Prop AMM Teardown
The wall#73 other closed program

Trench

8ZoPDsvLWXthQaZz6aJJEWNFBZKk2ePuygi6LHT7F7HhSolscan
0.00
USDC in the pot
0
backers
0
attempts
1
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:8ZoP…F7Hh. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow BKZf4q…HsPaNn · USDC account A7qfyr…oRrE3U

print of ELF sha256 ecdbb69dfd0adc95…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
438,654,184
ELF sha256
ecdbb69dfd0adc957a906df87e823f54be7843bef106cec04e3ac19a5936a4ec
ELF size
1,498,088 bytes (1.43 MB)
Snapshot taken
2026-11-02 20:45 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

165,113
sBPF instructions in .text
800
functions reached by internal calls
8,697
internal call sites
13
syscalls used

Sections

.text1,389,400
.rodata23,523
.data.rel.ro9,936
.dynamic176
.dynsym384
.dynstr235
.rel.dyn73,488
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x3208831,184
0xee7a821,960
0xb8c5820,792
0x6eb5020,192
0x95f0019,928
0x884b819,624
0x746e018,200
0xde73818,144
0xf4c4817,608
0xc9a5015,384
0xd14c813,960
0xcd71013,248

Strings in .rodata (30)

capacity overflow
The given account is not mutablecore/src/unicode/unicode_data.rsInstruction: UpdateRevenueConfig
sInvalid referrer profile accountInstruction: ClaimCreatorRewards
Yindex out of bounds: the len is
AccountNotAssociatedTokenAccount
)FInstruction: SetupCreatorRevenueInstruction: WhitelistLaunchPairMigration staging PDA is invalidInstruction: InitializeReferralsA signer constraint was violated
Oracle confidence exceeds config
An owner constraint was violatedInstruction: ClaimTraderCashbackProgramError caused by account: src/lib.rssrc/extension/mod.rs
src/de/mod.rsfailed to write whole bufferfailed to fill whole buffer()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runne…
Invalid Option representation: . The first byte must be 0 or 1
poolcode
fromkind
userbase
programs/trench-program/src/curve.rsprograms/trench-program/src/instructions/buy.rsbonding_curve
NotFoundTimedOutprotocol
executormetadata_
s (bytes
Deadlock
`__event_authorityprograms/trench-program/src/instructions/claim_creator_rewards.rsprograms/trench-program/src/instructions/claim_referral_rewards.rsprograms/trench-program/src/instructions/claim_trader_cashback.rslaunch…
ConstraintHasOneConstraintSigneralloc/src/fmt.rsreferrer_profile) when slicing `range end index . Error Number: Instruction: Buy
AccountNotSignerPermissionDeniedAddrNotAvailable0123456789abcdefcreator_cooldownmigration_configInvalidProgramIdprograms/trench-program/src/instructions/migrate.rsraydium_poolmigration_sol_stagingprograms/trench-program/…
programs/trench-program/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruct…
src/state.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runner/work/platform-tools/pla…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `core/src/unicode/printable.rs
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
438,654,184ecdbb69dfd0adc957a906df87e823f54be7843bef106cec04e3ac19a5936a4ec1.43 MB2026-11-02 20:45 UTC