v0.2.0 — Bytecode Selector Matching & EIP-1967 Proxy Detection

v0.2.0

What's New

• Bytecode selector matching: detects callbacks via 14 real keccak256 selectors in bytecode dispatchers, not just address flags
• EIP-1967 proxy detection: identifies upgradeable implementation slots (0x360894...) and admin slots (0xb531276...) loaded via SLOAD + DELEGATECALL — flagged as a point-in-time verdict that cannot be cached
• Dual detection display: shows address-flag-detected callbacks AND bytecode-detected callbacks separately in the report
• Address parsing fix: V4 hook addresses (40 hex chars) now correctly extract the lower 14 bits — previously u64 overflow caused all flags to read as zero

Risk Heuristics (unchanged from v0.1)

• SELFDESTRUCT → critical
• DELEGATECALL / proxy behavior → critical
• Reentrancy (SSTORE after CALL) → high
• External calls during swap/donate → high
• TIMESTAMP/NUMBER dependency (MEV vector) → medium
• Delta capability warnings → info

User-Requested Improvements

• Clear disclaimer that address flags indicate permitted callbacks only, not what the code actually does
• Static analysis caveat: hooks with runtime-only malicious paths (block N threshold, balance check) may appear clean
• Proxy explanation: upgradeable hook verdicts are point-in-time only — implementation can change between scan and interaction

Bug Fixes

• Fixed u64 overflow in address flag parsing (address was 40 hex chars, u64 could only hold 16)
• Added proper fetch_bytecode() function via eth_getCode RPC call
• Added selector field to HookCallback struct and build_selector_map()
• Removed unused tiny-keccak dependency (used only for selector generation)

Chore

• Bumped version to 0.2.0
• Updated README with accurate feature list and roadmap