Prop AMM Teardown
The wall#7 other closed program

Archer

Archer8kgiavM61GyusMzaaS2ft5sALtNsD1HxkUPMhySolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 827,586
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:Arch…PMhy. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow HPMySC…L8228X · USDC account omwZ57…47cevM

print of ELF sha256 faa555154ae9cabf…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
460,513,991
ELF sha256
faa555154ae9cabfe89e7b11f5ffda8741e8d4a9af6dd05820af288ba126958a
ELF size
330,864 bytes (323.1 KB)
Snapshot taken
2026-11-02 15:11 UTC
OtterSec verify
no verified build · on-chain hash d0eeaa1609cacaf3…
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

36,408
sBPF instructions in .text
301
functions reached by internal calls
1,267
internal call sites
14
syscalls used

Sections

.text305,904
.rodata7,642
.data.rel.ro3,592
.dynamic176
.dynsym432
.dynstr272
.rel.dyn11,904
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_last_restart_slotsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x1e08814,232
0x3265013,104
0x17da89,992
0x3ee87,360
0x3d3e06,544
0x2ebf86,128
0x280785,856
0x1cac85,568
0x492e05,216
0xcd085,200
0x5fb05,136
0x218204,384

Strings in .rodata (60)

+3<*;:dest is out of boundssrc/entrypoint/mod.rs
src/lib.rs
program/src/state/maker_book.rs
library/alloc/src/fmt.rs
program/src/processor/maker/close_maker_book.rs
program/src/processor/matching_engine/utils/aggregator.rs
library/alloc/src/raw_vec/mod.rs
(os error
slice index starts at
but ends at
src/extension/mod.rs
start byte index
& is not a char boundary; it is inside
(bytes
index out of bounds: the len is
but the index is
src/state.rs
is out of bounds of `
library/core/src/unicode/printable.rs
program/src/processor/maker/maker_withdraw_funds.rs
program/src/processor/matching_engine/swap.rs
range end index
" out of range for slice of length
program/src/units.rs
library/core/src/fmt/mod.rs
range start index
end byte index
program/src/processor/maker/update_book_limit.rs
program/src/state/market_state.rs
program/src/utils/validators.rs
program/src/utils/spl.rs
program/src/processor/maker/maker_deposit_funds.rs
src/ser/mod.rs
program/src/state/maker_registry.rs
begin > end (
) when slicing `
Invalid associated token program
RefCell already mutably borrowed__event_authority
event:SyncFillEventselfcodeKindkindSomeNone treadfimaker_registrymarketNotFoundTimedOutoverflowDeadlockdeadlockInvalid token mint ownerOwner not Archer programIncorrect token accountInvalid token programInvalid system…
Archer Exchange
project_url
https://archer.exchange
contacts
email:dhrumil@archer.exchange
policy
https://github.com/ballista-tech/archer-sdk/blob/master/SECURITY.md
preferred_languages
source_code
https://github.com/ballista-tech/archer-sdk
auditors
contact@osec.io
called `Result::unwrap()` on an `Err` valueIoInvalidUtf8EncodingInvalidBoolEncodingInvalidCharEncodingInvalidTagEncodingDeserializeAnyNotSupportedSizeLimitSequenceMustHaveLengthCustomUtf8Errorvalid_up_toerror_lenUnable t…
0123456789ABCDEFconnection resetentity not foundhost unreachableinvalid filenamePermissionDeniedno storage spaceAddrNotAvailable0123456789abcdefpermission deniedconnection refusednetwork unreachableconnection abortednot …
capacity overflowa formatting trait implementation returned an error when the underlying stream did notError
}), }[...]called `Option::unwrap()` on a `None` value00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828…
)14:EFIJNOde
INOWY^_
no7=?BESgu
_..0xpanicked at :
RefCell already borrowed

This program embeds a security.txt; its contacts are the place to report anything found while reading it.

Instruction sample

13 instructions to this program in 13 recent transactions (10 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
0ffa000000000000215×219B×2
0f20030000000000215×219B×2
0f68090000000000112×119B×1
0ffede0534000000113×119B×1
0fd6fe4e38000000113×119B×1
0f86010000000000117×119B×1
0fe6000000000000117×119B×1
0f84030000000000116×119B×1
0f8dfa9111000000112×119B×1
2400e5020000000016×186B×1
2400f4060000000016×161B×1

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
460,513,991faa555154ae9cabfe89e7b11f5ffda8741e8d4a9af6dd05820af288ba126958a323.1 KB2026-11-02 15:11 UTC