Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#60 other closed program

VaultLiquidUnstake

2rU1oCHtQ7WJUvy15tKtFvxdYNNSc3id7AzUcjeFSddoSolscan
0.00
USDC in the pot
0
backers
0
attempts
223
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:2rU1…Sddo. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow o15qVM…Td87SK · USDC account 3QYTwF…evTAeF

print of ELF sha256 d34380ae5125b096…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
DhUnAcd5CgwtvaS7ny1Epcgm6rR8zcQbJ1MpKmJHbUsP
Upgrade authority
F3yy3FVpwq9MV321AzALFcDWZp9XBBHbMas3t4AtEtCW
Last deploy slot
419,656,198
ELF sha256
d34380ae5125b096ebd6c518aa89f9614a486d5b8fb00d7d2e62b46250f42296
ELF size
1,044,568 bytes (1020.1 KB)
Snapshot taken
2026-11-02 18:45 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

112,261
sBPF instructions in .text
642
functions reached by internal calls
6,237
internal call sites
14
syscalls used

Sections

.text947,368
.rodata23,903
.data.rel.ro10,560
.dynamic176
.dynsym408
.dynstr272
.rel.dyn60,944
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_epoch_schedule_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x2a5a024,064
0x343e022,880
0x2539021,008
0x9f41017,216
0x89fc016,688
0x4d5d816,296
0x8348814,368
0x78df012,888
0x53ef011,800
0x7540811,576
0x57b2011,296
0x1bae010,960

Strings in .rodata (26)

The given account is not mutablecore/src/unicode/unicode_data.rs
Yindex out of bounds: the len is
AccountNotAssociatedTokenAccount
A signer constraint was violated
An owner constraint was violatedProgramError caused by account: src/lib.rssrc/de/mod.rssrc/de/impls.rscalled `Result::unwrap()` on an `Err` valuesrc/state.rsfailed to write whole bufferfailed to fill whole buffer()a Disp…
Invalid Option representation: . The first byte must be 0 or 1src/internal.rsInvalid enum valueprograms/liquid-unstaker/src/instructions/liquid_unstake_lst.rsRemaining accounts must be a multiple of three
fromkind
userbase
programs/liquid-unstaker/src/instructions/liquid_unstake_stake_account.rsprograms/liquid-unstaker/src/instructions/update.rsStake account info PDA does not belong to pool Stake account has no withdrawable lamports yet …
, bump: metadataborrower (bytes
Deadlocklst_mintdeadlockk
_9programs/liquid-unstaker/src/instructions/create_or_update_token_metadata.rsprograms/liquid-unstaker/src/instructions/liquid_unstake_lst_wrapped.rssol_vaultprograms/liquid-unstaker/src/instructions/withdraw_stake_accou…
programs/liquid-unstaker/src/state.rsprograms/liquid-unstaker/src/fee.rsprograms/liquid-unstaker/src/lp_math.rsprograms/liquid-unstaker/src/fee_flash_loans.rsprograms/liquid-unstaker/src/fee_lp.rsprograms/liquid-unstaker…
ConstraintHasOneConstraintSigneralloc/src/fmt.rsconnection reset) when slicing `metadata_programentity not founduser_lst_accounthost unreachableuser_sol_accountinvalid filenamerange end index . Error Number:
AccountNotSignerPermissionDeniedno storage spaceAddrNotAvailable0123456789abcdefInvalidProgramIdmanager_fee_accountstake_poolstake_pool_validator_liststake_pool_withdraw_authoritystake_pool_manager_fee_accountstake_pool_…
Nprograms/liquid-unstaker/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstru…
src/state.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runner/work/platform-tools/pla…
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rssrc/lib.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsCustom program error: The arguments provided…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnsupported PubkeyErrorsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/home/runner/work/platform-tools/platform-tools/out/rust/li…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `core/src/unicode/printable.rs
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
419,656,198d34380ae5125b096ebd6c518aa89f9614a486d5b8fb00d7d2e62b46250f422961020.1 KB2026-11-02 18:45 UTC