Artifacts
DISCLAIMER // NFA // DYOR
This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.
⊙ generated by robots | curated by humans
| METADATA | |
|---|---|
| Contract Address | 0x643A45B5...0673C1 (etherscan) |
| Network | Ethereum Mainnet |
| Analysis Date | 2026-08-18 |
Runtime Bytecode
The deployed implementation bytecode, 21,024 bytes. Every DAO clone delegates into this code, and the four immutable addresses the framework depends on are embedded here rather than in any clone's storage.
Source: Etherscan — Contract Code
Command:
Artifact (opening bytes — the dispatcher and the first selectors):
0x6080604052600436101561001a575b3615610018575f80fd5b005b5f5f3560e01c8062ad800c14613a95578062fdd58e14613a5157806303314efa14613a2b57806303dc0dc51461330a5780630527aab6146132c1578063083ce0cf1461328e578063
The full 21,024-byte blob is retained in the analysis working directory rather than reproduced here. The immutables can be located within it directly:
cast code 0x643A45B599D81be3f3A68F37EB3De55fF10673C1 > moloch.hex
# EACH RETURNS EXACTLY 1
grep -o -i "0000000000330b8df9e3bc5e553074da58ee9138" moloch.hex | wc -l # SUMMONER
grep -o -i "71E9b38d301b5A58cb998C1295045FE276Acf600" moloch.hex | wc -l # sharesImpl
grep -o -i "6f1f2aF76a3aDD953277e9F369242697C87bc6A5" moloch.hex | wc -l # lootImpl
grep -o -i "47C175Ce83B6B931ccBedD5ce95e701984eD96d5" moloch.hex | wc -l # badgesImpl
Clone Bytecode
Each DAO is 45 bytes. The code below was read from one live clone; a second returns byte-identical code — the implementation address in the middle is the only variable part of the pattern, and every clone summoned by the factory points at the same target.
Source: Etherscan — a live clone
Command:
Artifact:
Reading it: 5f5f365f5f3736 5f73 copies calldata and pushes the 20-byte implementation address 643a45b599d81be3f3a68f37eb3de55ff10673c1, then 5af4 performs the delegatecall and 3d5f5f3e6029573d5ffd5b3d5ff3 returns or reverts with the result. There is no admin slot and nothing else in the contract.
Creation Bytecode
The implementation was deployed through a create2 factory rather than directly, so the transaction's to field is the factory address and the payload is initialisation code rather than a plain contract creation. The same transaction deployed the Summoner, whose constructor in turn deployed this implementation — which is why the SUMMONER immutable resolves to the factory contract.
Source: Etherscan — Creation TX
Command:
Artifact (opening bytes of a 74,826-character payload):
0x61ff715f2c8b14a270eb080c2662a12936bb6b2babf15bf82350aa9f17a8fe02f739c884000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000091
| PROPERTY | VALUE |
|---|---|
| Block | 23817534 |
| Timestamp | 2025-11-17 07:54:23 UTC |
| Gas used | 8,375,069 |
| Sender | 0x1C0Aa8cC...855A20 (etherscan) |
| Target | 0x00000000...3c15aa (etherscan) — CREATE2 deployment factory |
Verified Source Code
Source code verified on Etherscan, and independently confirmed byte-identical to the project repository at HEAD 7d7a36b5a25d31f7aa4d499b3a57ee98f4367fac (2026-03-23). The diff produced no output.
Source: Etherscan — Contract Source and z0r0z/majeur
| PROPERTY | VALUE |
|---|---|
| File | src/Moloch.sol |
| Lines | 2,110 |
| Contracts | Moloch, Shares, Loot, Badges, Summoner |
| Compiler | v0.8.30+commit.73712a01 |
| Optimizer | Enabled, 245 runs |
| License | MIT |
Command:
# RETRIEVE THE VERIFIED SOURCE BUNDLE
curl -s "https://api.etherscan.io/v2/api?chainid=1&module=contract&action=getsourcecode\
&address=0x643A45B599D81be3f3A68F37EB3De55fF10673C1&apikey=$ETHERSCAN_API_KEY"
# CONFIRM IT MATCHES THE PUBLISHED REPOSITORY
git clone https://github.com/z0r0z/majeur.git
diff majeur/src/Moloch.sol ./Moloch.sol && echo IDENTICAL
The source file is 69,731 bytes and is not reproduced here. The structural map is:
| LINES | CONTRACT | CONTENTS |
|---|---|---|
| 10–1051 | Moloch |
Proposals, voting, execution, futarchy, permits, allowances, sales, ragequit, chat, ERC-6909 receipts, metadata |
| 1052–1605 | Shares |
ERC-20 with checkpoints, delegation, and split delegation |
| 1606–1701 | Loot |
ERC-20 with no voting machinery |
| 1702–1943 | Badges |
Soulbound ERC-721 with a 256-seat board and bitmap |
| 1944–1948 | IMajeurRenderer |
External metadata interface |
| 1949–2054 | — | Shared Call struct, global errors, cast, math, and token helpers |
| 2055–2110 | Summoner |
CREATE2 factory and DAO registry |
Additional Artifacts
Everything from "Proposal Registry Snapshots" onward was read from two live clones rather than from the implementation, because the implementation holds no governance state of its own. Those two DAOs — zOrg at 0x5E58BA0e...74053E (etherscan) and FWC at 0xE7Aa6cA3...F49853 (etherscan) — are two of the 56 summoned from the same factory at analysis (59 by 2026-09-26), sampled because both carry enough proposal, permit and badge activity to exercise the paths described in the analysis. No claim is made that they are representative of the other 54. The figures below describe those DAOs, not the framework; they appear here as evidence that behaviours read out of the source occur in production.
Storage Layouts
Generated mechanically from the verified source rather than reconstructed by hand, then confirmed against live storage reads.
Command:
forge inspect src/Moloch.sol:Moloch storageLayout --json
forge inspect src/Moloch.sol:Shares storageLayout --json
forge inspect src/Moloch.sol:Loot storageLayout --json
forge inspect src/Moloch.sol:Badges storageLayout --json
| CONTRACT | DECLARED ENTRIES | SLOTS OCCUPIED |
|---|---|---|
Moloch |
38 | 0–31, with 2, 3 and 4 packed |
Shares |
9 | 0–8 |
Loot |
5 | 0–4 |
Badges |
8 | 0–261, seats[256] spanning 5–260 |
Full output is in storage-layout.md, including the raw slot words used to confirm the three packed slots.
Function Selector Set
Command:
forge inspect src/Moloch.sol:Moloch methods --json
forge inspect src/Moloch.sol:Shares methods --json
forge inspect src/Moloch.sol:Loot methods --json
forge inspect src/Moloch.sol:Badges methods --json
forge inspect src/Moloch.sol:Summoner methods --json
| CONTRACT | SELECTORS |
|---|---|
Moloch |
81 |
Shares |
23 |
Loot |
15 |
Badges |
14 |
Summoner |
3 |
| Total | 136 |
Every selector published in functions.md was checked against this output in both directions.
Proposal Registry Snapshots
Both sampled DAOs' complete proposal histories were enumerated through proposalIds and captured with state, tally, snapshot supply, proposer, and timing for each entry.
| DAO | PROPOSALS | EXECUTED | EXPIRED | SUCCEEDED, UNEXECUTED | ACTIVE |
|---|---|---|---|---|---|
zOrg 0x5E58BA0e...74053E (etherscan) |
22 | 15 | 6 | 0 | 1 |
FWC 0xE7Aa6cA3...F49853 (etherscan) |
15 | 12 | 1 | 2 | 0 |
Executed Proposal Payloads
Recovered by decoding the execution transactions, since the Executed event carries mode, target and value but not calldata. Four of the fifteen zOrg executions targeted an address outside the DAO itself. Two of those four are not contracts: 0x1C0Aa8cC...855A20 and 0xFbd69f81...cADE8E each return a 23-byte 0xef0100… delegation pointer, making them EIP-7702 delegated externally owned accounts.
| TARGET | INTENT | TRANSACTION |
|---|---|---|
0x1C0Aa8cC...855A20 (etherscan) |
op=0, zero value, empty calldata — a no-op call to the deployer, the DAO's first execution |
tx |
0xFbd69f81...cADE8E (etherscan) |
op=0, 0.01 ETH, empty calldata — a plain treasury payment |
tx |
0x00000000...F600e4 (etherscan) |
op=0, trust(0x000000005d9b18764e12e5aeefd6da73110f85eb, true) on zRouter |
tx |
0x0000006D...32a9a8 (etherscan) |
op=0, setRenderer(0x0000006b980ae5e796B3eF484e767993d0E29979) on ZorgConviction |
tx |
The remaining eleven zOrg executions and all twelve FWC executions used op=0 against either the DAO itself — the standard pattern for configuration changes — or, on FWC, a helper contract deployed in its summon transaction. No execution on either DAO has used op != 0, so the delegatecall path has never been exercised in production on these instances.
The ZorgConviction execution can be confirmed to have landed:
cast call 0x0000006D936bA3653b8854490E16E782cd32a9a8 "renderer()(address)"
# 0x0000006b980ae5e796B3eF484e767993d0E29979 — matches the proposal payload
cast call 0x0000006D936bA3653b8854490E16E782cd32a9a8 "dao()(address)"
# 0x5E58BA0e06ED0F5558f83bE732a4b899a674053E — the zOrg DAO
Permit Grants and Spends
Captured from PermitSet and PermitSpent logs on the FWC DAO, with remaining counts read from ERC-6909 balances.
| SPENDER | GRANTED | REMAINING | INSTALLED |
|---|---|---|---|
0xb3b3f4f1...bF7F8e (etherscan) — verified as FundingWorksMinter |
1 | 1 | In the DAO's own creation transaction |
0x006CD14F...8549F2 (etherscan) — the same 3-owner multisig that owns the zFi TokenList |
10,000,000 | 10,000,000 | Block 25666542 |
0x002d1618...1d515c (etherscan) — verified as FWCKeeper |
100,000 | 99,991 | Block 25668031 |
0x002d1618...1d515c (etherscan) |
10 | 8 | Block 25668033 |
0x006cd14f...8549f2 (etherscan) |
1 | 1 | Block 25676377 |
Eleven spends are recorded, all op=0 with zero value against 0xb3b3f4f1...bf7f8e (etherscan), and every one was made by 0x002d1618...1d515c (etherscan) against its own two grants. The other three grants have never been spent, so their intents have never appeared on-chain through the contract. This DAO republishes proposal parameters in its own chat, and the two guardian grants recompute from those published values to their stored permit ids: 10,000,000 uses of bumpConfig() on the DAO itself, and one single-use delegatecall into FWCPoisonPill at 0x55D2cF1f...50d050 (etherscan).
The other sampled DAO has no permits installed. It has one SaleUpdated event; this one has none.
Allowances
setAllowance emits no event, so FWC's allowances were found by decoding setAllowance calls out of its executed proposals and reading the getter, allowance(token, spender), at block 26064438 (2026-09-26). The ETH allowance was found by probing every address the DAO has interacted with; an allowance granted to an address outside that set would not appear here.
| SPENDER | TOKEN | ALLOWANCE AT BLOCK 26064438 |
|---|---|---|
0x5D03BeE0...10C8E8 (etherscan) — verified as FollowOnSale |
The DAO's own address — mints new FWC shares on draw | 8,771,000 shares |
0x824d11a4...7e2491 (etherscan) — verified as ContinuousSale |
The DAO's own address — mints new FWC shares on draw | 6,667,102.917978715853 shares |
0x00000000...6C60aC (etherscan) — verified as DAICO |
address(0) — ETH from the treasury |
type(uint256).max less about 1.0012 ETH; bounded in practice by the DAO's ETH balance, which was zero at this block |
The two share-minting allowances total 15,438,102.9 shares against a supply of 3,443,609.1 FWC at the same block, roughly 4.5 times.
Badge Board State
Read from raw storage, since the bitmap and cutline have no dedicated getter.
| DAO | SEATS OCCUPIED | minSlot |
minBal (CUTLINE) |
|---|---|---|---|
zOrg badges 0x2809A7EB...01c221 (etherscan) |
256 of 256 | 120 | 16,693,532,759,286,299,628 (≈16.69 ZORG) |
FWC badges 0xDf6E6e31...90AEE4 (etherscan) |
23 of 256 | 19 | 110,000,000,000,000,000,000 (110 FWC) |
The FWC bitmap reads 0xdfffff — 23 bits set across the low 24, with bit 21 clear. That gap is a seat released when its holder's balance reached zero.
Token Supplies
| TOKEN | ADDRESS | SUPPLY |
|---|---|---|
| zOrg Shares (ZORG) | 0x00a6bA94...2dCb12 (etherscan) |
7,822,066,259,197,685,009,861,991 |
| zOrg Loot | 0x62eC8675...359016 (etherscan) |
2,026,458,778,534,528,890 |
| FWC Shares | 0x883d646d...4c3a49 (etherscan) |
3,333,609,082,021,284,147,000,000 |
| FWC Loot | 0xd07FA48b...bf13D2 (etherscan) |
0 |
Prior Audit Coverage
The project repository publishes 33 reports under audit/. Their existence is recorded here as context; none was used as a source for any claim in this analysis, and no assessment of their quality, scope, or completeness was made.
The set spans established security firms — Cantina, Certora, Trail of Bits, Zellic, Pashov, Cyfrin, Ackee — alongside outputs attributed to general-purpose language models including ChatGPT, Claude, Gemini, DeepSeek and Qwen, held in the same directory under the same naming convention. Anyone relying on this material should open the individual reports and judge them separately.