complete
bytecode
findings
Runtime bytecode matches an Oraclize/Provable-style oracle client with a public `update()` path, a `__callback(bytes32,string,bytes)` entrypoint, and a privileged `kill()` path. Based on runtime-only evidence, the main i...
Top findings
-
medium
Oracle callback accepts any authorized sender response without validating a pending query id
-
medium
Public `update()` path can spend ETH from contract balance on oracle queries
-
low
Privileged kill switch can sweep balance via `SELFDESTRUCT`