Prop AMM Teardown
The wall#1 prop AMM

BisonFi

BiSoNHVpsVZW2F7rx2eQ59yQwKxzU5NvBcmKshCSUypiSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 16,941,176
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:BiSo…Uypi. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 73Mcpb…tatKfc · USDC account 2ATLTw…xLRU1o

print of ELF sha256 1277d92c7f159ffb…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
464,563,291
ELF sha256
1277d92c7f159ffb18b9d77b409e7260acff53a3f0679a76e9496be9563f3008
ELF size
229,808 bytes (224.4 KB)
Snapshot taken
2026-11-02 21:15 UTC
OtterSec verify
no verified build
Corpus
1,000 real mainnet instructions from 416 transactions, slots 464,556,864 to 464,556,916, 358 account states, plus 10,000 fuzzed variants at replay · sha256 74815fa36263b0c9…

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

26,133
sBPF instructions in .text
121
functions reached by internal calls
697
internal call sites
16
syscalls used

Sections

.rodata8,008
.text221,624

Syscalls

abortsol_create_program_addresssol_get_stack_heightsol_get_sysvarsol_invoke_signed_csol_keccak256sol_log_sol_log_64_sol_log_datasol_memcpy_sol_memset_sol_panic_sol_secp256k1_recoversol_set_return_datasol_sha256sol_try_find_program_address

sBPF flags 3, static syscalls resolved by murmur3 hash

Largest functions

Offset in .textBytes
0x13877,640
0x1b2b037,128
0x2efe89,336
0x2c5985,416
0x349005,096
0x2dac03,408
0x149783,304
0x250483,128
0x25dc03,008
0x325282,816
0x295482,800
0x275a02,736

Strings in .rodata (42)

ProgramDerivedAddressUnable to find a viable program address bump seed
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz
yinventoryBC1BC2BC3BC46362securitizeRFQ v3: market tick required, returning 0RFQ v3: No tick inventory data, returning 0RFQ v3: Arithmetic overflow, returning 0RFQ v3: Division error, returning 0RFQ v3: Division by zero,…
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899attempt to divide by…
dark-amm/program/src/pricing_v3.rs
/home/svc_labubu/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/pinocchio-0.9.3/src/pubkey.rs
dark-amm/program/src/instructions/batch_clock.rs
/home/svc_labubu/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/pinocchio-0.9.3/src/sysvars/instructions.rs
dark-amm/program/src/state.rs
dark-amm/program/src/instructions/mod.rs
dark-amm/program/src/cpi_guard.rs
dark-amm/program/src/instructions/init_common.rs
dark-amm/program/src/instructions/init_pool_v3.rs
dark-amm/program/src/instructions/book_reserves.rs
dark-amm/program/src/instructions/reserve_transfer.rs
dark-amm/program/src/instructions/securitize_vault.rs
dark-amm/program/src/instructions/deposit_inventory.rs
dark-amm/program/src/instructions/set_fee_config_v3.rs
dark-amm/program/src/instructions/withdraw_inventory.rs
dark-amm/program/src/instructions/update_oracle_lean_batch.rs
dark-amm/program/src/instructions/swap.rs
dark-amm/program/src/instructions/deposit.rs
dark-amm/program/src/instructions/swap_v3.rs
dark-amm/program/src/instructions/withdraw.rs
dark-amm/program/src/instructions/token2022.rs
common-program/src/pricing.rs
/data/svc_labubu/home/.rustup/toolchains/nightly-2026-08-24-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/num/mod.rs
common-program/src/u256.rs
/home/svc_labubu/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/pinocchio-0.9.3/src/account_info.rs
/home/svc_labubu/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/pinocchio-tkn-0.2.2/src/state/mod.rs
/home/svc_labubu/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/solana-compiler-builtins-0.1.0/src/fp.rs
/data/svc_labubu/home/.rustup/toolchains/nightly-2026-08-24-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/traits/accum.rs
/data/svc_labubu/home/.rustup/toolchains/nightly-2026-08-24-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/mod.rs
index out of bounds: the len is
but the index is
range start index
" out of range for slice of length
slice index starts at
but ends at
range end index
RFQ v3: Zero amount, returning 0RFQ v3: Pool paused, returning 0
LRS0bookpool

Instruction sample

14 instructions to this program in 16 recent transactions (14 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
073efc6c9c000000610×619B×6
07605af405000000210×219B×2
0790648700000000110×119B×1
0762794b76000000110×119B×1
076c5a390b000000110×119B×1
0780209b3b000000110×119B×1
02b9793700000000113×118B×1
0263bd9648000000110×118B×1

Full kit from the judge

Computed by the judge machine on 2026-11-02 16:09 UTC.

25,954
instructions disassembled
88
functions
1,000
real instructions in the corpus
V3
sBPF version

Download the disassembly (26,130 lines, sha256 2b01fe0b5f319928…) · corpus bundle

Syscalls and call counts

abort ×1sol_create_program_address ×2sol_get_last_restart_slot ×1sol_get_stack_height ×2sol_get_sysvar ×9sol_invoke_signed_c ×8sol_keccak256 ×1sol_log_ ×12sol_log_64_ ×10sol_log_data ×2sol_memcpy_ ×1sol_memset_ ×1sol_panic_ ×1sol_secp256k1_recover ×1sol_set_return_data ×2sol_sha256 ×1sol_try_find_program_address ×5

Instruction patterns over the corpus

Per discriminator: count, account and data sizes, then each account slot as signer (s) and writable (w).

DiscriminatorCountAccountsData bytesSigner and writable slots
0205e033ee000000131018sw -w -w -w -w -w -- -- -- --
02807c780d00000091018sw -w -w -w -w -w -- -- -- --
02fc1af5ba010000810 to 1318sw -w -w -w -w -w -- -- -- --
07524e2a0b00000051019sw -w -w -w -w -w -- -- -- --
075dbc2b0b00000051019sw -w -w -w -w -w -- -- -- --
141e24e4da2b46e44597sw -- -w -w -w
07b7e9250b00000041019sw -w -w -w -w -w -- -- -- --
07221d310b00000041019sw -w -w -w -w -w -- -- -- --
146af842702d46e44597sw -- -w -w -w
142fd3107c2d46e44597sw -- -w -w -w
02e028196d02000041018sw -w -w -w -w -w -- -- -- --
077cbd3d0b00000041019sw -w -w -w -w -w -- -- -- --
148e049bde2b46e43597sw -- -w -w -w
10e6001a001a000032474sw -w

Account owners and sizes

Tokenk…3VQ5DA249 accounts165B×243 82B×6
111111…11111199 accounts0B×99
BiSoNH…CSUypi6 accounts2048B×6
tickUc…ULWY6N1 accounts88B×1
T1TANp…aNXvGT1 accounts9B×1
Vote11…1111111 accounts3762B×1
Sysvar…1111111 accounts40B×1

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
464,563,2911277d92c7f159ffb18b9d77b409e7260acff53a3f0679a76e9496be9563f3008224.4 KB2026-11-02 21:15 UTC
462,921,807aebe7418bb465aae2e3b97fc2d3ff0adaef767cf6770f5e3ed2bed461bc4ec3f222.9 KB2026-11-02 15:07 UTC