Documentation · 07 / 11
Opcode rules
OpcodeScanner disassembles runtime bytecode on-chain, skipping PUSH immediates and the solc metadata trailer, and refuses:
| Opcode | Byte | Why |
|---|---|---|
| DELEGATECALL | 0xF4 | Runs foreign code in the plugin's own context. |
| CALLCODE | 0xF2 | Legacy form of the same escape. |
| CREATE / CREATE2 | 0xF0 / 0xF5 | Would deploy unscanned code and call it. |
| SELFDESTRUCT | 0xFF | A plugin could vanish mid-lineup. |
CALL and STATICCALL are allowed: the interesting property is who a plugin calls, not that it calls. Code must be under 24,576 bytes. Governance can whitelist a specific codehash after manual review when a data segment trips the linear sweep.
The scan is a necessary condition, not a sufficient one. A clean plugin can still be economically adversarial; bonds, strikes and the Council bound that.