Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#80 other closed program

Virtuals

5U3EU2ubXtK84QcRjWVmYt9RaDyA8gKxdUrPFXmZyakiSolscan
0.00
USDC in the pot
0
backers
0
attempts
0
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:5U3E…yaki. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 5WHNfo…PHNPHG · USDC account HAuKaN…mKgaGZ

print of ELF sha256 4fb0c085f7a1afb7…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
FEcgdr8rd9FuBbJAD3WWvejN738Z3nhQPFqbMSkzyJY4
Upgrade authority
8nkmk4srVWABZe6ZfR1eqBMn1RAnAqFhLPtSWUiVRT14
Last deploy slot
319,985,732
ELF sha256
4fb0c085f7a1afb74e2445c70c46c6744b51acc7879d0e86a61c9460342b3a25
ELF size
573,976 bytes (560.5 KB)
Snapshot taken
2026-11-02 20:45 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

62,784
sBPF instructions in .text
483
functions reached by internal calls
3,207
internal call sites
12
syscalls used

Sections

.text519,000
.rodata18,487
.data.rel.ro6,624
.dynamic176
.dynsym360
.dynstr214
.rel.dyn28,176
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x2833820,136
0x2d7d819,968
0x1174014,432
0x32a8813,880
0x1fb1011,904
0x2553810,744
0x22c389,792
0x19c988,136
0x17c408,096
0x43b488,008
0x6c6707,400
0x1d6006,808

Strings in .rodata (24)

The given account is not mutableindex out of bounds: the len is
AccountNotAssociatedTokenAccount
Symbol too long. Max length = 10A signer constraint was violatedAn owner constraint was violatedProgramError caused by account: src/sysvar/mod.rssrc/de/mod.rsmid > lenfailed to fill whole buffer()a Display implementation…
src/encode_32.rsmeteora_deployerConstraintHasOneConstraintSignerconnection reset) when slicing `metadata_programentity not foundhost unreachableinvalid filenamerange end index . Error Number: Instruction: Buy
CreateIdempotentAccountNotSignerPermissionDeniedno storage spaceAddrNotAvailable0123456789abcdefDataTypeMismatchInvalidProgramId1
called `Result::unwrap()` on an `Err` valueCustomInvalidArgumentInvalidInstructionDataInvalidAccountDataAccountDataTooSmallInsufficientFundsIncorrectProgramIdMissingRequiredSignatureAccountAlreadyInitializedUninitialized…
New name:
Virtuals vault already initializedToken vault already initializedNo virtuals fee to distributeWidthdrawing virtuals to platformNo token fee to distribute token to platformWithdrawing virtuals to creator token to creato…
poolcode
Kindfromkind
userbaseSome <=
rent VPool has graduatedprograms/virtuals-program/src/contexts/initialize.rsvpool_virtuals_atavpool_token_atapayertoken_mintvirtuals_mintsystem_programassociated_token_programtoken_programcreatorcreator_virtuals_atap…
platformmetadataGv
t (bytes Deadlockdeadlocktoken_metadatauser_virtuals_atauser_token_atameteora_deployer_virtuals_atameteora_deployer_token_atalock_escrowescrow_vaultlp_mintvirtuals_vaulttoken_vaultvirtuals_token_vaulttoken_token_vaultvir…
(Kprograms/virtuals-program/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInst…
a Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsErrorCurve Arithmetic OverflowAsset Ratio ExceededInvalid SupplyZero Amountsrc/d…
AssociatedTokenAccountInstruction::CreateIdempotent`CreateRecoverNestedsrc/instruction.rssrc/state.rsa Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/librar…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/entrypoint.rssrc/instruction.rsUnsupported PubkeyErrorsrc/pubkey.rsUnable to find a viable program address bump seedsrc/rent.rsLength of the seed is too long …
but the index is : { , {
,]library/core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939…
library/core/src/str/pattern.rs[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `library/core/src/str/mod.rslibrary/core/src/unicode/printable.rs
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rs

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
319,985,7324fb0c085f7a1afb74e2445c70c46c6744b51acc7879d0e86a61c9460342b3a25560.5 KB2026-11-02 20:45 UTC