 0x0463 0000043f: DUP2 00000440: PUSH1 0x20 00000442: ADD 00000443: PUSH1 0x20 00000445: DUP2 00000446: ADD 00000447: SWAP1 00000448: PUSH2 0x0451 0000044b: SWAP2 0000044c: SWAP1 0000044d: PUSH2 0x0aa5 00000450: JUMP 00000451: JUMPDEST 00000452: PUSH1 0x01 00000454: PUSH1 0x01 00000456: PUSH1 0xa0 00000458: SHL 00000459: SUB 0000045a: DUP6 0000045b: AND 0000045c: SWAP1 0000045d: DUP4 0000045e: CALLDATALOAD 0000045f: PUSH2 0x06da 00000462: JUMP 00000463: JUMPDEST 00000464: POP 00000465: PUSH2 0x046d 00000468: DUP2 00000469: PUSH2 0x0ac2 0000046c: JUMP 0000046d: JUMPDEST 0000046e: SWAP1 0000046f: POP 00000470: PUSH2 0x0418 00000473: JUMP 00000474: JUMPDEST 00000475: POP 00000476: POP 00000477: POP 00000478: POP 00000479: POP 0000047a: JUMP 0000047b: JUMPDEST 0000047c: PUSH32 0xf0c57e16840df040f15088dc2f81fe391c3923bec73e23a9662efc9c229c6a00 0000049d: DUP1 0000049e: SLOAD 0000049f: PUSH1 0x01 000004a1: PUSH1 0x40 000004a3: SHL 000004a4: DUP2 000004a5: DIV 000004a6: PUSH1 0xff 000004a8: AND 000004a9: ISZERO 000004aa: SWAP1 000004ab: PUSH8 0xffffffffffffffff 000004b4: AND 000004b5: PUSH1 0x00 000004b7: DUP2 000004b8: ISZERO 000004b9: DUP1 000004ba: ISZERO 000004bb: PUSH2 0x04c1 000004be: JUMPI 000004bf: POP 000004c0: DUP3 000004c1: JUMPDEST 000004c2: SWAP1 000004c3: POP 000004c4: PUSH1 0x00 000004c6: DUP3 000004c7: PUSH8 0xffffffffffffffff 000004d0: AND 000004d1: PUSH1 0x01 000004d3: EQ 000004d4: DUP1 000004d5: ISZERO 000004d6: PUSH2 0x04de 000004d9: JUMPI 000004da: POP 000004db: ADDRESS 000004dc: EXTCODESIZE 000004dd: ISZERO 000004de: JUMPDEST 000004df: SWAP1 000004e0: POP 000004e1: DUP2 000004e2: ISZERO 000004e3: DUP1 000004e4: ISZERO 000004e5: PUSH2 0x04ec 000004e8: JUMPI 000004e9: POP 000004ea: DUP1 000004eb: ISZERO 000004ec: JUMPDEST 000004ed: ISZERO 000004ee: PUSH2 0x050a 000004f1: JUMPI 000004f2: PUSH1 0x40 000004f4: MLOAD 000004f5: PUSH4 0xf92ee8a9 000004fa: PUSH1 0xe0 000004fc: SHL 000004fd: DUP2 000004fe: MSTORE 000004ff: PUSH1 0x04 00000501: ADD 00000502: PUSH1 0x40 00000504: MLOAD 00000505: DUP1 00000506: SWAP2 00000507: SUB 00000508: SWAP1 00000509: REVERT 0000050a: JUMPDEST 0000050b: DUP5 0000050c: SLOAD 0000050d: PUSH8 0xffffffffffffffff 00000516: NOT 00000517: AND 00000518: PUSH1 0x01 0000051a: OR 0000051b: DUP6 0000051c: SSTORE 0000051d: DUP4 0000051e: ISZERO 0000051f: PUSH2 0x0534 00000522: JUMPI 00000523: DUP5 00000524: SLOAD 00000525: PUSH1 0xff 00000527: PUSH1 0x40 00000529: SHL 0000052a: NOT 0000052b: AND 0000052c: PUSH1 0x01 0000052e: PUSH1 0x40 00000530: SHL 00000531: OR 00000532: DUP6 00000533: SSTORE 00000534: JUMPDEST 00000535: PUSH1 0x00 00000537: DUP1 00000538: SLOAD 00000539: PUSH1 0x01 0000053b: PUSH1 0x01 0000053d: PUSH1 0xa0 0000053f: SHL 00000540: SUB 00000541: DUP1 00000542: DUP11 00000543: AND 00000544: PUSH1 0x01 00000546: PUSH1 0x01 00000548: PUSH1 0xa0 0000054a: SHL 0000054b: SUB 0000054c: NOT 0000054d: SWAP3 0000054e: DUP4 0000054f: AND 00000550: OR 00000551: SWAP1 00000552: SWAP3 00000553: SSTORE 00000554: PUSH1 0x01 00000556: DUP1 00000557: SLOAD 00000558: SWAP3 00000559: DUP10 0000055a: AND 0000055b: SWAP3 0000055c: SWAP1 0000055d: SWAP2 0000055e: AND 0000055f: SWAP2 00000560: SWAP1 00000561: SWAP2 00000562: OR 00000563: SWAP1 00000564: SSTORE 00000565: DUP4 00000566: ISZERO 00000567: PUSH2 0x05aa 0000056a: JUMPI 0000056b: DUP5 0000056c: SLOAD 0000056d: PUSH1 0xff 0000056f: PUSH1 0x40 00000571: SHL 00000572: NOT 00000573: AND 00000574: DUP6 00000575: SSTORE 00000576: PUSH1 0x40 00000578: MLOAD 00000579: PUSH1 0x01 0000057b: DUP2 0000057c: MSTORE 0000057d: PUSH32 0xc7f505b2f371ae2175ee4913f4499e1f2633a7b5936321eed1cdaeb6115181d2 0000059e: SWAP1 0000059f: PUSH1 0x20 000005a1: ADD 000005a2: PUSH1 0x40 000005a4: MLOAD 000005a5: DUP1 000005a6: SWAP2 000005a7: SUB 000005a8: SWAP1 000005a9: LOG1 000005aa: JUMPDEST 000005ab: POP 000005ac: POP 000005ad: POP 000005ae: POP 000005af: POP 000005b0: POP 000005b1: POP 000005b2: JUMP 000005b3: JUMPDEST 000005b4: PUSH1 0x00 000005b6: SLOAD 000005b7: PUSH1 0x01 000005b9: PUSH1 0x01 000005bb: PUSH1 0xa0 000005bd: SHL 000005be: SUB 000005bf: AND 000005c0: CALLER 000005c1: EQ 000005c2: PUSH2 0x05dd 000005c5: JUMPI 000005c6: PUSH1 0x40 000005c8: MLOAD 000005c9: PUSH3 0x461bcd 000005cd: PUSH1 0xe5 000005cf: SHL 000005d0: DUP2 000005d1: MSTORE 000005d2: PUSH1 0x04 000005d4: ADD 000005d5: PUSH2 0x023d 000005d8: SWAP1 000005d9: PUSH2 0x0a58 000005dc: JUMP 000005dd: JUMPDEST 000005de: PUSH1 0x00 000005e0: JUMPDEST 000005e1: DUP2 000005e2: DUP2 000005e3: LT 000005e4: ISZERO 000005e5: PUSH2 0x063e 000005e8: JUMPI 000005e9: CALLDATASIZE 000005ea: DUP4 000005eb: DUP4 000005ec: DUP4 000005ed: DUP2 000005ee: DUP2 000005ef: LT 000005f0: PUSH2 0x05fb 000005f3: JUMPI 000005f4: PUSH2 0x05fb 000005f7: PUSH2 0x0a8f 000005fa: JUMP 000005fb: JUMPDEST 000005fc: SWAP1 000005fd: POP 000005fe: PUSH1 0x40 00000600: MUL 00000601: ADD 00000602: SWAP1 00000603: POP 00000604: PUSH2 0x062d 00000607: DUP2 00000608: PUSH1 0x00 0000060a: ADD 0000060b: CALLDATALOAD 0000060c: DUP3 0000060d: PUSH1 0x20 0000060f: ADD 00000610: PUSH1 0x20 00000612: DUP2 00000613: ADD 00000614: SWAP1 00000615: PUSH2 0x061e 00000618: SWAP2 00000619: SWAP1 0000061a: PUSH2 0x0aa5 0000061d: JUMP 0000061e: JUMPDEST 0000061f: PUSH1 0x01 00000621: PUSH1 0x01 00000623: PUSH1 0xa0 00000625: SHL 00000626: SUB 00000627: AND 00000628: SWAP1 00000629: PUSH2 0x0643 0000062c: JUMP 0000062d: JUMPDEST 0000062e: POP 0000062f: PUSH2 0x0637 00000632: DUP2 00000633: PUSH2 0x0ac2 00000636: JUMP 00000637: JUMPDEST 00000638: SWAP1 00000639: POP 0000063a: PUSH2 0x05e0 0000063d: JUMP 0000063e: JUMPDEST 0000063f: POP 00000640: POP 00000641: POP 00000642: JUMP 00000643: JUMPDEST 00000644: DUP1 00000645: SELFBALANCE 00000646: LT 00000647: ISZERO 00000648: PUSH2 0x0666 0000064b: JUMPI 0000064c: PUSH1 0x40 0000064e: MLOAD 0000064f: PUSH4 0xcd786059 00000654: PUSH1 0xe0 00000656: SHL 00000657: DUP2 00000658: MSTORE 00000659: ADDRESS 0000065a: PUSH1 0x04 0000065c: DUP3 0000065d: ADD 0000065e: MSTORE 0000065f: PUSH1 0x24 00000661: ADD 00000662: PUSH2 0x023d 00000665: JUMP 00000666: JUMPDEST 00000667: PUSH1 0x00 00000669: DUP3 0000066a: PUSH1 0x01 0000066c: PUSH1 0x01 0000066e: PUSH1 0xa0 00000670: SHL 00000671: SUB 00000672: AND 00000673: DUP3 00000674: PUSH1 0x40 00000676: MLOAD 00000677: PUSH1 0x00 00000679: PUSH1 0x40 0000067b: MLOAD 0000067c: DUP1 0000067d: DUP4 0000067e: SUB 0000067f: DUP2 00000680: DUP6 00000681: DUP8 00000682: GAS 00000683: CALL 00000684: SWAP3 00000685: POP 00000686: POP 00000687: POP 00000688: RETURNDATASIZE 00000689: DUP1 0000068a: PUSH1 0x00 0000068c: DUP2 0000068d: EQ 0000068e: PUSH2 0x06b3 00000691: JUMPI 00000692: PUSH1 0x40 00000694: MLOAD 00000695: SWAP2 00000696: POP 00000697: PUSH1 0x1f 00000699: NOT 0000069a: PUSH1 0x3f 0000069c: RETURNDATASIZE 0000069d: ADD 0000069e: AND 0000069f: DUP3 000006a0: ADD 000006a1: PUSH1 0x40 000006a3: MSTORE 000006a4: RETURNDATASIZE 000006a5: DUP3 000006a6: MSTORE 000006a7: RETURNDATASIZE 000006a8: PUSH1 0x00 000006aa: PUSH1 0x20 000006ac: DUP5 000006ad: ADD 000006ae: RETURNDATACOPY 000006af: PUSH2 0x06b8 000006b2: JUMP 000006b3: JUMPDEST 000006b4: PUSH1 0x60 000006b6: SWAP2 000006b7: POP 000006b8: JUMPDEST 000006b9: POP 000006ba: POP 000006bb: SWAP1 000006bc: POP 000006bd: DUP1 000006be: PUSH2 0x063e 000006c1: JUMPI 000006c2: PUSH1 0x40 000006c4: MLOAD 000006c5: PUSH4 0x0a12f521 000006ca: PUSH1 0xe1 000006cc: SHL 000006cd: DUP2 000006ce: MSTORE 000006cf: PUSH1 0x04 000006d1: ADD 000006d2: PUSH1 0x40 000006d4: MLOAD 000006d5: DUP1 000006d6: SWAP2 000006d7: SUB 000006d8: SWAP1 000006d9: REVERT 000006da: JUMPDEST 000006db: PUSH1 0x40 000006dd: DUP1 000006de: MLOAD 000006df: PUSH1 0x01 000006e1: PUSH1 0x01 000006e3: PUSH1 0xa0 000006e5: SHL 000006e6: SUB 000006e7: DUP5 000006e8: DUP2 000006e9: AND 000006ea: PUSH1 0x24 000006ec: DUP4 000006ed: ADD 000006ee: MSTORE 000006ef: PUSH1 0x44 000006f1: DUP1 000006f2: DUP4 000006f3: ADD 000006f4: DUP6 000006f5: SWAP1 000006f6: MSTORE 000006f7: DUP4 000006f8: MLOAD 000006f9: DUP1 000006fa: DUP5 000006fb: SUB 000006fc: SWAP1 000006fd: SWAP2 000006fe: ADD 000006ff: DUP2 00000700: MSTORE 00000701: PUSH1 0x64 00000703: SWAP1 00000704: SWAP3 00000705: ADD 00000706: SWAP1 00000707: SWAP3 00000708: MSTORE 00000709: PUSH1 0x20 0000070b: DUP2 0000070c: ADD 0000070d: DUP1 0000070e: MLOAD 0000070f: PUSH1 0x01 00000711: PUSH1 0x01 00000713: PUSH1 0xe0 00000715: SHL 00000716: SUB 00000717: AND 00000718: PUSH4 0xa9059cbb 0000071d: PUSH1 0xe0 0000071f: SHL 00000720: OR 00000721: SWAP1 00000722: MSTORE 00000723: PUSH2 0x063e 00000726: SWAP2 00000727: DUP6 00000728: SWAP2 00000729: SWAP1 0000072a: PUSH1 0x00 0000072c: SWAP1 0000072d: PUSH2 0x0738 00000730: SWAP1 00000731: DUP5 00000732: AND 00000733: DUP4 00000734: PUSH2 0x0786 00000737: JUMP 00000738: JUMPDEST 00000739: SWAP1 0000073a: POP 0000073b: DUP1 0000073c: MLOAD 0000073d: PUSH1 0x00 0000073f: EQ 00000740: ISZERO 00000741: DUP1 00000742: ISZERO 00000743: PUSH2 0x075d 00000746: JUMPI 00000747: POP 00000748: DUP1 00000749: DUP1 0000074a: PUSH1 0x20 0000074c: ADD 0000074d: SWAP1 0000074e: MLOAD 0000074f: DUP2 00000750: ADD 00000751: SWAP1 00000752: PUSH2 0x075b 00000755: SWAP2 00000756: SWAP1 00000757: PUSH2 0x0ae9 0000075a: JUMP 0000075b: JUMPDEST 0000075c: ISZERO 0000075d: JUMPDEST 0000075e: ISZERO 0000075f: PUSH2 0x063e 00000762: JUMPI 00000763: PUSH1 0x40 00000765: MLOAD 00000766: PUSH4 0x5274afe7 0000076b: PUSH1 0xe0 0000076d: SHL 0000076e: DUP2 0000076f: MSTORE 00000770: PUSH1 0x01 00000772: PUSH1 0x01 00000774: PUSH1 0xa0 00000776: SHL 00000777: SUB 00000778: DUP5 00000779: AND 0000077a: PUSH1 0x04 0000077c: DUP3 0000077d: ADD 0000077e: MSTORE 0000077f: PUSH1 0x24 00000781: ADD 00000782: PUSH2 0x023d 00000785: JUMP 00000786: JUMPDEST 00000787: PUSH1 0x60 00000789: PUSH2 0x0794 0000078c: DUP4 0000078d: DUP4 0000078e: PUSH1 0x00 00000790: PUSH2 0x079b 00000793: JUMP 00000794: JUMPDEST 00000795: SWAP4 00000796: SWAP3 00000797: POP 00000798: POP 00000799: POP 0000079a: JUMP 0000079b: JUMPDEST 0000079c: PUSH1 0x60 0000079e: DUP2 0000079f: SELFBALANCE 000007a0: LT 000007a1: ISZERO 000007a2: PUSH2 0x07c0 000007a5: JUMPI 000007a6: PUSH1 0x40 000007a8: MLOAD 000007a9: PUSH4 0xcd786059 000007ae: PUSH1 0xe0 000007b0: SHL 000007b1: DUP2 000007b2: MSTORE 000007b3: ADDRESS 000007b4: PUSH1 0x04 000007b6: DUP3 000007b7: ADD 000007b8: MSTORE 000007b9: PUSH1 0x24 000007bb: ADD 000007bc: PUSH2 0x023d 000007bf: JUMP 000007c0: JUMPDEST 000007c1: PUSH1 0x00 000007c3: DUP1 000007c4: DUP6 000007c5: PUSH1 0x01 000007c7: PUSH1 0x01 000007c9: PUSH1 0xa0 000007cb: SHL 000007cc: SUB 000007cd: AND 000007ce: DUP5 000007cf: DUP7 000007d0: PUSH1 0x40 000007d2: MLOAD 000007d3: PUSH2 0x07dc 000007d6: SWAP2 000007d7: SWAP1 000007d8: PUSH2 0x0b0b 000007db: JUMP 000007dc: JUMPDEST 000007dd: PUSH1 0x00 000007df: PUSH1 0x40 000007e1: MLOAD 000007e2: DUP1 000007e3: DUP4 000007e4: SUB 000007e5: DUP2 000007e6: DUP6 000007e7: DUP8 000007e8: GAS 000007e9: CALL 000007ea: SWAP3 000007eb: POP 000007ec: POP 000007ed: POP 000007ee: RETURNDATASIZE 000007ef: DUP1 000007f0: PUSH1 0x00 000007f2: DUP2 000007f3: EQ 000007f4: PUSH2 0x0819 000007f7: JUMPI 000007f8: PUSH1 0x40 000007fa: MLOAD 000007fb: SWAP2 000007fc: POP 000007fd: PUSH1 0x1f 000007ff: NOT 00000800: PUSH1 0x3f 00000802: RETURNDATASIZE 00000803: ADD 00000804: AND 00000805: DUP3 00000806: ADD 00000807: PUSH1 0x40 00000809: MSTORE 0000080a: RETURNDATASIZE 0000080b: DUP3 0000080c: MSTORE 0000080d: RETURNDATASIZE 0000080e: PUSH1 0x00 00000810: PUSH1 0x20 00000812: DUP5 00000813: ADD 00000814: RETURNDATACOPY 00000815: PUSH2 0x081e 00000818: JUMP 00000819: JUMPDEST 0000081a: PUSH1 0x60 0000081c: SWAP2 0000081d: POP 0000081e: JUMPDEST 0000081f: POP 00000820: SWAP2 00000821: POP 00000822: SWAP2 00000823: POP 00000824: PUSH2 0x082e 00000827: DUP7 00000828: DUP4 00000829: DUP4 0000082a: PUSH2 0x0838 0000082d: JUMP 0000082e: JUMPDEST 0000082f: SWAP7 00000830: SWAP6 00000831: POP 00000832: POP 00000833: POP 00000834: POP 00000835: POP 00000836: POP 00000837: JUMP 00000838: JUMPDEST 00000839: PUSH1 0x60 0000083b: DUP3 0000083c: PUSH2 0x084d 0000083f: JUMPI 00000840: PUSH2 0x0848 00000843: DUP3 00000844: PUSH2 0x0894 00000847: JUMP 00000848: JUMPDEST 00000849: PUSH2 0x0794 0000084c: JUMP 0000084d: JUMPDEST 0000084e: DUP2 0000084f: MLOAD 00000850: ISZERO 00000851: DUP1 00000852: ISZERO 00000853: PUSH2 0x0864 00000856: JUMPI 00000857: POP 00000858: PUSH1 0x01 0000085a: PUSH1 0x01 0000085c: PUSH1 0xa0 0000085e: SHL 0000085f: SUB 00000860: DUP5 00000861: AND 00000862: EXTCODESIZE 00000863: ISZERO 00000864: JUMPDEST 00000865: ISZERO 00000866: PUSH2 0x088d 00000869: JUMPI 0000086a: PUSH1 0x40 0000086c: MLOAD 0000086d: PUSH4 0x9996b315 00000872: PUSH1 0xe0 00000874: SHL 00000875: DUP2 00000876: MSTORE 00000877: PUSH1 0x01 00000879: PUSH1 0x01 0000087b: PUSH1 0xa0 0000087d: SHL 0000087e: SUB 0000087f: DUP6 00000880: AND 00000881: PUSH1 0x04 00000883: DUP3 00000884: ADD 00000885: MSTORE 00000886: PUSH1 0x24 00000888: ADD 00000889: PUSH2 0x023d 0000088c: JUMP 0000088d: JUMPDEST 0000088e: POP 0000088f: DUP1 00000890: PUSH2 0x0794 00000893: JUMP 00000894: JUMPDEST 00000895: DUP1 00000896: MLOAD 00000897: ISZERO 00000898: PUSH2 0x08a4 0000089b: JUMPI 0000089c: DUP1 0000089d: MLOAD 0000089e: DUP1 0000089f: DUP3 000008a0: PUSH1 0x20 000008a2: ADD 000008a3: REVERT 000008a4: JUMPDEST 000008a5: PUSH1 0x40 000008a7: MLOAD 000008a8: PUSH4 0x0a12f521 000008ad: PUSH1 0xe1 000008af: SHL 000008b0: DUP2 000008b1: MSTORE 000008b2: PUSH1 0x04 000008b4: ADD 000008b5: PUSH1 0x40 000008b7: MLOAD 000008b8: DUP1 000008b9: SWAP2 000008ba: SUB 000008bb: SWAP1 000008bc: REVERT 000008bd: JUMPDEST 000008be: POP 000008bf: JUMP 000008c0: JUMPDEST 000008c1: PUSH1 0x01 000008c3: PUSH1 0x01 000008c5: PUSH1 0xa0 000008c7: SHL 000008c8: SUB 000008c9: DUP2 000008ca: AND 000008cb: DUP2 000008cc: EQ 000008cd: PUSH2 0x08bd 000008d0: JUMPI 000008d1: PUSH1 0x00 000008d3: DUP1 000008d4: REVERT 000008d5: JUMPDEST 000008d6: PUSH1 0x00 000008d8: DUP1 000008d9: PUSH1 0x40 000008db: DUP4 000008dc: DUP6 000008dd: SUB 000008de: SLT 000008df: ISZERO 000008e0: PUSH2 0x08e8 000008e3: JUMPI 000008e4: PUSH1 0x00 000008e6: DUP1 000008e7: REVERT 000008e8: JUMPDEST 000008e9: DUP3 000008ea: CALLDATALOAD 000008eb: SWAP2 000008ec: POP 000008ed: PUSH1 0x20 000008ef: DUP4 000008f0: ADD 000008f1: CALLDATALOAD 000008f2: PUSH2 0x08fa 000008f5: DUP2 000008f6: PUSH2 0x08c0 000008f9: JUMP 000008fa: JUMPDEST 000008fb: DUP1 000008fc: SWAP2 000008fd: POP 000008fe: POP 000008ff: SWAP3 00000900: POP 00000901: SWAP3 00000902: SWAP1 00000903: POP 00000904: JUMP 00000905: JUMPDEST 00000906: PUSH1 0x00 00000908: DUP1 00000909: PUSH1 0x00 0000090b: PUSH1 0x60 0000090d: DUP5 0000090e: DUP7 0000090f: SUB 00000910: SLT 00000911: ISZERO 00000912: PUSH2 0x091a 00000915: JUMPI 00000916: PUSH1 0x00 00000918: DUP1 00000919: REVERT 0000091a: JUMPDEST 0000091b: DUP4 0000091c: CALLDATALOAD 0000091d: PUSH2 0x0925 00000920: DUP2 00000921: PUSH2 0x08c0 00000924: JUMP 00000925: JUMPDEST 00000926: SWAP3 00000927: POP 00000928: PUSH1 0x20 0000092a: DUP5 0000092b: ADD 0000092c: CALLDATALOAD 0000092d: SWAP2 0000092e: POP 0000092f: PUSH1 0x40 00000931: DUP5 00000932: ADD 00000933: CALLDATALOAD 00000934: PUSH2 0x093c 00000937: DUP2 00000938: PUSH2 0x08c0 0000093b: JUMP 0000093c: JUMPDEST 0000093d: DUP1 0000093e: SWAP2 0000093f: POP 00000940: POP 00000941: SWAP3 00000942: POP 00000943: SWAP3 00000944: POP 00000945: SWAP3 00000946: JUMP 00000947: JUMPDEST 00000948: PUSH1 0x00 0000094a: DUP1 0000094b: DUP4 0000094c: PUSH1 0x1f 0000094e: DUP5 0000094f: ADD 00000950: SLT 00000951: PUSH2 0x0959 00000954: JUMPI 00000955: PUSH1 0x00 00000957: DUP1 00000958: REVERT 00000959: JUMPDEST 0000095a: POP 0000095b: DUP2 0000095c: CALLDATALOAD 0000095d: PUSH8 0xffffffffffffffff 00000966: DUP2 00000967: GT 00000968: ISZERO 00000969: PUSH2 0x0971 0000096c: JUMPI 0000096d: PUSH1 0x00 0000096f: DUP1 00000970: REVERT 00000971: JUMPDEST 00000972: PUSH1 0x20 00000974: DUP4 00000975: ADD 00000976: SWAP2 00000977: POP 00000978: DUP4 00000979: PUSH1 0x20 0000097b: DUP3 0000097c: PUSH1 0x06 0000097e: SHL 0000097f: DUP6 00000980: ADD 00000981: ADD 00000982: GT 00000983: ISZERO 00000984: PUSH2 0x098c 00000987: JUMPI 00000988: PUSH1 0x00 0000098a: DUP1 0000098b: REVERT 0000098c: JUMPDEST 0000098d: SWAP3 0000098e: POP 0000098f: SWAP3 00000990: SWAP1 00000991: POP 00000992: JUMP 00000993: JUMPDEST 00000994: PUSH1 0x00 00000996: DUP1 00000997: PUSH1 0x00 00000999: PUSH1 0x40 0000099b: DUP5 0000099c: DUP7 0000099d: SUB 0000099e: SLT 0000099f: ISZERO 000009a0: PUSH2 0x09a8 000009a3: JUMPI 000009a4: PUSH1 0x00 000009a6: DUP1 000009a7: REVERT 000009a8: JUMPDEST 000009a9: DUP4 000009aa: CALLDATALOAD 000009ab: PUSH2 0x09b3 000009ae: DUP2 000009af: PUSH2 0x08c0 000009b2: JUMP 000009b3: JUMPDEST 000009b4: SWAP3 000009b5: POP 000009b6: PUSH1 0x20 000009b8: DUP5 000009b9: ADD 000009ba: CALLDATALOAD 000009bb: PUSH8 0xffffffffffffffff 000009c4: DUP2 000009c5: GT 000009c6: ISZERO 000009c7: PUSH2 0x09cf 000009ca: JUMPI 000009cb: PUSH1 0x00 000009cd: DUP1 000009ce: REVERT 000009cf: JUMPDEST 000009d0: PUSH2 0x09db 000009d3: DUP7 000009d4: DUP3 000009d5: DUP8 000009d6: ADD 000009d7: PUSH2 0x0947 000009da: JUMP 000009db: JUMPDEST 000009dc: SWAP5 000009dd: SWAP8 000009de: SWAP1 000009df: SWAP7 000009e0: POP 000009e1: SWAP4 000009e2: SWAP5 000009e3: POP 000009e4: POP 000009e5: POP 000009e6: POP 000009e7: JUMP 000009e8: JUMPDEST 000009e9: PUSH1 0x00 000009eb: DUP1 000009ec: PUSH1 0x40 000009ee: DUP4 000009ef: DUP6 000009f0: SUB 000009f1: SLT 000009f2: ISZERO 000009f3: PUSH2 0x09fb 000009f6: JUMPI 000009f7: PUSH1 0x00 000009f9: DUP1 000009fa: REVERT 000009fb: JUMPDEST 000009fc: DUP3 000009fd: CALLDATALOAD 000009fe: PUSH2 0x0a06 00000a01: DUP2 00000a02: PUSH2 0x08c0 00000a05: JUMP 00000a06: JUMPDEST 00000a07: SWAP2 00000a08: POP 00000a09: PUSH1 0x20 00000a0b: DUP4 00000a0c: ADD 00000a0d: CALLDATALOAD 00000a0e: PUSH2 0x08fa 00000a11: DUP2 00000a12: PUSH2 0x08c0 00000a15: JUMP 00000a16: JUMPDEST 00000a17: PUSH1 0x00 00000a19: DUP1 00000a1a: PUSH1 0x20 00000a1c: DUP4 00000a1d: DUP6 00000a1e: SUB 00000a1f: SLT 00000a20: ISZERO 00000a21: PUSH2 0x0a29 00000a24: JUMPI 00000a25: PUSH1 0x00 00000a27: DUP1 00000a28: REVERT 00000a29: JUMPDEST 00000a2a: DUP3 00000a2b: CALLDATALOAD 00000a2c: PUSH8 0xffffffffffffffff 00000a35: DUP2 00000a36: GT 00000a37: ISZERO 00000a38: PUSH2 0x0a40 00000a3b: JUMPI 00000a3c: PUSH1 0x00 00000a3e: DUP1 00000a3f: REVERT 00000a40: JUMPDEST 00000a41: PUSH2 0x0a4c 00000a44: DUP6 00000a45: DUP3 00000a46: DUP7 00000a47: ADD 00000a48: PUSH2 0x0947 00000a4b: JUMP 00000a4c: JUMPDEST 00000a4d: SWAP1 00000a4e: SWAP7 00000a4f: SWAP1 00000a50: SWAP6 00000a51: POP 00000a52: SWAP4 00000a53: POP 00000a54: POP 00000a55: POP 00000a56: POP 00000a57: JUMP 00000a58: JUMPDEST 00000a59: PUSH1 0x20 00000a5b: DUP1 00000a5c: DUP3 00000a5d: MSTORE 00000a5e: PUSH1 0x17 00000a60: SWAP1 00000a61: DUP3 00000a62: ADD 00000a63: MSTORE 00000a64: PUSH32 0x4f6e6c79206f776e65722063616e207769746864726177000000000000000000 00000a85: PUSH1 0x40 00000a87: DUP3 00000a88: ADD 00000a89: MSTORE 00000a8a: PUSH1 0x60 00000a8c: ADD 00000a8d: SWAP1 00000a8e: JUMP 00000a8f: JUMPDEST 00000a90: PUSH4 0x4e487b71 00000a95: PUSH1 0xe0 00000a97: SHL 00000a98: PUSH1 0x00 00000a9a: MSTORE 00000a9b: PUSH1 0x32 00000a9d: PUSH1 0x04 00000a9f: MSTORE 00000aa0: PUSH1 0x24 00000aa2: PUSH1 0x00 00000aa4: REVERT 00000aa5: JUMPDEST 00000aa6: PUSH1 0x00 00000aa8: PUSH1 0x20 00000aaa: DUP3 00000aab: DUP5 00000aac: SUB 00000aad: SLT 00000aae: ISZERO 00000aaf: PUSH2 0x0ab7 00000ab2: JUMPI 00000ab3: PUSH1 0x00 00000ab5: DUP1 00000ab6: REVERT 00000ab7: JUMPDEST 00000ab8: DUP2 00000ab9: CALLDATALOAD 00000aba: PUSH2 0x0794 00000abd: DUP2 00000abe: PUSH2 0x08c0 00000ac1: JUMP 00000ac2: JUMPDEST 00000ac3: PUSH1 0x00 00000ac5: PUSH1 0x01 00000ac7: DUP3 00000ac8: ADD 00000ac9: PUSH2 0x0ae2 00000acc: JUMPI 00000acd: PUSH4 0x4e487b71 00000ad2: PUSH1 0xe0 00000ad4: SHL 00000ad5: PUSH1 0x00 00000ad7: MSTORE 00000ad8: PUSH1 0x11 00000ada: PUSH1 0x04 00000adc: MSTORE 00000add: PUSH1 0x24 00000adf: PUSH1 0x00 00000ae1: REVERT 00000ae2: JUMPDEST 00000ae3: POP 00000ae4: PUSH1 0x01 00000ae6: ADD 00000ae7: SWAP1 00000ae8: JUMP 00000ae9: JUMPDEST 00000aea: PUSH1 0x00 00000aec: PUSH1 0x20 00000aee: DUP3 00000aef: DUP5 00000af0: SUB 00000af1: SLT 00000af2: ISZERO 00000af3: PUSH2 0x0afb 00000af6: JUMPI 00000af7: PUSH1 0x00 00000af9: DUP1 00000afa: REVERT 00000afb: JUMPDEST 00000afc: DUP2 00000afd: MLOAD 00000afe: DUP1 00000aff: ISZERO 00000b00: ISZERO 00000b01: DUP2 00000b02: EQ 00000b03: PUSH2 0x0794 00000b06: JUMPI 00000b07: PUSH1 0x00 00000b09: DUP1 00000b0a: REVERT 00000b0b: JUMPDEST 00000b0c: PUSH1 0x00 00000b0e: DUP3 00000b0f: MLOAD 00000b10: PUSH1 0x00 00000b12: JUMPDEST 00000b13: DUP2 00000b14: DUP2 00000b15: LT 00000b16: ISZERO 00000b17: PUSH2 0x0b2c 00000b1a: JUMPI 00000b1b: PUSH1 0x20 00000b1d: DUP2 00000b1e: DUP7 00000b1f: ADD 00000b20: DUP2 00000b21: ADD 00000b22: MLOAD 00000b23: DUP6 00000b24: DUP4 00000b25: ADD 00000b26: MSTORE 00000b27: ADD 00000b28: PUSH2 0x0b12 00000b2b: JUMP 00000b2c: JUMPDEST 00000b2d: POP 00000b2e: PUSH1 0x00 00000b30: SWAP3 00000b31: ADD 00000b32: SWAP2 00000b33: DUP3 00000b34: MSTORE 00000b35: POP 00000b36: SWAP2 00000b37: SWAP1 00000b38: POP 00000b39: JUMP 00000b3a: INVALID 00000b3b: LOG2 00000b3c: PUSH5 0x6970667358 00000b42: UNKNOWN(0x22) 00000b43: SLT 00000b44: KECCAK256 00000b45: UNKNOWN(0x1F) 00000b46: ADDRESS 00000b47: UNKNOWN(0xEE) 00000b48: MUL 00000b49: UNKNOWN(0xE8) 00000b4a: PUSH10 0x0367ce84c0020f2a4225 00000b55: CREATE 00000b56: INVALID 00000b57: PUSH1 0xe5 00000b59: DUP6 00000b5a: MSTORE 00000b5b: UNKNOWN(0xD8) 00000b5c: UNKNOWN(0xD8) 00000b5d: ADDMOD 00000b5e: UNKNOWN(0xD6) 00000b5f: UNKNOWN(0xCD) 00000b60: INVALID 00000b61: CALLDATASIZE 00000b62: UNKNOWN(0xA9) 00000b63: UNKNOWN(0xC5) 00000b64: UNKNOWN(0xD6) 00000b65: PUSH5 0x736f6c6343 00000b6b: STOP 00000b6c: ADDMOD 00000b6d: EQ 00000b6e: STOP 00000b6f: CALLER
| Severity | Category | Tool | Title | Confidence | Validated | Confirmed | Details |
|---|---|---|---|---|---|---|---|
| critical | auth | codex | Unprotected initializer allows ownership takeover if the contract is uninitialized | 90 | no | — |
viewevidence_json{
"evidence": "At 0x047b the function loads the Initializable storage slot `0xf0c57e...` and checks `_initialized/_initializing` plus `ADDRESS EXTCODESIZE` (initializer guard) but never checks CALLER. It then writes calldata-provided addresses into slot0 and slot1 (SSTORE at ~0x0553 and ~0x0564) and emits `Initialized(uint64)` (topic `0xc7f505...`). Withdraw paths at 0x01fe (ETH via 0x0643 CALL with value) and 0x02c7 (ERC20 transfer via 0x06da) authorize only slot0/slot1, so a caller who initializes themselves can drain funds.",
"locations": [
"BYTECODE_BUNDLE.txt:0x047b",
"BYTECODE_BUNDLE.txt:0x04db",
"BYTECODE_BUNDLE.txt:0x0535",
"BYTECODE_BUNDLE.txt:0x0554",
"BYTECODE_BUNDLE.txt:0x01fe",
"BYTECODE_BUNDLE.txt:0x02c7",
"BYTECODE_BUNDLE.txt:0x0643",
"BYTECODE_BUNDLE.txt:0x06da"
],
"recommendation": "Initialize in the deployment flow (or proxy constructor) and/or add access control to the initializer; consider calling `_disableInitializers()` on the implementation to prevent takeovers.",
"exploit_scenario": "If the Initializable slot indicates `_initialized == 0` (e.g., freshly deployed proxy or implementation left uninitialized), any address can call selector `0xf09a4016` with attacker-controlled addresses to set slot0/slot1. The attacker then calls `0x62f714ce` to withdraw ETH (or `0x5fc3ea0b`/`0x68638cdf` to transfer ERC20s) to their own address. While slot0==0, the owner==0-gated paths (`0x7c7a518d`/`0x434f94df`) also allow direct ETH/token withdrawal without setting ownership."
}
|
| high | other | detector | Untrusted CALL target/value reachable | 60 | no | no |
viewtrace_id: 0x2cc5c4e6cf72312315ce8aa24d3a43aa3ffba1ec28732c048196b0b387d81167
call_targets:
0xcd0eb8b89c43c3654b4f8d83eb38149327c1107c
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x2cc5c4e6cf72312315ce8aa24d3a43aa3ffba1ec28732c048196b0b387d81167",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xcd0eb8b89c43c3654b4f8d83eb38149327c1107c"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x8040fcb1",
"selector": "0x8040fcb1",
"calldata_variants": [
"0x8040fcb1",
"0x8040fcb10000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc45a0155",
"selector": "0xc45a0155",
"calldata_variants": [
"0xc45a0155",
"0xc45a01550000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf09a4016",
"selector": "0xf09a4016",
"calldata_variants": [
"0xf09a4016",
"0xf09a40160000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfdcc0822",
"selector": "0xfdcc0822",
"calldata_variants": [
"0xfdcc0822",
"0xfdcc08220000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x434f94df",
"selector": "0x434f94df",
"calldata_variants": [
"0x434f94df",
"0x434f94df0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5fc3ea0b",
"selector": "0x5fc3ea0b",
"calldata_variants": [
"0x5fc3ea0b",
"0x5fc3ea0b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x68638cdf",
"selector": "0x68638cdf",
"calldata_variants": [
"0x68638cdf",
"0x68638cdf0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 896,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1667,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 2025,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"call_count": 3,
"guards_detected": [],
"untrusted_call_count": 3
}
|
| high | other | detector | ETH value transfer possible | 55 | no | no |
viewtrace_id: 0x2cc5c4e6cf72312315ce8aa24d3a43aa3ffba1ec28732c048196b0b387d81167
call_targets:
0xcd0eb8b89c43c3654b4f8d83eb38149327c1107c
target_varies:
no
classification:
constant_target
validation_json{
"sink": "CALL",
"errors": 0,
"status": "sink_reached",
"attempts": 1,
"trace_id": "0x2cc5c4e6cf72312315ce8aa24d3a43aa3ffba1ec28732c048196b0b387d81167",
"confirmed": false,
"trace_mode": "callTracer",
"call_targets": [
"0xcd0eb8b89c43c3654b4f8d83eb38149327c1107c"
],
"matched_probe": null,
"target_varies": false,
"classification": "constant_target"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x8040fcb1",
"selector": "0x8040fcb1",
"calldata_variants": [
"0x8040fcb1",
"0x8040fcb10000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc45a0155",
"selector": "0xc45a0155",
"calldata_variants": [
"0xc45a0155",
"0xc45a01550000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf09a4016",
"selector": "0xf09a4016",
"calldata_variants": [
"0xf09a4016",
"0xf09a40160000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfdcc0822",
"selector": "0xfdcc0822",
"calldata_variants": [
"0xfdcc0822",
"0xfdcc08220000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x434f94df",
"selector": "0x434f94df",
"calldata_variants": [
"0x434f94df",
"0x434f94df0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5fc3ea0b",
"selector": "0x5fc3ea0b",
"calldata_variants": [
"0x5fc3ea0b",
"0x5fc3ea0b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x68638cdf",
"selector": "0x68638cdf",
"calldata_variants": [
"0x68638cdf",
"0x68638cdf0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"examples": [
{
"pc": 896,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 1667,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
},
{
"pc": 2025,
"opcode": "CALL",
"returndata_checked": null,
"value_expression_category": "computed",
"target_expression_category": "computed"
}
],
"eth_value_calls": 3,
"guards_detected": []
}
|
| medium | other | detector | CREATE/CREATE2 reachable | 45 | no | no |
viewtrace_id: 0xfd1a59135e5755f1308cd41369d50f66811d65938a9cca3cc1d7cd048ff1d3c3
validation_json{
"sink": "CREATE",
"errors": 0,
"status": "unknown",
"attempts": 18,
"trace_id": "0xfd1a59135e5755f1308cd41369d50f66811d65938a9cca3cc1d7cd048ff1d3c3",
"confirmed": false,
"trace_mode": "structLogs",
"call_targets": null,
"matched_probe": null,
"target_varies": null,
"classification": "no_sink"
}
witness_json{
"notes": "heuristic witness; entrypoints are best-effort selectors with zeroed calldata",
"constraints": [],
"entrypoints": [
{
"calldata": "0x8040fcb1",
"selector": "0x8040fcb1",
"calldata_variants": [
"0x8040fcb1",
"0x8040fcb10000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x8da5cb5b",
"selector": "0x8da5cb5b",
"calldata_variants": [
"0x8da5cb5b",
"0x8da5cb5b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xc45a0155",
"selector": "0xc45a0155",
"calldata_variants": [
"0xc45a0155",
"0xc45a01550000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xf09a4016",
"selector": "0xf09a4016",
"calldata_variants": [
"0xf09a4016",
"0xf09a40160000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0xfdcc0822",
"selector": "0xfdcc0822",
"calldata_variants": [
"0xfdcc0822",
"0xfdcc08220000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x434f94df",
"selector": "0x434f94df",
"calldata_variants": [
"0x434f94df",
"0x434f94df0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x5fc3ea0b",
"selector": "0x5fc3ea0b",
"calldata_variants": [
"0x5fc3ea0b",
"0x5fc3ea0b0000000000000000000000000000000000000000000000000000000000000000"
]
},
{
"calldata": "0x68638cdf",
"selector": "0x68638cdf",
"calldata_variants": [
"0x68638cdf",
"0x68638cdf0000000000000000000000000000000000000000000000000000000000000000"
]
}
]
}
evidence_json{
"create_count": 1,
"create2_count": 0
}
|
| low | other | cast | Contract creation opcode present | 60 | no | — |
viewevidence_json{
"notes": "runtime can deploy contracts dynamically via CREATE/CREATE2",
"create_count": 1,
"create2_count": 0
}
|