Prop AMM Teardown
The wall#74 other closed program

Aldrin V2

CURVGoZn8zycx6FXwwevgBTB2gVvdbGTEpvMJDbgs2t4Solscan
0.00
USDC in the pot
0
backers
0
attempts
0
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:CURV…s2t4. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow AdpZUG…6pmvqA · USDC account Dz4Ch7…uDXri7

print of ELF sha256 c067c6a981257b7a…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
441,200,340
ELF sha256
c067c6a981257b7a2550d8ff39e621375c534edee47aeb616131648d118a0df7
ELF size
535,048 bytes (522.5 KB)
Snapshot taken
2026-11-02 20:16 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

62,190
sBPF instructions in .text
761
functions reached by internal calls
3,860
internal call sites
8
syscalls used

Sections

.text504,592
.rodata7,935
.data.rel.ro3,864
.dynamic176
.dynsym264
.dynstr139
.rel.dyn17,136
.shstrtab72

Syscalls

abortsol_invoke_signed_rustsol_log_sol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x57e609,224
0x314487,768
0x396307,008
0x252c86,488
0x6adb06,248
0x3f8186,136
0x36be85,808
0x333185,440
0x231105,048
0x26ca05,040
0x382985,008
0x297c84,936

Strings in .rodata (23)

/root/.cargo/registry/src/github.com-1ecc6299db9ec823/anchor-lang-0.12.0/src/program_account.rs/root/.cargo/registry/src/github.com-1ecc6299db9ec823/anchor-lang-0.12.0/src/loader.rs
/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.7.8/src/sysvar/mod.rsfailed to write whole buffera Display implementation returned an error unexpectedly/home/runner/work/bpf-tools/bpf-tools/out/rus…
attempt to divide by zeroalready mutably borrowedcalled `Option::unwrap()` on a `None` valuecalled `Result::unwrap()` on an `Err` value/root/.cargo/registry/src/github.com-1ecc6299db9ec823/base64-0.13.0/src/encode.rsInva…
(bytes
{DeadlockNotFoundTimedOut
from_bytesfrom_bytes_mutsrc/baskets.rssrc/farming.rs
Psrc/lib.rs
0Unexpected variant index:
called `Option::unwrap()` on a `None` value/root/.cargo/registry/src/github.com-1ecc6299db9ec823/spl-math-0.1.0/src/precise_number.rs/root/.cargo/registry/src/github.com-1ecc6299db9ec823/spl-math-0.1.0/src/uint.rs
attempt to divide by zero
/root/.cargo/registry/src/github.com-1ecc6299db9ec823/spl-token-3.1.1/src/state.rs
/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.7.8/src/sysvar/mod.rsfailed to write whole buffer
PermissionDenied) when slicing `AddrNotAvailablealready borrowedrange end index already mutably borrowedcalled `Option::unwrap()` on a `None` value/root/.cargo/registry/src/github.com-1ecc6299db9ec823/anchor-lang-0.12.0/…
already mutably borrowed/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.7.8/src/account_info.rs/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.7.8/src/entrypoint.rs/root/.car…
IO Error: Failed to borrow a reference to account data, already borrowedThe instruction expected additional account keysAn attempt to operate on an account that hasn't been initializedAn initialize instruction was sent t…
>/root/.cargo/registry/src/github.com-1ecc6299db9ec823/bytemuck-1.7.0/src/lib.rsAlignmentMismatchSizeMismatchOutputSliceWouldHaveSlopTargetAlignmentGreaterAndInputNotAligned Some <= kindcodeKindNoneErrormessageOsError…
library/alloc/src/raw_vec.rscapacity overflowa formatting trait implementation returned an errorlibrary/alloc/src/fmt.rsbyteserrorFromUtf8Error
)..BorrowErrorBorrowMutErrorindex out of bounds: the len is but the index is called `Option::unwrap()` on a `None` value:panicked at '', `: {
[]0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899range start inde…
library/core/src/str/mod.rs[...]byte index is out of bounds of `begin <= end ( is not a char boundary; it is inside ) of `library/core/src/unicode/printable.rs
INOWY^_
)14:EFIJNOde\
library/core/src/unicode/unicode_data.rsErrorUtf8Errorvalid_up_toerror_len

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
441,200,340c067c6a981257b7a2550d8ff39e621375c534edee47aeb616131648d118a0df7522.5 KB2026-11-02 20:16 UTC