Prop AMM Teardown
The wall#2 other closed program

Pump.fun

6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6PSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 14,163,934
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:6EF8…wF6P. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow DFQbKP…adinDX · USDC account FDUbSv…gBWkT6

print of ELF sha256 05249b60f8ddf02a…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
458,921,440
ELF sha256
05249b60f8ddf02a53d0f8a43980fde40cce33f73526355b4ef08e292279819f
ELF size
1,934,800 bytes (1.85 MB)
Snapshot taken
2026-11-02 15:10 UTC
OtterSec verify
no verified build
Corpus
1,000 real mainnet instructions from 41 transactions, slots 464,554,359 to 464,554,361, 287 account states, plus 10,000 fuzzed variants at replay · sha256 1ae46101522fca15…

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

215,873
sBPF instructions in .text
1,170
functions reached by internal calls
10,861
internal call sites
16
syscalls used

Sections

.text1,792,208
.rodata32,031
.data.rel.ro10,352
.dynamic176
.dynsym456
.dynstr288
.rel.dyn98,352
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_set_return_datasol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x15726026,896
0xcf63024,312
0xd59d023,608
0xb645823,440
0xa425823,360
0xe618822,520
0x13f7f019,448
0x5b75017,368
0x1e6a015,576
0x13b89815,480
0xac5a814,992
0x16e6d014,624

Strings in .rodata (34)

capacity overflow/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/vec/spec_from_iter_nested.rsInstruction: CollectCreatorFeeV2
\>[^The given account is not mutableQuoteMintNotEligibleForWhitelist
Yindex out of bounds: the len is
FeeBasisPointsGreaterThanMaximumAccountNotAssociatedTokenAccount
)FShare bps must be greater than 0Nothing to sweep for fee bucket Instruction: AddQuoteControlMintBuybackFeeRecipientNotAuthorizedA signer constraint was violated
Instruction: UpdateBuybackConfigAn owner constraint was violated
E/]aHolder-reward coins are disabledProgramError caused by account: account
fromkind`
userbase
rent N
src/lib.rssrc/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsfalseUnexpected length of inp…
pump_ammmetadatadata.len (bytes user_ataV
Deadlock
deadlocklamports
`CpiGuardend_timePermanentDelegateNonTransferableAccountTransferHookTransferHookAccountConfidentialTransferFeeConfigConfidentialTransferFeeAmountMetadataPointerTokenMetadataGroupPointerTokenGroupGroupMemberPointer
ConstraintHasOneseconds_in_a_dayEndTimeInThePastConstraintSignerconnection resetassertion `left ) when slicing `Sell zero amountDayInActiveRangeInvalidQuotePoolDivision by zeroentity not foundbonding-curve-v2DisabledWith…
AccountNotSignerPermissionDeniedTokenGroupMemberno storage spaceAddrNotAvailable right` failed: source_authority0123456789abcdefDataTypeMismatchInvalidProgramIdConfidentialMintBurnAccountprograms/pump/src/admin_set_idl_a…
programs/pump/src/migrate_v2.rsprograms/pump/src/multi_hop_curve_swap.rsmulti_hop_swapprograms/pump/src/pump_quote.rsprograms/pump/src/quote_control/state.rsprograms/pump/src/quote_control/update_quote_control_mints.rspr…
cFeeConfigGlobalConfigSharingConfig
|pGlobal
Instruction: IdlCreateAccountInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: IdlWriteInstruction: IdlSetAuthorityIns…
src/de/mod.rsfailed to fill whole buffera Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsUnexpected length of inputInvalid bool re…
src/extension/transfer_fee/instruction.rs
src/state.rssrc/instruction.rs
src/state.rsfailed to write whole buffer/home/runner/work/platform-tools/platform-tools/out/rust/library/std/src/io/mod.rssrc/instruction.rscalled `Result::unwrap()` on an `Err` valuefailed to fill whole buffera Display …
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzProgramDerivedAddressUnable to find a viable program address bump seedcalled `Result::unwrap()` on an `Err` valuesrc/encode.rspermission deniedconnection refusedn…
but the index is ==!=matches right` failed
right:
left: : { , {
,]library/core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `library/core/src/str/mod.rslibrary/core/src/unicode/printable.rs
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rs

Instruction sample

14 instructions to this program in 6 recent transactions (11 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
e445a52e51cb9a1d71×788B×2 104B×2 399B×1 413B×2
623691610246ad2b245×2148B×2
e1f7501ed5b38488217×225B×2
f945a4da9667548a24×28B×2
1c92de7726c469d5117×124B×1

Full kit from the judge

Computed by the judge machine on 2026-11-02 16:00 UTC.

215,873
instructions disassembled
1,027
functions
1,000
real instructions in the corpus
V0
sBPF version

Download the disassembly (217,927 lines, sha256 38c789dcb0ba98e0…) · corpus bundle

Syscalls and call counts

abort ×154sol_create_program_address ×1sol_get_clock_sysvar ×1sol_get_rent_sysvar ×1sol_get_return_data ×1sol_invoke_signed_rust ×1sol_log_ ×99sol_log_data ×1sol_log_pubkey ×1sol_memcmp_ ×1sol_memcpy_ ×2sol_memmove_ ×1sol_memset_ ×2sol_set_return_data ×1sol_sha256 ×1sol_try_find_program_address ×1

Instruction patterns over the corpus

Per discriminator: count, account and data sizes, then each account slot as signer (s) and writable (w).

DiscriminatorCountAccountsData bytesSigner and writable slots
e1f7501ed5b384886821724 to 25-- -- -- -- -- -w -w -w sw -w -w -w -- -w -- -- --
5df6823ce7e940b2722624-- -- -- -- -- -- -w -w -w -w -w -w -w sw -w -w -w -w -- -w -w -- -- -- -- --
c2ab1c46684d5b2f552724-- -- -- -- -- -- -w -w -w -w -w -w -w sw -w -w -w -w -- -- -w -w -- -- -- -- --
20f6bf3408c949ba51138sw -- -- -- -- -- -- -w -w -w -w -- --
e445a52e51cb9a1d51188 to 413--
1416567bc61cdb842658-w -w -- -- --
38fc74089edfcd5f161825-- -w -- -w -w -w sw -- -- -w -- -- -- -w -- -- -- -w
cf118af20422133812108-w -w -w -w -- -- -- -- -- --
b817ee6167c5d33d112724-- -- -- -- -- -- -w -w -w -w -w -w -w sw -w -w -w -w -- -- -w -w -- -- -- -- --
33e685a4017f83ad91624-- -w -- -w -w -w sw -- -w -- -- -- -- -- -- -w
1c92de7726c469d561724-- -- -- -- -- -w -w -w sw -w -w -w -- -w -- -- --
66063d1201daebea41825-- -w -- -w -w -w -w -- -- -w -- -- -w -w -- -- -- -w
e19a7516d756f66721821-- -- -- sw -w -w -w -w -- -- -- -- -- -- -- -w -w -w
5e06ca73ff60e8b7168sw sw -w -- -- --

Account owners and sizes

Tokenz…pPxuEb107 accounts170B×52 179B×26 416B×3
111111…11111172 accounts0B×72
6EF8rr…BEwF6P68 accounts137B×40 166B×26 1088B×1
Tokenk…3VQ5DA23 accounts165B×22 82B×1
pfeeUx…6VojVZ12 accounts208B×8 1024B×3 4097B×1
MAyhSm…47MD4e3 accounts74B×3
pAMMBa…FMfXEA2 accounts949B×1 301B×1

CPI targets

Tokenz…pPxuEb113 calls
pfeeUx…6VojVZ34 calls
111111…1111114 calls

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
458,921,44005249b60f8ddf02a53d0f8a43980fde40cce33f73526355b4ef08e292279819f1.85 MB2026-11-02 15:10 UTC