{
  "generatedUTC": "2026-10-31T17:49:01.535651+00:00",
  "finding": "The nonce28 call destination and selector match documented OpenOcean ExchangeV2 Polygon router and official swap ABI.",
  "documentedPolygonRouter": "0x6352a56caadc4f1e25cd6c75970fa768a3304e64",
  "incidentTransaction": "0x3f73b5800812abbdebcb66bee783b1c52a3d5a9ef8f16a287b298faa881a98dd",
  "officiality": {
    "documentation": "https://docs.openocean.finance/",
    "observedGitHubLink": "https://github.com/openocean-finance",
    "observation": "Official documentation homepage links this GitHub organization. Its ExchangeV2 README explicitly publishes this router for Polygon."
  },
  "sources": {
    "deployment": {
      "URL": "https://github.com/openocean-finance/OpenOceanExchangeV2/blob/76c0a5a1a5b93a08c0c9ac8d6643c6b3a7b9e77e/README.md",
      "lines": [
        18,
        21,
        28
      ],
      "sourceSHA256": "d2cd1459da82491d619cf816bacb90f184781f4ccb4f7a567ef997aeda27635d",
      "GitBlobSHA1": "31d0d275a54b983e300740f53aff8fcd929cff1e"
    },
    "contract": {
      "URL": "https://github.com/openocean-finance/OpenOceanExchangeV2/blob/76c0a5a1a5b93a08c0c9ac8d6643c6b3a7b9e77e/contracts/OpenOceanExchange.sol",
      "lines": [
        26,
        35,
        39,
        49,
        57,
        130,
        138
      ],
      "sourceSHA256": "b9ad0853dd8a6c9143a482c38c605ab625c83b097b61553cd9c1603b40ba05bc",
      "GitBlobSHA1": "8ec0338c596c15718e1c151e22850309598c8c9b"
    },
    "ABI": {
      "URL": "https://github.com/openocean-finance/ledger/blob/2bad4a9054c95b6f74fbcad4cb83274f3d2bd0a2/tests/networks/ethereum/openocean/abis/0x6352a56caadc4f1e25cd6c75970fa768a3304e64.abi.json",
      "lines": null,
      "sourceSHA256": "1d52c79b503ff1484c050941f3babb9c155d90170bd24839ace12eecaa75cb81",
      "GitBlobSHA1": "6108b63c80286c109480f188b7d63f985046e7cf"
    },
    "selectorTable": {
      "URL": "https://github.com/openocean-finance/ledger/blob/2bad4a9054c95b6f74fbcad4cb83274f3d2bd0a2/README.md",
      "lines": [
        18,
        24
      ],
      "sourceSHA256": "6d6851b42bd9d2ccebe8b5a30559b9b95debfde092b611b1b435ccf708ef3a31",
      "GitBlobSHA1": "838d0a949628dd3b3ce3bc6abc754707c66f0838"
    },
    "callerInterface": {
      "URL": "https://github.com/openocean-finance/OpenOceanExchangeV2/blob/76c0a5a1a5b93a08c0c9ac8d6643c6b3a7b9e77e/contracts/interfaces/IOpenOceanCaller.sol",
      "lines": [
        6,
        7,
        8,
        9,
        10
      ],
      "sourceSHA256": "4e948099b67eefd2a6e04674fcc57b6235f79e3b9c7df6288e5a9b589659764d",
      "GitBlobSHA1": "06b09d9ce04ef79706ae526b34df254ce40ebd6c"
    },
    "nativeTokenRecognition": {
      "URL": "https://github.com/openocean-finance/OpenOceanExchangeV2/blob/76c0a5a1a5b93a08c0c9ac8d6643c6b3a7b9e77e/contracts/libraries/UniversalERC20.sol",
      "lines": [
        14,
        52,
        55,
        56,
        57,
        58,
        59
      ],
      "sourceSHA256": "da9995c228a3afa36ad65b8d221d63f03649c07e3827e23ab3ecf6f23a660bf5",
      "GitBlobSHA1": "97df7399099e658a6f79f5cf32734dc8df5c335c"
    }
  },
  "ABI": {
    "functionSignature": "swap(address,(address,address,address,address,uint256,uint256,uint256,uint256,address,bytes),(uint256,uint256,uint256,bytes)[])",
    "selector": "0x90411a32",
    "SwapDescriptionFields": [
      "address srcToken",
      "address dstToken",
      "address srcReceiver",
      "address dstReceiver",
      "uint256 amount",
      "uint256 minReturnAmount",
      "uint256 guaranteedAmount",
      "uint256 flags",
      "address referrer",
      "bytes permit"
    ],
    "CallDescriptionFields": [
      "uint256 target",
      "uint256 gasLimit",
      "uint256 value",
      "bytes data"
    ],
    "eventSignature": "Swapped(address,address,address,address,uint256,uint256,uint256,uint256,uint256,address)",
    "eventTopic0": "0x76af224a143865a50b41496e1a73622698692c565c1214bc862f18e22d829c5e",
    "SwappedIndexedFields": [
      "sender",
      "srcToken",
      "dstToken"
    ],
    "SwappedDataFields": [
      "dstReceiver",
      "amount",
      "spentAmount",
      "returnAmount",
      "minReturnAmount",
      "guaranteedAmount",
      "referrer"
    ]
  },
  "referrerRole": {
    "name": "referrer",
    "sourceBehavior": "swap accepts desc.referrer and emits it in Swapped. This field is not an authenticated account owner or signer.",
    "officialDocumentationContext": "ExchangeV2 README describes integrator monetization via referrer/referrerFee parameters. This supports a referral/fee role, not ownership attribution for the incident receiver.",
    "financialBoundary": "Actual fee transfers and signed incident bytes are verified in the sibling collector-corpus pass; this document establishes official field semantics."
  },
  "nativeToken": {
    "address": "0x0000000000000000000000000000000000001010",
    "sourceConstant": "MATIC_ADDRESS",
    "sourceBehavior": "UniversalERC20.isETH recognizes this address and universalBalanceOf uses account.balance, the native coin balance. On Polygon the current native token is POL."
  },
  "unresolvedAddresses": {
    "0x394767c060fc000f7ae5fbe907c442fbc5f6d1b9": "Observed caller/executor in incident bytes; no exact official source ownership binding found.",
    "0x3692dea4346c95eb3957d8022c40373ab2a21369": "Observed separate native-coin payment recipient from sibling receipt checks; no source-defined ownership/service role recovered."
  },
  "limits": [
    "No source-to-deployed-bytecode equivalence audit or proxy implementation reconstruction in this pass.",
    "Official CallDescription types target as uint256; checked repository has interface only, so no claim that arbitrary target uint values are address-only.",
    "Shared public router usage and a referral field do not identify an attacker, customer, device or person.",
    "Current source publication time is not independently proven by Git dates."
  ]
}