Methodology

DISCLAIMER // NFA // DYOR

This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.

⊙ generated by robots | curated by humans

METADATA
Contract Address	0x00000000...4e6f2a (etherscan)
Network	Ethereum Mainnet
Analysis Date	2026-10-27

---

Overview

Every call SafeSummoner builds was traced into the Majeur Moloch and Summoner source, already collected for the Majeur analysis, to establish what each encoded call actually does when the new Decentralized Autonomous Organization (DAO) executes it — how permits are keyed, what the allowance sentinels mean, when the proposal time-to-live (TTL) applies, and what init does and does not check.

On-chain work covered what the source cannot show:

• Whether the address predictions hold for real DAOs: checked against all 30, through the stored settings and the Shares and Loot addresses.
• Who uses the contract, and for what: answered from the full transaction and internal-transaction history and by decoding every summon's parameters, which showed create2Deploy to be the most-called function.
• Whether msg.value reuse in multicall and pre-emption of a predicted DAO address behave as the source reads: tested with read-only eth_call simulations using state overrides. No transaction was sent.

Source comments cite numbered findings ("KF#11", "KF#2" and others). They were not used to infer behaviour. Each validation rule is described from what its condition tests.

Thought Process

mindmap
  root((SafeSummoner))
    Obtain
      Etherscan v2 source and ABI
      Runtime bytecode via cast
      Creation path
        VanityMarket CREATE3
    Structure
      No storage
      Six bytecode constants
      16 functions
        9 payable entry points
        7 pure or view helpers
    Trace into Majeur
      Summoner salt excludes caller and initCalls
      Moloch.init skips quorumBps bound
      Permit id includes config
      TTL skipped once queued
      Allowance sentinels dao and 1007
    On-chain usage
      121 transactions
      91 create2Deploy
        90 contracts
        TokenList and ZorgConviction among them
      30 summons
        Preset values match stored state
        1 DAO with a proposal
    Verify
      Prediction vs shares and loot x30
      multicall value reuse simulation
      Address pre-emption simulation
    Risks
      Validation does not bind the DAO
      Pre-emptible summons
      Permit invalidation by bumpConfig
      Presence not adequacy

---

Verification Guide

All conclusions rest on the verified SafeSummoner source, the Majeur source verified on Etherscan, and chain state at blocks 26,284,721 to 26,284,732.

External Resources

RESOURCE	WHAT IT PROVIDED
Etherscan — SafeSummoner	Verified source, Application Binary Interface (ABI), compiler settings, creation record
Etherscan — Summoner	summon salt derivation and the NewDAO event
Etherscan — Moloch implementation	init, state, setPermit, spendPermit, _intentHashId, _payout
Etherscan — ShareBurner	burnUnsold and closeSale
Etherscan — VanityMarket	Identity of the deployment factory and its deploy(uint256,bytes) entry point
Etherscan API v2 txlist, txlistinternal, getLogs, getsourcecode	Call history, CREATE2 deployments, NewDAO events, names of deployed contracts
Majeur contract analysis	Prior reading of the framework this contract configures
EIP-1014	CREATE2 address formula

---

Commandline Tools

Tip

Commands below use cast from the Foundry Toolkit. To run the commands below, you must set the Remote Procedure Call (RPC) URL environment variable:

export ETH_RPC_URL=https://eth.llamarpc.com

Confirm the Contract Holds Nothing

SafeSummoner declares no storage, so slot 0 reads zero, and its balance should be zero. The nonce counts its own CREATE2 deployments.

# STORAGE SLOT 0

cast storage 0x00000000004473e1f31C8266612e7FD5504e6f2a 0


# ETH BALANCE

cast balance 0x00000000004473e1f31C8266612e7FD5504e6f2a


# NONCE (1 + SUCCESSFUL create2Deploy CALLS)

cast nonce 0x00000000004473e1f31C8266612e7FD5504e6f2a


# RUNTIME SIZE

cast codesize 0x00000000004473e1f31C8266612e7FD5504e6f2a

Map Selectors to Functions

The ABI from Etherscan, expanded to canonical signatures, reproduces the 16 selectors in the runtime jump table.

# SELECTORS PRESENT IN RUNTIME

cast selectors "$(cast code 0x00000000004473e1f31C8266612e7FD5504e6f2a)"


# SELECTOR OF A STRUCT-TAKING FUNCTION (STRUCTS EXPAND TO TUPLES)

cast sig "previewCalls((uint96,uint64,uint64,uint96,uint96,bool,bool,uint256,uint256,address,bool,address,uint256,uint256,bool,bool,address,uint256,address,address,uint40))"

Identify the Deployment Path

# CREATION RECORD (CREATOR, TX, CREATE3 PROXY — NOT VanityMarket ITSELF)

curl -s "https://api.etherscan.io/v2/api?chainid=1&module=contract&action=getcontractcreation&contractaddresses=0x00000000004473e1f31C8266612e7FD5504e6f2a&apikey=$ETHERSCAN_API_KEY"


# THE TX CALLS VanityMarket.deploy(uint256,bytes)

cast tx 0x028bd2b5cd3495a793cc7ed474f6769d60087143f066628477df231e06f05cfc to
cast 4byte 0x61ff715f

Tally Usage by Function

# DIRECT TRANSACTIONS, GROUPED BY SELECTOR

curl -s "https://api.etherscan.io/v2/api?chainid=1&module=account&action=txlist&address=0x00000000004473e1f31C8266612e7FD5504e6f2a&startblock=0&endblock=99999999&sort=asc&apikey=$ETHERSCAN_API_KEY" \
  | jq -r '.result[] | .input[0:10]' | sort | uniq -c


# CONTRACTS CREATED BY create2Deploy

curl -s "https://api.etherscan.io/v2/api?chainid=1&module=account&action=txlistinternal&address=0x00000000004473e1f31C8266612e7FD5504e6f2a&startblock=0&endblock=99999999&sort=asc&apikey=$ETHERSCAN_API_KEY" \
  | jq -r '.result[] | select(.type=="create2") | .contractAddress'

Enumerate Summoned DAOs and Their Settings

Summoner emits NewDAO(address indexed summoner, address indexed dao). Filtering on SafeSummoner as summoner lists every DAO it produced; the total comes from getDAOCount. The Etherscan log endpoint is used because many public RPCs cap eth_getLogs block ranges well below the 1.6 million blocks involved.

# DAOS SUMMONED THROUGH SAFESUMMONER

curl -s "https://api.etherscan.io/v2/api?chainid=1&module=logs&action=getLogs&address=0x0000000000330B8df9E3bc5E553074DA58eE9138\
&topic0=0x567cac11d4a66456bbe20dc60d3579ec446a4e2fffae2a85f82ad0f1f18214f1\
&topic1=0x00000000000000000000000000000000004473e1f31c8266612e7fd5504e6f2a&topic0_1_opr=and\
&fromBlock=24649778&toBlock=26284732&apikey=$ETHERSCAN_API_KEY" | jq -r '.result[] | "0x" + .topics[2][26:]'


# ALL DAOS FROM THE SUMMONER

cast call 0x0000000000330B8df9E3bc5E553074DA58eE9138 "getDAOCount()(uint256)"


# STORED GOVERNANCE SETTINGS OF ONE DAO (REPEAT PER DAO)

DAO=0x989a337649C8eEca33f0F09447FF08eA83C739D5
cast call $DAO "proposalThreshold()(uint96)"
cast call $DAO "proposalTTL()(uint64)"
cast call $DAO "timelockDelay()(uint64)"
cast call $DAO "quorumBps()(uint16)"
cast call $DAO "quorumAbsolute()(uint96)"
cast call $DAO "getProposalCount()(uint256)"
cast call $(cast call $DAO "shares()(address)") "totalSupply()(uint256)"

Check Address Predictions

# PREDICTED VS ACTUAL SHARES AND LOOT FOR ONE DAO

DAO=0x989a337649C8eEca33f0F09447FF08eA83C739D5
cast call 0x00000000004473e1f31C8266612e7FD5504e6f2a "predictShares(address)(address)" $DAO
cast call $DAO "shares()(address)"
cast call 0x00000000004473e1f31C8266612e7FD5504e6f2a "predictLoot(address)(address)" $DAO
cast call $DAO "loot()(address)"

Decode a Decentralized Autonomous Initial Coin Offering (DAICO) Summon

# CANONICAL SIGNATURE FROM THE ABI, THEN DECODE THE TX INPUT

SIG=$(jq -r 'def t: if (.type|startswith("tuple")) then "(" + ([.components[]|t]|join(",")) + ")" + (.type|ltrimstr("tuple")) else .type end;
  .[] | select(.name=="safeSummonDAICO") | .name + "(" + ([.inputs[]|t]|join(",")) + ")"' abi.json)
cast decode-calldata "$SIG" "$(cast tx 0xee4f90933028bfbb6b29858a74e9694996a694d36487775f61dfa0546d66f316 input)"

Simulate msg.value Reuse and Address Pre-emption

Both are read-only eth_calls with state overrides. Commands and outputs: msg.value reuse, address pre-emption.

---

Document Verification

The drafted documents were re-checked before publication in five independent passes, each with a narrow scope and each reading from primary sources rather than from the draft. Running them separately matters: a claim can be correctly formatted, non-redundant, neutral in tone, free of filler, and still be factually wrong, and a single reviewer holding all five concerns at once reliably drops the last one.

DIMENSION	WHAT IT CHECKS	CHECKED AGAINST
Facts	Addresses, block heights, counts, dates, compiler versions, selector values, every quantitative claim	Live chain state via cast, Etherscan API v2, the verified SafeSummoner and Majeur sources
Standards	Address display format, explorer links on every on-chain reference, table casing, section separators, icon semantics, glossary term wrapping, nav registration	CLAUDE.md, docs/glossary.md, mkdocs.yml
Redundancy	Duplicated tables and paragraphs across the six documents, and the same claim stated with different values in two places	The document set itself
Voice	Superlatives asserted without a verification clause, opinion adjectives, speculation about intent or users	CLAUDE.md writing standards
Filler	Rhetorical padding — meta-narration, telegraphed structure, formulaic emphasis	CLAUDE.md anti-patterns

Every disagreement the fact pass raised was re-derived from chain or source before any edit was made, on the assumption that the checker is as capable of being wrong as the draft. A claim was only changed where the contradicting value could be reproduced from a command in the Verification Guide above.

---

Token Cost Breakdown

PHASE	DESCRIPTION	TOKENS
Phase 0	Obtain the Contract	25 tok
Phase 1	Discovery & Understanding	45 tok
Phase 2	Deep Dive Analysis	45 tok
Phase 3	Risk & Trust Analysis	25 tok
Phase 4	Documentation Generation	70 tok
Phase 5	Document Verification	815 tok
TOTAL	Complete Contract Analysis	1 mtok

Phase 5 dominates because five independent reviewers each re-read the full document set, and the fact pass re-derived every count, address and code claim from chain state and source rather than from the draft.

Note: Token costs are estimates based on typical conversation lengths and complexity. Actual consumption may vary by ±10-15% depending on API responses, iterative refinement, and verification steps.