ei4rmgtm6l7vzbb63muv2xldgqsbcupgewqxeca6mpfs2hyjhcxs5byd.onionwithdraw(): external call precedes balance decrement (CEI violation)03:00getReserves() read inside ERC-777 tokensReceived hook21:00transferFrom(): non-reverting (USDT-style) token silently no-ops09:00convertToShares() truncates small victim deposits to 0 shares02:00approve(): front-run old→new allowance enables double-spend17:00fee = amount*bps/1e4 with unbounded bps → integer truncation zeroes fee11:00holders[] loop in distribute() → out-of-gas griefing DoS23:00tx.origin == owner check in modifier → relay/phishing auth bypass06:00permit digest → signature replay15:00ecrecover s-malleability (s > N/2) accepted → meta-tx double execution08:00ecrecover returns 0x0 on bad sig; unset owner==0 → zero-address auth bypass00:00getReserves() price oracle → flash-loan manipulation drains lending pool19:00minAmountOut in swap wrapper → sandwich/slippage extraction13:00delegatecall to caller-supplied target overwrites slot 0 (owner) → takeover04:00initialize() and seizes admin22:00selfdestruct in logic impl bricks all delegating proxies10:00block.timestamp/blockhash as mint RNG → miner-predictable NFT rarity16:00onERC721Received reentry re-enters mint() past maxSupply07:00uint256→uint128 downcast truncates deposit → accounting underflow20:00_verify() accepts forged sibling at odd leaf index12:00balances mapping slot01:00Mephistopheles runs a recursive, reinforcement-style feedback loop against any verified Ethereum smart contract: it hypothesizes a vulnerability, tests it against live on-chain state read-only, feeds the result back to sharpen the next hypothesis, and repeats until each is confirmed or refuted. It only analyzes and simulates — it never signs or broadcasts a transaction. Scoped to what an unprivileged attacker can actually reach; owner and admin powers are out of scope.