{"project": {"projectId": 1, "author": "0x90b3a1fded70ea72609644e2f0a45091ef02cfd2", "network": "flare", "kind": "contract", "chainId": 14, "subject": "0x12e605bc104e93b45e1ad99f9e555f659051c2bb", "name": "Sceptre sFLR", "fingerprint": "0x8a26e38ce2c83d6a0a0837e974ef58b6fb1b0f23084dacb4303711543f356288", "content": "{\"facts\":[{\"a\":\"Yes. EIP-1967 implementation 0xCa0fEe77bDEAdcb0Af9C1b98d7776EFaa8a04B89 is controlled by ProxyAdmin 0x1e3BeAF840b96353A8BE0A75b6dBB176dced66ce.\",\"how\":\"eth_getStorageAt implementation and admin slots on the sFLR proxy; owner() on the ProxyAdmin; eth_getCode on the owner address.\",\"q\":\"Can the code be replaced?\"},{\"a\":\"single key 0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9, through ProxyAdmin 0x1e3BeAF840b96353A8BE0A75b6dBB176dced66ce.\",\"how\":\"owner() on the ProxyAdmin, then eth_getCode on the owner address.\",\"q\":\"Who holds that power?\"},{\"a\":\"0 seconds found.\",\"how\":\"delay(), getMinDelay(), and getTimelock() on the authority path did not return a delay.\",\"q\":\"Delay before a change\"},{\"a\":\"Yes. paused() exists and returned false.\",\"how\":\"paused() on the sFLR proxy.\",\"q\":\"Can it be paused?\"}],\"footer\":\"What this can't tell you: audits, team identity, intent, or whether a Safe's signers are distinct people.\",\"receipts\":[{\"block\":71410195,\"call\":\"eth_getStorageAt\",\"data\":\"0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc\",\"fact\":\"Can the code be replaced?\",\"result\":\"0x000000000000000000000000ca0fee77bdeadcb0af9c1b98d7776efaa8a04b89\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"},{\"block\":71410195,\"call\":\"eth_getStorageAt\",\"data\":\"0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103\",\"fact\":\"Can the code be replaced?\",\"result\":\"0x0000000000000000000000001e3beaf840b96353a8be0a75b6dbb176dced66ce\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"},{\"block\":71410195,\"call\":\"eth_getStorageAt\",\"data\":\"0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50\",\"fact\":\"Can the code be replaced?\",\"result\":\"0x0000000000000000000000000000000000000000000000000000000000000000\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"},{\"block\":71410195,\"call\":\"owner()\",\"data\":\"0x8da5cb5b\",\"fact\":\"Who holds that power?\",\"result\":\"0x000000000000000000000000f76a23626c2527638b3eaf3d497a7c111f6d0ef9\",\"to\":\"0x1e3BeAF840b96353A8BE0A75b6dBB176dced66ce\"},{\"block\":71410195,\"call\":\"eth_getCode\",\"data\":\"0x\",\"fact\":\"Who holds that power?\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"getMinDelay()\",\"data\":\"0xf27a0c92\",\"fact\":\"Delay before a change\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"delay()\",\"data\":\"0x6a42b8f8\",\"fact\":\"Delay before a change\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"getTimelock()\",\"data\":\"0x6221a54b\",\"fact\":\"Delay before a change\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"paused()\",\"data\":\"0x5c975abb\",\"fact\":\"Can it be paused?\",\"result\":\"0x0000000000000000000000000000000000000000000000000000000000000000\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"}],\"title\":\"Who can change the rules\",\"v\":1}", "txHash": "0xd85218932ad91b4d05ecfc0d2255ec683457f6af4dad15f8320fe9020eb4eaad", "receiptUrl": "https://flare-explorer.flare.network/tx/0xd85218932ad91b4d05ecfc0d2255ec683457f6af4dad15f8320fe9020eb4eaad", "blockNumber": 72105767, "jurisdiction": "", "markText": "", "shape": "", "keeper": "", "what": "", "repoUrl": "", "credit": "", "chunk": ""}, "notes": [{"noteId": 1, "projectId": 1, "author": "0x90b3a1fded70ea72609644e2f0a45091ef02cfd2", "authorName": "Steven Hudspeth", "authorHandle": "hudspeth589", "authorVerified": true, "authorShort": "0x90b3...cfd2", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 0, "kindLabel": "finding", "inReplyTo": 0, "fingerprint": "0x8a26e38ce2c83d6a0a0837e974ef58b6fb1b0f23084dacb4303711543f356288", "content": "{\"facts\":[{\"a\":\"Yes. EIP-1967 implementation 0xCa0fEe77bDEAdcb0Af9C1b98d7776EFaa8a04B89 is controlled by ProxyAdmin 0x1e3BeAF840b96353A8BE0A75b6dBB176dced66ce.\",\"how\":\"eth_getStorageAt implementation and admin slots on the sFLR proxy; owner() on the ProxyAdmin; eth_getCode on the owner address.\",\"q\":\"Can the code be replaced?\"},{\"a\":\"single key 0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9, through ProxyAdmin 0x1e3BeAF840b96353A8BE0A75b6dBB176dced66ce.\",\"how\":\"owner() on the ProxyAdmin, then eth_getCode on the owner address.\",\"q\":\"Who holds that power?\"},{\"a\":\"0 seconds found.\",\"how\":\"delay(), getMinDelay(), and getTimelock() on the authority path did not return a delay.\",\"q\":\"Delay before a change\"},{\"a\":\"Yes. paused() exists and returned false.\",\"how\":\"paused() on the sFLR proxy.\",\"q\":\"Can it be paused?\"}],\"footer\":\"What this can't tell you: audits, team identity, intent, or whether a Safe's signers are distinct people.\",\"receipts\":[{\"block\":71410195,\"call\":\"eth_getStorageAt\",\"data\":\"0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc\",\"fact\":\"Can the code be replaced?\",\"result\":\"0x000000000000000000000000ca0fee77bdeadcb0af9c1b98d7776efaa8a04b89\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"},{\"block\":71410195,\"call\":\"eth_getStorageAt\",\"data\":\"0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103\",\"fact\":\"Can the code be replaced?\",\"result\":\"0x0000000000000000000000001e3beaf840b96353a8be0a75b6dbb176dced66ce\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"},{\"block\":71410195,\"call\":\"eth_getStorageAt\",\"data\":\"0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50\",\"fact\":\"Can the code be replaced?\",\"result\":\"0x0000000000000000000000000000000000000000000000000000000000000000\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"},{\"block\":71410195,\"call\":\"owner()\",\"data\":\"0x8da5cb5b\",\"fact\":\"Who holds that power?\",\"result\":\"0x000000000000000000000000f76a23626c2527638b3eaf3d497a7c111f6d0ef9\",\"to\":\"0x1e3BeAF840b96353A8BE0A75b6dBB176dced66ce\"},{\"block\":71410195,\"call\":\"eth_getCode\",\"data\":\"0x\",\"fact\":\"Who holds that power?\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"getMinDelay()\",\"data\":\"0xf27a0c92\",\"fact\":\"Delay before a change\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"delay()\",\"data\":\"0x6a42b8f8\",\"fact\":\"Delay before a change\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"getTimelock()\",\"data\":\"0x6221a54b\",\"fact\":\"Delay before a change\",\"result\":\"0x\",\"to\":\"0xF76a23626c2527638b3EAF3d497a7c111F6D0ef9\"},{\"block\":71410195,\"call\":\"paused()\",\"data\":\"0x5c975abb\",\"fact\":\"Can it be paused?\",\"result\":\"0x0000000000000000000000000000000000000000000000000000000000000000\",\"to\":\"0x12e605bc104e93B45e1aD99F9e555f659051c2BB\"}],\"title\":\"Who can change the rules\",\"v\":1}", "structured": null, "uri": "", "txHash": "0x8082b1d1034a6f75c657def0186f2e9c907a1f8a08706be2de08378364865a16", "receiptUrl": "https://flare-explorer.flare.network/tx/0x8082b1d1034a6f75c657def0186f2e9c907a1f8a08706be2de08378364865a16", "blockNumber": 72105771, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Receipt", "Verified"], "withheld": null, "checkResults": []}], "threads": [{"projectId": 1, "rootNoteId": 1, "standing": "stands", "receiptCount": 1, "inputs": {"notes": [{"factors": ["Receipt", "Verified"], "inReplyTo": 0, "kind": 0, "noteId": 1, "retracted": false, "voice": null, "weight": 3.0, "withheld": false}], "rootNoteId": 1, "version": "0.3"}}], "voiceLabels": [{"project_id": 1, "address": "0xf76a23626c2527638b3eaf3d497a7c111f6d0ef9", "voice": "project", "source": "DEFAULT_ADMIN_ROLE member", "block_number": 73672355, "receipt_json": "{\"address\": \"0x12e605bc104e93b45e1ad99f9e555f659051c2bb\", \"block\": 73672355, \"call\": \"getRoleMember(DEFAULT_ADMIN_ROLE,i)\", \"index\": 0, \"result\": \"0xf76a23626c2527638b3eaf3d497a7c111f6d0ef9\"}", "checked_at": 1793737422}], "card": {"projectId": 1, "name": "Sceptre sFLR", "checked": "2026-10-28", "risk": {"word": "Highest", "reasons": ["One wallet is in control.", "There is no waiting period before a change lands.", "The code can be swapped out.", "One wallet can freeze users' money.", "Money of users is held here today.", "More than $1 million is at stake."], "wouldLower": ["A waiting period of at least 24 hours.", "A group of signers instead of one wallet."], "reasonKeys": ["single-wallet", "no-delay", "upgradeable", "single-freeze", "money-held", "large-money"]}, "control": "One wallet. No second signature, no vote.", "delay": "Immediately.", "freeze": "Yes.", "siteSays": "We have not checked their site yet.", "changes": [{"date": "2026-10-14", "line": "First check recorded."}], "response": "None yet. Sceptre sFLR can answer here.", "money": {"band": "over 1M", "text": "at least about $7 million", "receipt": {"block": 73201906, "feedId": "0x01464c522f55534400000000000000000000000000", "ftsoV2": "0x7bde3df0624114edb3a67dfe6753e62f4e7c1d20", "timestamp": 1793221670}}, "report": null, "about": "Liquid staking for FLR. You hand in FLR and hold sFLR, which earns staking rewards.", "statusLine": "One wallet can change the rules, immediately.", "xHandle": {"handle": "SceptreLS", "sourceUrl": "https://sceptre.fi", "readAt": "2026-10-07"}, "sent": {"state": "not-sent"}, "receiptsMatch": {"ok": 4, "total": 4, "checkedAt": "2026-10-28"}, "findingsCount": 1, "answer": {"state": "none"}, "kind": "contract"}}