Prop AMM Teardown
The wall#10 other closed program

BinaryFi

B72M6nyCLFgWiJtAN4naUTminMiTmyGcEqQHXwVeRdhtSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 649,624
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:B72M…Rdht. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 3RQetP…sHyJrC · USDC account 63yCXQ…ye6cTu

print of ELF sha256 9d61a5ab098e39fc…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
464,929,161
ELF sha256
9d61a5ab098e39fc1b0f2e31b71aead9f7a1079c62f5747aca04c0210ce9d95f
ELF size
431,488 bytes (421.4 KB)
Snapshot taken
2026-11-03 16:01 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

48,398
sBPF instructions in .text
237
functions reached by internal calls
659
internal call sites
10
syscalls used

Sections

.text408,768
.rodata9,792
.data.rel.ro2,016
.dynamic176
.dynsym312
.dynstr173
.rel.dyn9,312
.shstrtab72

Syscalls

abortsol_get_sysvarsol_invoke_signed_csol_log_sol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_set_return_datasol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x25be077,328
0x4236039,272
0x4fe1015,384
0x3b59810,440
0x394188,576
0x3e5088,336
0x20e487,576
0x40307,528
0x405987,248
0x2487,216
0x4e4186,648
0x118d85,968

Strings in .rodata (36)

Unable to find a viable program address bump seedlibrary/alloc/src/fmt.rs
program/src/instructions/update_config_remove_from_whitelist.rs
library/alloc/src/string.rs
program/src/tx_patterns/router_abi/jupiter_v6.rs
program/src/swap/math.rs
program/src/tx_patterns/handlers/endpoint_sweep.rs
program/src/events/mod.rs
program/src/instructions/update_levels.rs
library/alloc/src/raw_vec/mod.rs
program/src/instructions/migrate_config.rs
program/src/tx_patterns/instruction_view/mod.rs
src/de/mod.rs
program/src/instructions/update_config_remove_from_blacklist.rs
src/extension/mod.rs
program/src/instructions/update_config_add_to_whitelist.rs
src/state.rs
library/core/src/unicode/printable.rs
src/syscalls.rs
src/internal.rs
program/src/instructions/update_config_add_to_blacklist.rs
program/src/tx_patterns/handlers/known_dex_cpi.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rs
library/core/src/str/mod.rs
program/src/tx_patterns/router_abi/mod.rs
program/src/utils/orderbook.rs
library/core/src/fmt/mod.rs
program/src/state/pool_state.rs
Yindex out of bounds: the len is
failed to fill whole bufferfailed to write whole bufferdest is out of boundsInvalid bool representation: Not all bytes readInvalid Option representation: . The first byte must be 0 or 1from_bytesfrom_bytes_mut>configpool…
Eassertion failed: index < self.len
) when slicing `range end index
0123456789abcdefTargetAlignmentGreaterAndInputNotAlignedOutputSliceWouldHaveSlopSizeMismatchAlignmentMismatchUnexpected length of inputError: memory allocation failed, out of memoryErrorcapacity overflowa formatting trai…
.. (bytes called `Option::unwrap()` on a `None` value but the index is : 0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717…
)14:EFIJNOde
INOWY^_
attempt to divide by zerorange start index out of range for slice of length slice index starts at but ends at

Instruction sample

16 instructions to this program in 16 recent transactions (0 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
049f84289a1b000016×1458B×1
049e84289a1b000017×1690B×1
049d84289a1b0000116×1428B×1
04a483289a1b000013×1135B×1
04a283289a1b000017×1578B×1
04a383289a1b000016×1749B×1
04a183289a1b000016×1396B×1
04a083289a1b000017×1722B×1
049f83289a1b000017×1302B×1
049e83289a1b0000111×1645B×1
04ea77e69c1b000015×1259B×1
04e977e69c1b0000116×1411B×1
04ec76e69c1b000016×1313B×1
04ea76e69c1b0000115×1520B×1
04eb76e69c1b000013×122B×1
04ec75e69c1b000016×1233B×1

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
464,929,1619d61a5ab098e39fc1b0f2e31b71aead9f7a1079c62f5747aca04c0210ce9d95f421.4 KB2026-11-03 16:01 UTC
462,918,052d127c1ade4f7af4e9904502423ba0db064050abf986d2f8629069e445169a6d7386.8 KB2026-11-02 18:30 UTC