{"data":{"decision":"review","decidedBy":["trap","audit"],"votes":[{"leg":"trap","verdict":"CAUTION","decision":"review"},{"leg":"audit","verdict":"medium","decision":"review"},{"leg":"vault","verdict":"EXIT_NOW_FULL","decision":"proceed"}],"results":{"trap":{"honeypotProbability":25,"proxyRisk":"high","maxSafeSlippage":1,"verdict":"CAUTION","confidence":"medium","risk_factors":["Privileged functions with live control: blacklist(address), isBlacklisted(address), mint(address,uint256), pause(), unpause()","Proxy upgradeable by a single key (OpenZeppelin legacy (zeppelinos) proxy)"],"mitigating_factors":["honeypot.is simulated a buy and a sell: buy tax 0%, sell tax 0%"],"summary":"CAUTION: decided by rules from a honeypot.is buy/sell simulation and on-chain control telemetry, with no model call. Simulated taxes 0% buy / 0% sell; proxy risk high; live privileged control present.","verdict_floor_applied":false,"decidedBy":"rules:simulation","evidenceBasis":"simulation","llmCalls":0,"source_review":{"status":"not_requested","observations":[]},"oracles":{"honeypotIs":{"simulated":true,"isHoneypot":false,"reason":null,"buyTax":0,"sellTax":0,"transferTax":0,"simulationError":null},"goPlus":null,"errors":["GoPlus has no record for this token"],"sources":[{"name":"honeypot.is","url":"https://api.honeypot.is/v2/IsHoneypot?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chainID=8453","status":"ok","detail":null},{"name":"GoPlus","url":"https://api.gopluslabs.io/api/v1/token_security/8453?contract_addresses=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","status":"no_data","detail":null}]},"privilegedSelectorsFound":[{"selector":"0xf9f92be4","signature":"blacklist(address)","category":"blacklist"},{"selector":"0xfe575a87","signature":"isBlacklisted(address)","category":"blacklist"},{"selector":"0x40c10f19","signature":"mint(address,uint256)","category":"mint"},{"selector":"0x8456cb59","signature":"pause()","category":"trading_switch"},{"selector":"0x3f4ba83a","signature":"unpause()","category":"trading_switch"}],"telemetry":{"chainId":8453,"blockNumber":53691300,"address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","proxy":{"type":"OpenZeppelin legacy (zeppelinos) proxy","implementation":"0x2Ce6311ddAE708829bc0784C967b7d77D19FD779","admin":"0x4fc7850364958d97B4d3f5A08f79db2493f8cA44","beacon":null,"adminAccount":{"address":"0x4fc7850364958d97B4d3f5A08f79db2493f8cA44","isContract":false,"codeSize":0,"kind":null},"implementationCodeSize":23464},"bytecode":{"contract":{"codeSize":1852,"codeHash":"0xa6705a10bb756b5dea144591118be77d7af0c3eee3bf2dfe2583dcb0364fefab","opcodes":{"ORIGIN":0,"SSTORE":2,"CREATE":0,"CALL":1,"CALLCODE":0,"DELEGATECALL":1,"CREATE2":0,"SELFDESTRUCT":0},"pushedSelectors":6,"dispatchedSelectors":5,"selectorSource":"dispatch","knownSelectors":[{"selector":"0x8f283970","signature":"changeAdmin(address)","category":"upgrade"},{"selector":"0x3659cfe6","signature":"upgradeTo(address)","category":"upgrade"},{"selector":"0x4f1ef286","signature":"upgradeToAndCall(address,bytes)","category":"upgrade"}]},"implementation":{"codeSize":23464,"codeHash":"0x11b75a237997ab8328f65b2d5a55c10f0346d0a175741ed42ddf4f2c66b9e873","opcodes":{"ORIGIN":8,"SSTORE":39,"CREATE":0,"CALL":1,"CALLCODE":0,"DELEGATECALL":2,"CREATE2":0,"SELFDESTRUCT":0},"pushedSelectors":59,"dispatchedSelectors":55,"selectorSource":"dispatch","knownSelectors":[{"selector":"0xf9f92be4","signature":"blacklist(address)","category":"blacklist"},{"selector":"0xfe575a87","signature":"isBlacklisted(address)","category":"blacklist"},{"selector":"0xdd62ed3e","signature":"allowance(address,address)","category":"erc20"},{"selector":"0x095ea7b3","signature":"approve(address,uint256)","category":"erc20"},{"selector":"0x70a08231","signature":"balanceOf(address)","category":"erc20"},{"selector":"0x313ce567","signature":"decimals()","category":"erc20"},{"selector":"0x06fdde03","signature":"name()","category":"erc20"},{"selector":"0x95d89b41","signature":"symbol()","category":"erc20"},{"selector":"0x18160ddd","signature":"totalSupply()","category":"erc20"},{"selector":"0xa9059cbb","signature":"transfer(address,uint256)","category":"erc20"},{"selector":"0x23b872dd","signature":"transferFrom(address,address,uint256)","category":"erc20"},{"selector":"0x40c10f19","signature":"mint(address,uint256)","category":"mint"},{"selector":"0x8da5cb5b","signature":"owner()","category":"ownership"},{"selector":"0xf2fde38b","signature":"transferOwnership(address)","category":"ownership"},{"selector":"0x8456cb59","signature":"pause()","category":"trading_switch"},{"selector":"0x3f4ba83a","signature":"unpause()","category":"trading_switch"}]}},"erc20":{"name":"USD Coin","symbol":"USDC","decimals":6,"totalSupply":"4313782517436762"},"ownership":{"owner":"0x3ABd6f64A422225E61E435baE41db12096106df7","renounced":false,"ownerAccount":{"address":"0x3ABd6f64A422225E61E435baE41db12096106df7","isContract":false,"codeSize":0,"kind":null},"ownerSupplyPct":0,"adminFunction":{"address":"0x4fc7850364958d97B4d3f5A08f79db2493f8cA44","renounced":false},"accessControl":false},"privilegedSelectorsFound":[{"selector":"0xf9f92be4","signature":"blacklist(address)","category":"blacklist"},{"selector":"0xfe575a87","signature":"isBlacklisted(address)","category":"blacklist"},{"selector":"0x40c10f19","signature":"mint(address,uint256)","category":"mint"},{"selector":"0x8456cb59","signature":"pause()","category":"trading_switch"},{"selector":"0x3f4ba83a","signature":"unpause()","category":"trading_switch"}]}},"vault":{"verdict":"EXIT_NOW_FULL","confidence":"medium","summary":"Full exit is possible now at block 26352528: about 1147.145461 USDC out.","next_step":"Re-run with holder to confirm with an exact eth_call simulation, then submit with a minimum-assets-out guard.","verdict_reasons":["liquidity (morpho_withdraw_queue) covers the exit"],"partial":false,"missing":[],"time_budget":{"budget_ms":80000,"elapsed_ms":660},"chain":"ethereum","vault":"0xBEEF01735c132Ada46AA9aA4c54623cAA92A64CB","block_number":26352528,"block_timestamp":1793928611,"vault_info":{"name":"Steakhouse USDC","symbol":"steakUSDC","kinds":["metamorpho"],"asset":"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48","asset_symbol":"USDC","asset_decimals":6,"share_token":"0xBEEF01735c132Ada46AA9aA4c54623cAA92A64CB","share_decimals":18,"total_assets":"67784616648553","total_supply":"59089817493050688981819623","paused":null,"cooldown_seconds":null,"erc7540":null,"morpho":{"timelock_seconds":604800,"fee_wad":"50000000000000000","pending_guardian":false},"euler":null,"yearn":null},"request":{"shares":"1000000000000000000000","assets_requested":null,"fair_assets":"1147145461","quoted_assets":"1147145461","clamped_to_holder_balance":false},"holder":null,"exitable_now":{"assets":"1147145461","shares":"1000000000000000000000","basis":"liquidity_pool","liquidity_is_lower_bound":false},"haircut":{"fee_haircut_bps":0,"undeliverable_now_bps":0,"effective_haircut_bps":0},"partial_exit_max":{"shares":"1000000000000000000000","assets":"1147145461","method":"liquidity_pool","resolution_shares":null,"probes":0},"time_to_full_exit":{"kind":"instant","seconds":0,"basis":"full exit succeeds at the pinned block"},"liquidity":{"pool_assets":"46072489889200","basis":"morpho_withdraw_queue","idle_assets":"6011","coverage_ratio":10000,"required_assets":"1147145461","markets":[{"market_id":"0x54efdee08e272e929034a8f26f7ca34b1ebe364b275391169b28c6d7db24dbc8","collateral_token":null,"vault_supplied_assets":"0","market_available_liquidity":"594425333193","withdrawable_assets":"0","utilization_bps":0,"cap":"1000000000000000000","enabled":true},{"market_id":"0x64d65c9a2d91c36d56fbc42d69e979335320169b3df63bf92789e2c8883fcc64","collateral_token":"0xcbB7C0000aB88B473b1f5aFd9ef808440eed33Bf","vault_supplied_assets":"22202289910292","market_available_liquidity":"32074580374790","withdrawable_assets":"22202289910292","utilization_bps":9037,"cap":"1000000000000000","enabled":true},{"market_id":"0x3a85e619751152991742810df6ec69ce473daef99e28a64ab2340d7b7ccfee49","collateral_token":"0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599","vault_supplied_assets":"14722824179360","market_available_liquidity":"12779278115756","withdrawable_assets":"12779278115756","utilization_bps":9057,"cap":"200000000000000","enabled":true},{"market_id":"0x85252bb8485c99bba46fe149c7dd2aad83672640f53c630890673cf1848ba16e","collateral_token":"0xCd5fE23C85820F7B72D0926FC9b05b43E359b7ee","vault_supplied_assets":"11871938338430","market_available_liquidity":"3868907574894","withdrawable_assets":"3868907574894","utilization_bps":9008,"cap":"100000000000000","enabled":true},{"market_id":"0xb323495f7e4148be5643a4ea4a8221eef163e4bccfdedc2a6f4696baacbc86cc","collateral_token":"0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0","vault_supplied_assets":"5137982517650","market_available_liquidity":"3977842324277","withdrawable_assets":"3977842324277","utilization_bps":9000,"cap":"200000000000000","enabled":true},{"market_id":"0x7e585a933ffe8443c371b4f8cfeb4430f5f6a14c2f32a898c26662c67a1cb8b8","collateral_token":"0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0","vault_supplied_assets":"1010028461145","market_available_liquidity":"1292733334450","withdrawable_assets":"1010028461145","utilization_bps":9022,"cap":"200000000000000","enabled":true},{"market_id":"0xc498f4bfdda99e60ea8eb04c1e145654a70bc59da76ef9c6ed54a1314d78e5b5","collateral_token":"0xbeef0C075Da5D01112AE5cF34d257074fB5DDB2f","vault_supplied_assets":"11561724779702","market_available_liquidity":"1171805702997","withdrawable_assets":"1171805702997","utilization_bps":9025,"cap":"25000000000000","enabled":true},{"market_id":"0x94b823e6bd8ea533b4e33fbc307faea0b307301bc48763acc4d4aa4def7636cd","collateral_token":"0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2","vault_supplied_assets":"1083816712849","market_available_liquidity":"891548632615","withdrawable_assets":"891548632615","utilization_bps":9027,"cap":"200000000000000","enabled":true},{"market_id":"0x09dc9e7eb5d8fc54b2bc41d1135fd4e99057a580f680321faeb90c7a21e631c1","collateral_token":"0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599","vault_supplied_assets":"179201939842","market_available_liquidity":"156107740337","withdrawable_assets":"156107740337","utilization_bps":9030,"cap":"200000000000000","enabled":true},{"market_id":"0xbc99de6a88904cd0e69042ad6f266e63182801f030c636507c3caf590ffd84fe","collateral_token":"0xcbB7C0000aB88B473b1f5aFd9ef808440eed33Bf","vault_supplied_assets":"14675866869","market_available_liquidity":"94673547327","withdrawable_assets":"14675866869","utilization_bps":9041,"cap":"1000000000000000","enabled":true},{"market_id":"0x34377fc4f617c51818e92c79df31ff270c6a91bc94ad32e367fdf59b9f4ac5dd","collateral_token":"0xCd5fE23C85820F7B72D0926FC9b05b43E359b7ee","vault_supplied_assets":"0","market_available_liquidity":"281195","withdrawable_assets":"0","utilization_bps":9999,"cap":"20000000000000","enabled":true},{"market_id":"0xfb8d92086861bae6fb778917afd1de5dbbc4ec70edfb636fed48238e225e7e3d","collateral_token":"0x54C1Ff361b402f66c13107421E6A431C3375EF24","vault_supplied_assets":"48824665","market_available_liquidity":"5554007","withdrawable_assets":"5554007","utilization_bps":9025,"cap":"10000000000000","enabled":true}],"strategies":[]},"admin":{"proxy":{"upgradeable":false,"type":"none","implementation":null,"beacon":null,"adminSlot":null},"access_control":false,"role_members":[],"controllers":[{"address":"0x0A0e559bc3b0950a7e448F0d4894db195b9cf8DD","roles":["owner"],"kind":"safe","safe":{"threshold":5,"ownerCount":10,"owners":["0xC04F9610694a9E07e0d6a361bEC53ABeaDf9Cf9e","0x005398827D00c2951ffB52BD91164eF402bCF105","0x2E8c25A6f7f7f34666b998813aBF97D8B617f111","0x5571A6fEf340a9D26f1428684B9e893EA84b46Ac","0x32E5Cb1a68761a0CFf88d4baa21e398422B5166E","0x21C1e5Be991BF1544ca9759a601f66Dc60083f7d","0x9A86713145F38cd688969c0ECc87B314b23254b2","0xBC27046213d34D4A153cF57a48c74D74239e8968","0x394e6eF80c6F4Ad14a891A3987D8bD1387afA0b1","0x86Bd534A95Fb2Cc36D526ba149464c4477315C32"]}},{"address":"0x827e86072B06674a077f592A531dcE4590aDeCdB","roles":["curator"],"kind":"safe","safe":{"threshold":3,"ownerCount":9,"owners":["0x1710932cf538F38E7bcFC30AAae389B24dD004f6","0x44e6E4152a60D594c175BFeD42E68ad62FFB5871","0xfB3e98B5d59505Ceb259E9874b4553fD27FCCe3c","0x7307Bf07641a794fdBc2391d0983a7f1cFa36E4B","0x1936552B58Be97fFD9c7c1DD28E675b7B022F16d","0xd824031D4A115590e6Ff26e4e23fC346ab4cB2Db","0x4c23E86A9D8506a43046C15Be1b7fA0B6F3427DE","0x5868aaa8d66023137365ADAe9634A9D8834d488d","0x1Dc4354B39554251d4a2C4b571906e7EbAe535A3"]}},{"address":"0xaa0500198B4425DfC4E272FbE42C8E64E21fc03d","roles":["guardian"],"kind":"contract"}],"power":{"upgradeable":false,"upgradeable_without_timelock":false,"pausable_by_eoa":false,"owner_is_eoa":false,"single_signer_control":false,"governor_can_disable_withdrawals":false,"min_control_delay_seconds":null,"flags":[]}},"simulation":null,"unknowns":["no holder given: per-holder limits and the exact assets out were not simulated"],"what_would_change_verdict":["supplying holder runs eth_call redeem(shares, holder, holder) and returns exact assets out or the decoded revert","docsUrls adds a check of the project's redemption claims against the contract","state is pinned to one block; liquidity can change within seconds as borrowers draw or repay"],"docs_analysis":{"status":"not_requested"}},"audit":{"verdict":"warn","verdict_reason":"3 medium or lower severity findings, or high severity findings of low confidence; review before deploying","risk_score":16,"status":"partial","next_step":"Review \"Unprotected one-shot initializeV2_2 can be front-run during a non-atomic upgrade\" at /Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_2.sol:46, fix or document accepted risks, then re-run.","top_findings":[{"id":"F-01","title":"Unprotected one-shot initializeV2_2 can be front-run during a non-atomic upgrade","severity":"medium","confidence":"medium","file":"/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_2.sol","line":46,"fix":"Always upgrade and initialize atomically (`upgradeToAndCall`). Alternatively restrict the initializer, e.g. `require(msg.sender == owner)` (via `_owner`), or verify against an on-chain commitment that the full legacy blacklist was migrated. Add reason strings to the version `require`s."},{"id":"F-02","title":"delegatecall present","severity":"medium","confidence":"low","file":"@openzeppelin/contracts/utils/Address.sol","line":167,"fix":"Restrict the target to a trusted, immutable or access-controlled address and keep storage layouts aligned."},{"id":"F-03","title":"Highly privileged roles and single-step ownership transfer","severity":"low","confidence":"high","file":"/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/Ownable.sol","line":82,"fix":"Use a multisig or timelock for all privileged roles and adopt a two-step ownership transfer (propose/accept). Document the trust model."}],"source":{"kind":"sourcify","files":["/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_2.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/Ownable.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/EIP2612.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/EIP3009.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/util/EIP712.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/Pausable.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/util/ECRecover.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1.1/Rescuable.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/FiatTokenV1.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/EIP712Domain.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/Blacklistable.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_1.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/interface/IERC1271.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1.1/FiatTokenV1_1.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/util/MessageHashUtils.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/util/SignatureChecker.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/AbstractFiatTokenV1.sol","/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/AbstractFiatTokenV2.sol","@openzeppelin/contracts/math/SafeMath.sol","@openzeppelin/contracts/utils/Address.sol"],"address":"0x2Ce6311ddAE708829bc0784C967b7d77D19FD779","chainId":8453,"sourcify_match":"exact_match","compiler":"0.6.12+commit.27d51765","verified_at":"2026-09-13T14:12:39Z"},"sarif":{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"writerslogic-contract-auditor","version":"1.0.0","semanticVersion":"1.0.0","informationUri":"https://agents.writerslogic.com","rules":[{"id":"sol/access_control","name":"access_control","shortDescription":{"text":"Access control"},"defaultConfiguration":{"level":"warning"},"properties":{"tags":["security","smart-contract","solidity"],"security-severity":"5.5"}},{"id":"sol/delegatecall_proxy","name":"delegatecall_proxy","shortDescription":{"text":"Delegatecall or proxy risk"},"defaultConfiguration":{"level":"warning"},"properties":{"tags":["security","smart-contract","solidity"],"security-severity":"5.5"}},{"id":"sol/centralization_risk","name":"centralization_risk","shortDescription":{"text":"Centralization risk"},"defaultConfiguration":{"level":"note"},"properties":{"tags":["security","smart-contract","solidity"],"security-severity":"3.0"}},{"id":"sol/other","name":"other","shortDescription":{"text":"Other"},"defaultConfiguration":{"level":"note"},"properties":{"tags":["security","smart-contract","solidity"],"security-severity":"0.5"}}]}},"results":[{"ruleId":"sol/access_control","ruleIndex":0,"level":"warning","message":{"text":"Unprotected one-shot initializeV2_2 can be front-run during a non-atomic upgrade. `initializeV2_2` is external and has no access control. It is guarded only by the version counter. It lets the caller choose both the new token symbol and the subset of legacy blacklisted accounts to migrate. Accounts left out of `accountsToBlacklist` are not migrated, and because `_isBlacklisted` now reads the high bit of `balanceAndBlacklistStates`, they are silently unblacklisted. The version is then bumped to 3, so the legitimate admin call reverts. This is exploitable only if the proxy is upgraded to V2_2 in one transaction and initialized in a later one (not via `upgradeToAndCall`). The `require` also has no reason string. Fix: Always upgrade and initialize atomically (`upgradeToAndCall`). Alternatively restrict the initializer, e.g. `require(msg.sender == owner)` (via `_owner`), or verify against an on-chain commitment that the full legacy blacklist was migrated. Add reason strings to the version `require`s."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_2.sol","uriBaseId":"%SRCROOT%"},"region":{"startLine":46,"endLine":46}}}],"partialFingerprints":{"primaryLocationLineHash/v1":"F-01"},"properties":{"severity":"medium","confidence":"medium","source":"model","verification":"verified"}},{"ruleId":"sol/delegatecall_proxy","ruleIndex":1,"level":"warning","message":{"text":"delegatecall present. delegatecall executes foreign code against this contract's storage. It is unsafe when the target is attacker-influenced or its storage layout differs. Fix: Restrict the target to a trusted, immutable or access-controlled address and keep storage layouts aligned."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"%40openzeppelin/contracts/utils/Address.sol","uriBaseId":"%SRCROOT%"},"region":{"startLine":167,"endLine":167}}}],"partialFingerprints":{"primaryLocationLineHash/v1":"F-02"},"properties":{"severity":"medium","confidence":"low","source":"static","verification":"static_detector"}},{"ruleId":"sol/centralization_risk","ruleIndex":2,"level":"note","message":{"text":"Highly privileged roles and single-step ownership transfer. The pauser can freeze all transfers, and the blacklister can freeze any account's balance. The rescuer can move any ERC20 held by the token contract, including the token itself. The master minter controls mint allowances, and the owner appoints all of these roles. Ownership transfer is a single step, so a mistyped non-zero address permanently loses control of the owner role. These are intended design properties for a regulated stablecoin, but they are trust assumptions. Fix: Use a multisig or timelock for all privileged roles and adopt a two-step ownership transfer (propose/accept). Document the trust model."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/Ownable.sol","uriBaseId":"%SRCROOT%"},"region":{"startLine":82,"endLine":82}}}],"partialFingerprints":{"primaryLocationLineHash/v1":"F-03"},"properties":{"severity":"low","confidence":"high","source":"model","verification":"verified"}},{"ruleId":"sol/other","ruleIndex":3,"level":"note","message":{"text":"Floating compiler pragma. The pragma accepts several compiler versions, so the deployed bytecode may come from a version that was not tested. Fix: Pin the exact compiler version used in testing."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_2.sol","uriBaseId":"%SRCROOT%"},"region":{"startLine":19,"endLine":19}}}],"partialFingerprints":{"primaryLocationLineHash/v1":"F-04"},"properties":{"severity":"informational","confidence":"high","source":"static","verification":"static_detector"}}],"invocations":[{"executionSuccessful":false,"toolExecutionNotifications":[{"level":"warning","message":{"text":"File @openzeppelin/contracts/token/ERC20/SafeERC20.sol did not fit the 100000-character review budget and was not reviewed"}},{"level":"warning","message":{"text":"File @openzeppelin/contracts/token/ERC20/IERC20.sol did not fit the 100000-character review budget and was not reviewed"}}]}]}]},"contract_names":["FiatTokenV2_2","Ownable","EIP2612","EIP3009","EIP712","Pausable","ECRecover","Rescuable","FiatTokenV1","FiatTokenV2","EIP712Domain","Blacklistable","FiatTokenV2_1","IERC1271","FiatTokenV1_1","MessageHashUtils","SignatureChecker","AbstractFiatTokenV1","AbstractFiatTokenV2","SafeMath","Address"],"compiler_version":"0.6.12, >=0.6.0 <0.8.0, >=0.6.2 <0.8.0","summary":"This is Circle's FiatTokenV2_2 (USDC) stack on Solidity 0.6.12, with SafeMath on balance and allowance arithmetic, a pinned pragma, EIP-712 domain separation including chainId, permit nonces, EIP-3009 nonces and ECDSA s/v checks. I found no critical issues. Lead L1 (floating pragma) is refuted: every Circle file pins `0.6.12`, and only the OpenZeppelin library ranges differ, which has no practical effect. Lead L2 (delegatecall in `Address.functionDelegateCall`) is refuted: it is an unused internal library helper with no caller-controlled target. Remaining concerns are the unprotected one-time migration initializer, which can be front-run if the upgrade is not atomic, and the heavily privileged roles.","overall_risk":"medium","findings":[{"id":"F-01","title":"Unprotected one-shot initializeV2_2 can be front-run during a non-atomic upgrade","severity":"medium","category":"access_control","location":"FiatTokenV2_2.initializeV2_2, lines 42-66","code_snippet":"require(_initializedVersion == 2);","description":"`initializeV2_2` is external and has no access control. It is guarded only by the version counter. It lets the caller choose both the new token symbol and the subset of legacy blacklisted accounts to migrate. Accounts left out of `accountsToBlacklist` are not migrated, and because `_isBlacklisted` now reads the high bit of `balanceAndBlacklistStates`, they are silently unblacklisted. The version is then bumped to 3, so the legitimate admin call reverts. This is exploitable only if the proxy is upgraded to V2_2 in one transaction and initialized in a later one (not via `upgradeToAndCall`). The `require` also has no reason string.","exploit_scenario":"The admin upgrades the proxy to the V2_2 implementation without calling the initializer in the same transaction. An attacker, or a sanctioned user, front-runs with `initializeV2_2([], \"X\")`. The symbol is set to attacker-chosen text, the previously blacklisted accounts are no longer blacklisted, and `_initializedVersion` becomes 3, blocking the correct migration.","recommendation":"Always upgrade and initialize atomically (`upgradeToAndCall`). Alternatively restrict the initializer, e.g. `require(msg.sender == owner)` (via `_owner`), or verify against an on-chain commitment that the full legacy blacklist was migrated. Add reason strings to the version `require`s.","confidence":"medium","source":"model","verification":"verified","line_start":47,"line_end":47,"file":"/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_2.sol","line":46,"end_line":46},{"id":"F-02","title":"delegatecall present","severity":"medium","category":"delegatecall_proxy","location":"Address.functionDelegateCall, line 2772","code_snippet":"(bool success, bytes memory returndata) = target.delegatecall(data);","description":"delegatecall executes foreign code against this contract's storage. It is unsafe when the target is attacker-influenced or its storage layout differs.","exploit_scenario":"If the target is user-controlled, an attacker supplies code that overwrites ownership or drains funds.","recommendation":"Restrict the target to a trusted, immutable or access-controlled address and keep storage layouts aligned.","confidence":"low","source":"static","verification":"static_detector","line_start":2772,"line_end":2772,"file":"@openzeppelin/contracts/utils/Address.sol","line":167,"end_line":167},{"id":"F-03","title":"Highly privileged roles and single-step ownership transfer","severity":"low","category":"centralization_risk","location":"Ownable.transferOwnership (line 393); Pausable.pause (line 994); Blacklistable.blacklist (line 2002); Rescuable.rescueERC20 (line 1172)","code_snippet":"function transferOwnership(address newOwner) external onlyOwner {","description":"The pauser can freeze all transfers, and the blacklister can freeze any account's balance. The rescuer can move any ERC20 held by the token contract, including the token itself. The master minter controls mint allowances, and the owner appoints all of these roles. Ownership transfer is a single step, so a mistyped non-zero address permanently loses control of the owner role. These are intended design properties for a regulated stablecoin, but they are trust assumptions.","exploit_scenario":"n/a (trust assumption). Mistransferring ownership to a wrong address would permanently lose the ability to rotate roles.","recommendation":"Use a multisig or timelock for all privileged roles and adopt a two-step ownership transfer (propose/accept). Document the trust model.","confidence":"high","source":"model","verification":"verified","line_start":393,"line_end":393,"file":"/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v1/Ownable.sol","line":82,"end_line":82},{"id":"F-04","title":"Floating compiler pragma","severity":"informational","category":"other","location":"(file level), line 20","code_snippet":"pragma solidity 0.6.12;","description":"The pragma accepts several compiler versions, so the deployed bytecode may come from a version that was not tested.","exploit_scenario":"n/a","recommendation":"Pin the exact compiler version used in testing.","confidence":"high","source":"static","verification":"static_detector","line_start":20,"line_end":20,"file":"/Users/aloysius.chan/Repositories/circlefin/stablecoin-evm-private-usdc-mainnet-base/contracts/v2/FiatTokenV2_2.sol","line":19,"end_line":19}],"not_checked":["File @openzeppelin/contracts/token/ERC20/SafeERC20.sol did not fit the 100000-character review budget and was not reviewed","File @openzeppelin/contracts/token/ERC20/IERC20.sol did not fit the 100000-character review budget and was not reviewed","Inherited contract IERC20 is not in the provided source","Import @openzeppelin/contracts/token/ERC20/IERC20.sol is not in the provided source","Import @openzeppelin/contracts/token/ERC20/SafeERC20.sol is not in the provided source","Import @openzeppelin/contracts/token/ERC20/IERC20.sol is not in the provided source","The code executed by delegatecall is not part of the provided source","Deployed bytecode, off-chain components, and economic or oracle assumptions are outside this source-level review"],"severity_counts":{"critical":0,"high":0,"medium":2,"low":1,"informational":1},"lines_of_code":2794}},"steps":{"trap":{"id":"trap","agentId":"token-trap-detector","attempts":1,"status":"ok","ms":427,"inputSha256":"7a9738ed20d014102fba08544e1f1b581267636d0519c2cd66cfa9797ce6c25f","outputSha256":"b9f92af76c21cef29833852c7a7ad867a491653687d471000b738bad6da1e754","partial":false},"vault":{"id":"vault","agentId":"vault-exit-lawyer","attempts":1,"status":"ok","ms":660,"inputSha256":"1b22f7fd933e86f755d49908b4caad8e283068f606331c206b76c1ab2e3c557a","outputSha256":"5f268a1f238731531ef6f7b4d74d90df41d44384ff9ae0d723f4e611078ebe8c","partial":false},"audit":{"id":"audit","agentId":"contract-auditor","attempts":1,"status":"ok","ms":25222,"inputSha256":"2d647ffeb9ed5d8c2bb7f02a3508429dbeb66037b03b05f6a7d526a84a1b4c90","outputSha256":"5ed072b95375ade1853842271f136d0e660c86de61ffc36dff9b743eb0e7dd8c","reads":{"trap":"b9f92af76c21cef29833852c7a7ad867a491653687d471000b738bad6da1e754"},"partial":true}},"partial":true,"missing":[{"step":"audit","reason":"partial","impact":"no source-level audit of the token contract"}],"deterministic":false},"_provenance":{"version":"writerslogic-provenance/1","issuer":"did:web:agents.writerslogic.com","verify":{"endpoint":"POST /api/v1/verify-provenance","did":"did:web:agents.writerslogic.com"},"manifest":{"format":"application/json","instance_id":"xmp:iid:84b87309-b71a-49cd-87ac-594516417292","claim_generator_info":[{"name":"WritersLogic x402 Agent Hub","version":"2.0.0"}],"title":"Token and Vault Exit Ladder","assertions":[{"label":"c2pa.actions.v2","data":{"actions":[{"action":"c2pa.created","when":"2026-11-06T01:31:01.149Z","softwareAgent":{"name":"writerslogic-agent-hub/token-vault-ladder","version":"2.0.0"},"digitalSourceType":"http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia","parameters":{"endpoint":"POST /api/v1/pipelines/token-vault-ladder","inputDigest":{"alg":"sha256","hash":"27c92bb0764d4ca9efcb2d599468516434593ed34d2af908abc3b01cba33b845","canonicalization":"JCS"}}}]}},{"label":"c2pa.hash.data","data":{"alg":"sha256","hash":"9ed087b5f1b7552b882123129bdde28e54a7dba670d06be9378519ffddf1d444","name":"jcs-canonical-json(data)"}},{"label":"c2pa.ingredient.v3","data":{"title":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","format":"application/json","relationship":"inputTo","dc":{"source":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","date":"2026-11-06T01:30:35.618Z"},"hash":{"alg":"sha256","hash":"2b86d5c4ebf83f0d8087f14c0a12acbbabf0fd1561c7fa14f9929c621bab56ca","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:35.630Z"},"hash":{"alg":"sha256","hash":"1b4c9948350921489f387c8ac3eddf70c737d393b182e71eba1ff4c83a96dc9e","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:35.730Z"},"hash":{"alg":"sha256","hash":"3cb157299249364d8877d8829e3ddbf69048e09fcc60eade78339e092f715b93","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","format":"application/json","relationship":"inputTo","dc":{"source":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","date":"2026-11-06T01:30:35.736Z"},"hash":{"alg":"sha256","hash":"c4344735128bbb62d3095e5d858abf5ce6ad45c46ffd69fcda811a3ecd7bf523","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:35.808Z"},"hash":{"alg":"sha256","hash":"dcf6223e47e5a0a47487e45d4670aa08189c80af4d0317ea3b736e168f12f9d2","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://api.honeypot.is/v2/IsHoneypot?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chainID=8453","format":"application/json","relationship":"inputTo","dc":{"source":"https://api.honeypot.is/v2/IsHoneypot?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chainID=8453","date":"2026-11-06T01:30:35.812Z"},"hash":{"alg":"sha256","hash":"9563572833bef3c39af670fd9082f9884bd9bfc8c7112699903b4b2b0014bf92","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://api.gopluslabs.io/api/v1/token_security/8453?contract_addresses=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","format":"application/json","relationship":"inputTo","dc":{"source":"https://api.gopluslabs.io/api/v1/token_security/8453?contract_addresses=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","date":"2026-11-06T01:30:35.812Z"},"hash":{"alg":"sha256","hash":"8f78a6007b5c143a7d13aa97b7a1a7edd72054530745c3e8d658e5cb677a75b9","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:35.887Z"},"hash":{"alg":"sha256","hash":"9dabbef3512c6e9811ee9480ec04e9ccafa0cea4b306354e2c88dc2784714380","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","format":"application/json","relationship":"inputTo","dc":{"source":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","date":"2026-11-06T01:30:35.927Z"},"hash":{"alg":"sha256","hash":"74250213012b9281bbe664314d11e63c579dc6c06cf1a9fe5675d6fcf8157667","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:35.931Z"},"hash":{"alg":"sha256","hash":"9917fb03ec358122aa55bbe633ef402bbc4def4ccb8bfe6800015a80e39aeb21","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:36.051Z"},"hash":{"alg":"sha256","hash":"f1ac668eceffd2a4d8d51f4117751098a0d96dcd2c8661446b7473b7a1be7b0b","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:36.105Z"},"hash":{"alg":"sha256","hash":"cc4cae15f1bc4c3eefeefeddd7002b1ecde827c767fa961735a6a100fbf62aa4","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","format":"application/json","relationship":"inputTo","dc":{"source":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","date":"2026-11-06T01:30:36.160Z"},"hash":{"alg":"sha256","hash":"8a5ba4634c7bf44f40a1eff5bc3a93bd6da21a030c49fda5e10d115bf483b3cb","basis":"body"}}},{"label":"c2pa.ingredient.v3","data":{"title":"https://sourcify.dev/server/v2/contract/8453/0x2Ce6311ddAE708829bc0784C967b7d77D19FD779?fields=sources,compilation","format":"application/json","relationship":"inputTo","dc":{"source":"https://sourcify.dev/server/v2/contract/8453/0x2Ce6311ddAE708829bc0784C967b7d77D19FD779?fields=sources,compilation","date":"2026-11-06T01:30:36.353Z"},"hash":{"alg":"sha256","hash":"1021e5687ba81244cec733b790469758f0af14de24284f36b9aafdcda3f22a27","basis":"body"}}}]},"credential":{"@context":["https://www.w3.org/ns/credentials/v2"],"id":"urn:uuid:e167f7ac-ce09-4ddf-8174-98c401d6f023","type":["VerifiableCredential","AgentOutputCredential"],"issuer":"did:web:agents.writerslogic.com","validFrom":"2026-11-06T01:31:01.149Z","credentialSubject":{"id":"urn:sha256:9ed087b5f1b7552b882123129bdde28e54a7dba670d06be9378519ffddf1d444","agent":"token-vault-ladder","endpoint":"POST /api/v1/pipelines/token-vault-ladder","outputDigest":{"alg":"sha256","value":"9ed087b5f1b7552b882123129bdde28e54a7dba670d06be9378519ffddf1d444","canonicalization":"JCS"},"inputDigest":{"alg":"sha256","value":"27c92bb0764d4ca9efcb2d599468516434593ed34d2af908abc3b01cba33b845","canonicalization":"JCS"},"manifestDigest":{"alg":"sha256","value":"d59018343972257324ec43d02a67173f7335717d804393dfa02d4fe5ffb50e63","canonicalization":"JCS"},"ingredients":[{"url":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","sha256":"2b86d5c4ebf83f0d8087f14c0a12acbbabf0fd1561c7fa14f9929c621bab56ca"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"1b4c9948350921489f387c8ac3eddf70c737d393b182e71eba1ff4c83a96dc9e"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"3cb157299249364d8877d8829e3ddbf69048e09fcc60eade78339e092f715b93"},{"url":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","sha256":"c4344735128bbb62d3095e5d858abf5ce6ad45c46ffd69fcda811a3ecd7bf523"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"dcf6223e47e5a0a47487e45d4670aa08189c80af4d0317ea3b736e168f12f9d2"},{"url":"https://api.honeypot.is/v2/IsHoneypot?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chainID=8453","sha256":"9563572833bef3c39af670fd9082f9884bd9bfc8c7112699903b4b2b0014bf92"},{"url":"https://api.gopluslabs.io/api/v1/token_security/8453?contract_addresses=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","sha256":"8f78a6007b5c143a7d13aa97b7a1a7edd72054530745c3e8d658e5cb677a75b9"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"9dabbef3512c6e9811ee9480ec04e9ccafa0cea4b306354e2c88dc2784714380"},{"url":"https://api.developer.coinbase.com/rpc/v1/base/H40340sxRub3vIuyhYC0nu4IGzzgj9bw","sha256":"74250213012b9281bbe664314d11e63c579dc6c06cf1a9fe5675d6fcf8157667"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"9917fb03ec358122aa55bbe633ef402bbc4def4ccb8bfe6800015a80e39aeb21"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"f1ac668eceffd2a4d8d51f4117751098a0d96dcd2c8661446b7473b7a1be7b0b"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"cc4cae15f1bc4c3eefeefeddd7002b1ecde827c767fa961735a6a100fbf62aa4"},{"url":"https://eth-mainnet.g.alchemy.com/v2/alch_CmdCRbsS-DMlybCIxlx5-","sha256":"8a5ba4634c7bf44f40a1eff5bc3a93bd6da21a030c49fda5e10d115bf483b3cb"},{"url":"https://sourcify.dev/server/v2/contract/8453/0x2Ce6311ddAE708829bc0784C967b7d77D19FD779?fields=sources,compilation","sha256":"1021e5687ba81244cec733b790469758f0af14de24284f36b9aafdcda3f22a27"}],"payment":{"scheme":"api-key","network":"eip155:8453","payer":"sample"}},"proof":{"type":"DataIntegrityProof","cryptosuite":"eddsa-jcs-2022","created":"2026-11-06T01:31:01.149Z","verificationMethod":"did:web:agents.writerslogic.com#key-1","proofPurpose":"assertionMethod","proofValue":"z44rvdGiJyWhzS4RdW9W4QGk2fc2yPK1P6PWoUaVVVvLydiEuKSQUhhGeBMAwb1dkRGBqNPsFkcVBhwcc5KJ2FUym"}},"ethSignature":{"type":"EIP-191","signer":"did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","address":"0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","message":"writerslogic-provenance:ff9a05b3977c513f04d4e20615d1833cdf9217c30c7ff150d9ae74d93d56012e","signature":"0x6d81d04436af28cd35ec758214b6098e49a4fe5f72b1a4f87539109593cc4b8602679302fb3faf12b1329ee3f7862b525736a4adcfe319ea66eda8356265d0031b"}}}