ADV-01

Security triage of a live BSC contract

A high-stakes triage on a contract with real money behind it, chosen because it is genuinely privileged rather than because it flatters either arm — BSC-USD is upgradeable-adjacent, owner-controlled and holds billions. Both arms answer at the same block. The agent reads deployed bytecode and storage slots; the manual arm may use any tool, including BscScan and the verified source, which is an advantage the agent does not have. FALSIFIED IF: the agent reports a privilege the contract does not have, or misses one that a reader of the verified source finds in the manual arm.

Back to the Ledger · The method

The registered task

task hash 0x6dd085cdb7a9ce82cabf9d89d9f0da6bf13ea876be5f2248bde733e1490141d5input hash 0x069277c6f5acf9de1818249a7e53d4cddd3f5c89c2790af4fa2eba5877b7b450rubric 1.0 0xe7bb4e109246cb9cc4d83f2eadc43fe2be59d6caecfa740a8a7725eff103dbfd, registered 2026-09-05 07:13:09Z

Triage the BNB Smart Chain contract 0x55d398326f99059fF775485246999027B3197955 for the risks that would affect someone holding or approving this token.
Chain: BNB Smart Chain (56). Block: 126580730.

Cover, at minimum: whether the contract is upgradeable and by whom; whether a privileged party can mint, pause, blacklist or change fees; and what a holder is exposed to if that party is compromised.
For every claim, say how you established it. State explicitly what your method cannot see.

The rubric

Registered before either arm ran, and version-hashed so it cannot be quietly rewritten once the answers are in. Scoring is blind: source labels are stripped from both outputs before anyone reads them.

Criterion	Points	What a full-marks answer contains
Correctness	40	Every stated number is right against chain state at the pinned block, within the tolerance the published MCS test uses for that field. A single wrong figure that a reader would act on scores zero here regardless of the rest.
Completeness	15	Every field the task asked for is present. A missing field is not a partial answer; it is a question left unanswered, and the reader has to go and find it themselves.

The agent arm

Redcell · repetition 1

graded blind

output hash 0x6f518331bbd42432188d610772f6f34842d617f77d8b8cb0a7c124035f2bd324manifest hash 0xdcab4ee9b1a025041308c5480918b95ee65a371ca8b54584eee0a381127771b7block 120123441 · ran 2026-09-09 18:59:07Z

MEASURED545 ms. wall clock around the public HTTPS request, measured with performance.now(); includes TLS, the reverse proxy and the SSRF guard because a buyer waits for those too

Cost: gas $0.0000, model $0.0000, agent fee $0.0000, human time n/a.

{
  "owner": "0xF68a4b64162906efF0fF6aE34E2bB1Cd42FEf62d",
  "proxy": {
    "admin": null,
    "beacon": null,
    "isProxy": false,
    "implementation": null
  },
  "method": "deployed bytecode selector scan plus EIP-1967/1822 storage slots and view calls, read on-chain",
  "paused": null,
  "readAt": "2026-09-09T18:59:07.228Z",
  "symbol": "USDT",
  "address": "0x55d398326f99059fF775485246999027B3197955",
  "verdict": "0 critical, 1 high, 1 medium",
  "approval": null,
  "codeSize": 4413,
  "findings": [
    {
      "title": "Someone can create new tokens.",
      "source": "onchain",
      "summary": "The deployed bytecode dispatches mint(uint256).",
      "category": "supply-control",
      "severity": "high",
      "dedupeKey": "2218600a625095d3",
      "confidence": 0.85,
      "recommendedFix": "Establish who may call mint(uint256) and under what delay. The function existing is not the problem; an unaccountable caller is.",
      "exploitScenario": "Supply can be increased after you buy, diluting every existing holder."
    },
    {
      "title": "A single owner address holds privileged control",
      "source": "onchain",
      "summary": "owner() returns 0xF68a4b64162906efF0fF6aE34E2bB1Cd42FEf62d.",
      "category": "privilege",
      "severity": "medium",
      "dedupeKey": "09aa7b11bb632c5a",
      "confidence": 0.95,
      "recommendedFix": "Check whether that address is an externally owned account, a multisig or a timelock. An EOA owner is the weakest of the three by a wide margin.",
      "exploitScenario": "Every owner-gated function below is one compromised key away from being called. The concentration is the risk, not any individual function."
    }
  ],
  "isContract": true,
  "blockNumber": "120123441",
  "limitations": [
    "Selector presence is read from the deployed dispatcher. A function reachable only through a proxy, a fallback router or an unusual optimiser layout can be missed.",
    "No source code is read, so logic bugs, reentrancy and accounting errors are entirely out of scope.",
    "A clean result means nothing was found by this method. It never means the contract is safe."
  ],
  "severityCounts": {
    "low": 0,
    "high": 1,
    "info": 0,
    "medium": 1,
    "critical": 0
  }
}

Redcell · repetition 2

graded blind

output hash 0x7da19ebf0135161a3005b54fccccc4caa14814f8130a09c678c92f8b3c94cd16manifest hash 0x7e9345048b6b925a931383bf39c2f3611f8b746bb477c18800e5693854fcf397block 120123441 · ran 2026-09-09 18:59:07Z

MEASURED160 ms. wall clock around the public HTTPS request, measured with performance.now(); includes TLS, the reverse proxy and the SSRF guard because a buyer waits for those too

Cost: gas $0.0000, model $0.0000, agent fee $0.0000, human time n/a.

{
  "owner": "0xF68a4b64162906efF0fF6aE34E2bB1Cd42FEf62d",
  "proxy": {
    "admin": null,
    "beacon": null,
    "isProxy": false,
    "implementation": null
  },
  "method": "deployed bytecode selector scan plus EIP-1967/1822 storage slots and view calls, read on-chain",
  "paused": null,
  "readAt": "2026-09-09T18:59:07.433Z",
  "symbol": "USDT",
  "address": "0x55d398326f99059fF775485246999027B3197955",
  "verdict": "0 critical, 1 high, 1 medium",
  "approval": null,
  "codeSize": 4413,
  "findings": [
    {
      "title": "Someone can create new tokens.",
      "source": "onchain",
      "summary": "The deployed bytecode dispatches mint(uint256).",
      "category": "supply-control",
      "severity": "high",
      "dedupeKey": "2218600a625095d3",
      "confidence": 0.85,
      "recommendedFix": "Establish who may call mint(uint256) and under what delay. The function existing is not the problem; an unaccountable caller is.",
      "exploitScenario": "Supply can be increased after you buy, diluting every existing holder."
    },
    {
      "title": "A single owner address holds privileged control",
      "source": "onchain",
      "summary": "owner() returns 0xF68a4b64162906efF0fF6aE34E2bB1Cd42FEf62d.",
      "category": "privilege",
      "severity": "medium",
      "dedupeKey": "09aa7b11bb632c5a",
      "confidence": 0.95,
      "recommendedFix": "Check whether that address is an externally owned account, a multisig or a timelock. An EOA owner is the weakest of the three by a wide margin.",
      "exploitScenario": "Every owner-gated function below is one compromised key away from being called. The concentration is the risk, not any individual function."
    }
  ],
  "isContract": true,
  "blockNumber": "120123441",
  "limitations": [
    "Selector presence is read from the deployed dispatcher. A function reachable only through a proxy, a fallback router or an unusual optimiser layout can be missed.",
    "No source code is read, so logic bugs, reentrancy and accounting errors are entirely out of scope.",
    "A clean result means nothing was found by this method. It never means the contract is safe."
  ],
  "severityCounts": {
    "low": 0,
    "high": 1,
    "info": 0,
    "medium": 1,
    "critical": 0
  }
}

The manual arm

This arm was run by a person, on camera. The recording below is the analyst doing exactly this task by hand at the pinned block, not a re-enactment, and not something Marque could have generated.

Screen recording of the human analyst running ADV-01 by hand

Watch the human arm: ADV-01 MEASUREDThe analyst on BscScan, reading the BEP-20 USDT contract source (the exact token the task names) line by line for upgrade, mint, pause and blacklist powers.Full recording on YouTube ↗

Human analyst · repetition 1

graded blind

output hash 0xa4aa021c7285ab57f54c75f695622dcd68f45f73d0a3f91d89ea2fb403a999damanifest hash 0x6af1848f3ae9cd4215a8cdc950298f098233aa2104c6e0cf36b42e63975562b7block not recorded → effective 120123441 · ran 2026-09-08 12:48:50Z

MEASUREDProvenance: The raw run recorded no block. Its manifest task hash (0xfb984f660bd387cae77e9805404f4b8ef52b8aadddc72cbfc08af6991156ac81) matches the benchmark task frozen before either arm ran, and that task pins exactly one BSC block: 120123441. The raw row is unchanged; this is the block trusted for the comparison. Source task 0xfb984f660bd3…. The raw run row is unchanged.

MEASURED547.0 s. PC Screen recorder

Cost: gas $0.0000, model $0.0000, agent fee $0.0000, human time $4.8622.

Screen recording

{
  "text": "ADV-01 — BSC block 120123441\nContract: 0x55d398326f99059fF775485246999027B3197955\n\nThe contract is BEP20USDT and its source is verified on BscScan.\n\nUpgradeable: No. I found a direct BEP20USDT deployment rather than a proxy, and the verified source/ABI contains no implementation, proxy-admin or upgrade function.\n\nPrivileged authority: owner() at block 120123441 returned 0xF68a4b64162906efF0fF6aE34E2bB1Cd42FEf62d.\n\nMint: Yes. The verified source defines mint(uint256) as onlyOwner. Therefore the address above could mint arbitrary additional supply at the pinned block, assuming it was non-zero.\n\nPause: No pause/unpause mechanism found in the verified source or ABI.\n\nBlacklist/freeze: No blacklist, freeze or address-denial mechanism found.\n\nFees: No configurable transfer fee found. The verified _transfer logic simply subtracts the transfer amount from sender and adds the same amount to recipient.\n\nApprovals: Standard allowance/transferFrom behaviour. A spender approved by a holder can transfer up to that allowance. I found no special owner privilege over allowances or holder balances.\n\nCompromise exposure: If the owner key were compromised, the attacker could mint arbitrary new supply and transfer ownership, creating severe dilution/depeg risk. I found no owner capability to pause transfers, blacklist individual holders, introduce transfer fees, or directly confiscate holder balances.\n\nMethod: verified BscScan Solidity/ABI plus archive-RPC owner() read at block 120123441.\n\nLimits: This establishes the deployed contract logic and on-chain owner at the pinned block. It does not establish who actually controlled the owner's private keys, whether those keys were compromised, or off-chain custody/governance arrangements."
}

Human analyst · repetition 2

graded blind

output hash 0x496e79ea2cad57c67ae6567a0e584e101dffd9719c24cac0f3cba6c89a83ea29manifest hash 0x2359668d031c10677ed94ab373eee6a1a8a16056a7070b481548e4c27132cb75block not recorded → effective 120123441 · ran 2026-09-08 16:45:10Z

MEASURED382.0 s. Stopwatch from my mobile

Cost: gas $0.0000, model $0.0000, agent fee $0.0000, human time $2.8650.

Screen recording

{
  "text": "BEP20USDT; non-upgradeable/direct deployment; mint(uint256) is onlyOwner; no pause; no blacklist/freeze; no configurable transfer fee; standard approvals; principal privileged risk = owner compromise allowing arbitrary minting/dilution."
}

The registered task

The rubric

The agent arm

Redcell · repetition 1

Redcell · repetition 2

The manual arm

Human analyst · repetition 1

Human analyst · repetition 2

Outstanding