Then I traced the JUMPDEST that should be unreachable — but a storage collision could reanimate it.
When you compile a Solidity contract, the optimizer doesn't just remove unreachable paths — it buries them. But "unreachable" at compile time is not "unreachable at runtime" if the EVM state can change. 0xdeadcode
I recently dissected a contract that had this: Then I traced the JUMPDEST that should be