Prop AMM Teardown
The wall#66 other closed program

Trends

CURVEmPpijXDTNdqrA9PGP1io2rkgiVXH26xdXVGLLfzSolscan
0.00
USDC in the pot
0
backers
0
attempts
11
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:CURV…LLfz. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 7Yqn43…L1Yf37 · USDC account EiJMAX…wo5n6a

print of ELF sha256 467ab615d0d4a10a…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
416,564,720
ELF sha256
467ab615d0d4a10a030a874dedb4e0c194cddc1cf9a0fec77280a06181236cba
ELF size
583,224 bytes (569.6 KB)
Snapshot taken
2026-11-02 19:45 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

62,747
sBPF instructions in .text
455
functions reached by internal calls
3,470
internal call sites
10
syscalls used

Sections

.text526,680
.rodata18,671
.data.rel.ro7,200
.dynamic176
.dynsym312
.dynstr174
.rel.dyn29,072
.shstrtab72

Syscalls

abortsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x421a817,688
0x133c816,664
0x334d815,392
0xadc014,720
0x269b814,392
0x2e37813,736
0x3719813,272
0x3a61013,272
0x3e32812,672
0xe83011,312
0x2413010,376
0x1e27810,184

Strings in .rodata (26)

NotFoundTimedOut
Pausable (bytes
YyDeadlockCpiGuardcalled `Result::unwrap()` on an `Err` valuesrc/accounts/account_loader.rscapacity overflow
The given account is not mutablecore/src/unicode/unicode_data.rs
Yindex out of bounds: the len is
AccountNotAssociatedTokenAccount
A signer constraint was violated
An owner constraint was violated
ProgramError caused by account: src/extension/mod.rssrc/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc…
AccountNotSignerPermissionDeniedTokenGroupMemberAddrNotAvailable0123456789abcdefInvalidProgramIdConfidentialMintBurnScaledUiAmountPausableAccountfrom_bytesfrom_bytes_mut>src/internal.rs
/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rs__event_authorityprograms/bonding-curve/src/instructions/admin/raydium_creator_fee.rs
poolcode
Kindfromkind
pool_authorityprograms/bonding-curve/src/instructions/swap.rsprograms/bonding-curve/src/instructions/migrate.rsraydium_poolprograms/bonding-curve/src/state/pool.rsInvalid zero amountMath overflow / underflowInsufficient …
Giprograms/bonding-curve/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruc…
src/instruction.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/accum.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/extension/mod.rs
src/state.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/instruction.rs
src/state.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/ser/helpers.rssrc/instruction.rscalled `Result::unwrap()` on an `Err` value/Users/runner/work/platform-tools/platform-…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `core/src/unicode/printable.rs
)14:EFIJNOde
INOWY^_
number not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
416,564,720467ab615d0d4a10a030a874dedb4e0c194cddc1cf9a0fec77280a06181236cba569.6 KB2026-11-02 19:45 UTC