Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#70 other closed program

Carrot

CarrotwivhMpDnm27EHmRLeQ683Z1PufuqEmBZvD282sSolscan
0.00
USDC in the pot
0
backers
0
attempts
1
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:Carr…282s. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow DUiPzA…w4gyh9 · USDC account Es2xGk…p7pKDa

print of ELF sha256 7851859e67794f00…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
D4hrynDhmPDbFBK9UvHo2CbeXs6FMkj6Rn2dwP8PxWdR
Upgrade authority
3eUEKYy7bPqtZ3KyUvCgpXV55v8TfN4xE85NickX6SUM
Last deploy slot
452,706,710
ELF sha256
7851859e67794f00c48d971c46c4ce847baee2172477d75350b773012c876d16
ELF size
2,472,760 bytes (2.36 MB)
Snapshot taken
2026-11-02 20:00 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

288,167
sBPF instructions in .text
2,080
functions reached by internal calls
13,239
internal call sites
13
syscalls used

Sections

.text2,346,408
.rodata23,603
.data.rel.ro12,496
.dynamic176
.dynsym384
.dynstr228
.rel.dyn88,512
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x17d210111,320
0x12a2a022,512
0x9ea7021,752
0x116ef818,392
0x10827816,712
0x1626f016,608
0xef09016,488
0x10331815,752
0xcdc4815,704
0x12298815,688
0x1342f015,688
0xca1c014,976

Strings in .rodata (50)

attempt to add with overflow
The given account is not mutableprograms/carrot/src/utils/mod.rsindex out of bounds: the len is
Instruction: MigrateVaultAccountA signer constraint was violated, last_withdraw_request_shares: assertion failed: idx < CAPACITYAn owner constraint was violatedInstruction: DistributeVaultFeesProgramError caused by accou…
attempt to subtract with overflowfailed to fill whole buffer()a Display implementation returned an error unexpectedly/Users/dmitri/work/git/platform-tools/out/rust/library/alloc/src/string.rs/Users/dmitri/work/git/platfo…
attempt to multiply with overflow
attempt to divide by zeroUnexpected length of inputInvalid bool representation: Errorcalled `Option::unwrap()` on a `None` value/Users/dmitri/work/git/platform-tools/out/rust/library/alloc/src/collections/btree/navigate.…
NotFoundTimedOut
filename (bytes
uwstrategyDeadlockdeadlockStrategyMw
*_IZ_ amount
feedKindfromkind
userbaseSome <=
lineNone
minterror_nameerror_code_numbererror_msgerror_origincompared_valuesAccountNameTryFromIntErrorValuesPubkeysUnexpected variant index: /Users/dmitri/work/git/platform-tools/out/rust/library/core/src/ops/arith.rsMaxSeedLengt…
Invalid Option representation: . The first byte must be 0 or 1WrongSizeInvalidProgramErrorWithOriginprogram_errorCustomInvalidArgumentInvalidInstructionDataInvalidAccountDataAccountDataTooSmallInsufficientFundsIncorrectP…
coin_token_accountasset_token_accountchest_coin_reserveredemption_requestasset_destinationstrategy_asset_token_accountchest_redemption_requestclend_accountclend_bankclend_bank_liquidity_vaultclend_groupclend_program
clend_bank_liquidity_vault_authorityclend_oraclesharesshares_destination
drift_insurance_fund_stakedrift_signerdrift_insurance_fund_vaultdistributorClaimStatusclaim_statusdistributor_token_vaultvault_token_accountmerkle_distributor_programdestinationdrift_perp_marketprograms/carrot/src/instru…
user_claimjuplend_claim_accountuser_statefarm_statekfarms_vaults_authorityrvaultkfarms_rewards_vaulttvaultkfarms_rewards_treasury_vaultscope_priceskfarms_global_configkfarms_programreserve_liquidity_supplyreserve_collate…
reserve_deposit_collateral_atawithdraw_collateral_ataold_authoritynew_authority7Gs9n5FQMeC9XcEhg281bRZ6VHRrCvqp5Yq1j78HkvNareward_vaultSo11111111111111111111111111111111111111112switchboard_on_demand_programSBondMDrcV3K4…
pprograms/carrot/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: Id…
attempt to divide by zerocalled `Option::unwrap()` on a `None` value
integrations/solend-sdk/src/math/decimal.rs
attempt to subtract with overflowintegrations/solend-sdk/src/state/obligation.rsObligation version does not match lending program versionintegrations/solend-sdk/src/state/reserve.rsReserve version does not match lending …
attempt to shift left with overflow
failed to fill whole buffera Display implementation returned an error unexpectedly/Users/dmitri/work/git/platform-tools/out/rust/library/alloc/src/string.rsInvalid bool representation: Error
integrations/merkle-distributor-cpi/src/lib.rsMerkleDistributorattempt to add with overflow
attempt to subtract with overflow
attempt to multiply with overflowsrc/arith.rs
attempt to shift right with overflowsrc/int256.rs
dfailed to fill whole buffera Display implementation returned an error unexpectedly/Users/dmitri/work/git/platform-tools/out/rust/library/alloc/src/string.rsError
integrations/drift-cpi/src/lib.rsInsuranceFundStakefailed to fill whole buffera Display implementation returned an error unexpectedly/Users/dmitri/work/git/platform-tools/out/rust/library/alloc/src/string.rsInvalid bool …
integrations/chest-cpi/src/lib.rsChest
failed to fill whole buffer()a Display implementation returned an error unexpectedly/Users/dmitri/work/git/platform-tools/out/rust/library/alloc/src/string.rsErrorTryFromIntErrorcalled `Result::unwrap()` on an `Err` valu…
attempt to add with overflowsrc/instruction.rssrc/state.rs
attempt to add with overflowsrc/instruction.rs
a Display implementation returned an error unexpectedly/Users/dmitri/work/git/platform-tools/out/rust/library/alloc/src/string.rs
attempt to add with overflowMaxSeedLengthExceededInvalidSeedsIllegalOwnerCustomInvalidArgumentInvalidInstructionDataInvalidAccountDataAccountDataTooSmallInsufficientFundsIncorrectProgramIdMissingRequiredSignatureAccountA…
attempt to multiply with overflow()src/encode.rscalled `Result::unwrap()` on an `Err` valueBufferTooSmallIoInvalidUtf8EncodingInvalidBoolEncodingInvalidCharEncodingInvalidTagEncodingDeserializeAnyNotSupportedSizeLimitSeq…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/entrypoint.rssrc/instruction.rssrc/pubkey.rsSlice must be the same length as a PubkeyUnable to find a viable program address bump seedsrc/rent.rsLength of the…
permission deniedconnection refusednetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a directoryis a directorydirect…
/Users/dmitri/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hashbrown-0.14.2/src/raw/mod.rs
Errorlibrary/alloc/src/raw_vec.rscapacity overflowa formatting trait implementation returned an errorlibrary/alloc/src/fmt.rs
called `Option::unwrap()` on a `None` value)invalid argslibrary/core/src/fmt/mod.rs..BorrowErrorBorrowMutErroralready borrowed: already mutably borrowed: :[panicked at :
but the index is : { , {
]library/core/src/fmt/num.rs0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `library/core/src/str/mod.rslibrary/core/src/unicode/printable.rs
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rs

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
452,706,7107851859e67794f00c48d971c46c4ce847baee2172477d75350b773012c876d162.36 MB2026-11-02 20:00 UTC