Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#20 other closed program

Denali

DNL1tgEj3nJovHw9jtyCCQD3arssCJzkmpDizknwzey4Solscan
0.00
USDC in the pot
0
backers
0
attempts
est. 75,604
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:DNL1…zey4. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 8gVQSs…wQ6zC5 · USDC account 44BX6S…Zj91dh

print of ELF sha256 82e71b87f999fd36…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
5VRHDAkbVTcnANNiiVMK6QMyhYLaB44YkQJ3vBkGVXi5
Upgrade authority
EpKvr3GkNLTwJQzgrbPpBzp7GTYk8tmZjBkYrHNY22dR
Last deploy slot
454,575,418
ELF sha256
82e71b87f999fd36bfb448767e049691d92be192373699ec446f0e99ba7cbad2
ELF size
569,968 bytes (556.6 KB)
Snapshot taken
2026-11-02 16:00 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

59,840
sBPF instructions in .text
475
functions reached by internal calls
2,880
internal call sites
14
syscalls used

Sections

.text506,816
.rodata19,799
.data.rel.ro8,816
.dynamic176
.dynsym408
.dynstr261
.rel.dyn32,752
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_last_restart_slotsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x2842016,080
0x10fa014,928
0x1d24813,456
0x2df3813,112
0x3131013,112
0x21af811,832
0x68ee89,232
0xc7689,056
0x591987,768
0x6e0307,392
0x569d87,200
0x80987,168

Strings in .rodata (24)

capacity overflow
The given account is not mutablecore/src/unicode/unicode_data.rs
Instruction: CancelAdminTransferindex out of bounds: the len is
AccountNotAssociatedTokenAccount
Oracle account data wrong lengthA signer constraint was violated
An owner constraint was violatedProgramError caused by account: src/extension/mod.rssrc/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platfo…
fromkind
baseSome <= .
programs/prop-amm/src/instructions/deposit_liquidity.rsprograms/prop-amm/src/instructions/disable_side.rsprograms/prop-amm/src/instructions/initialize_market.rsprograms/prop-amm/src/instructions/pause.rsprograms/prop-amm…
(bytes
Deadlockpause_v2quote_v1/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rs__event_authorityprograms/prop-amm/src/instructions/withdraw_liquidity.rsadmin_auth_v1admin_params_…
oracle_authorityConstraintHasOneConstraintSigneralloc/src/fmt.rs) when slicing `Market is pausedQ64 mul overflowrange end index . Error Number:
AccountNotSignermarket_authorityPermissionDeniedQ64 sub overflowsrc/math/u256.rsAddrNotAvailable0123456789abcdefQ64 add overflowInvalidProgramIdOracle is staleOracle has expiredConfig sequence mismatchNo pending config t…
programs/prop-amm/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: I…
src/quote.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/num/mod.rssrc/extension/mod.rs
src/instruction.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/accum.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/extension/mod.rs
src/state.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runner/work/platform-tools/pla…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnsupported PubkeyErrorsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/home/runner/work/platform-tools/platform-tools/out/rust/li…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

14 instructions to this program in 7 recent transactions (14 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
68688356a1bdb4d8714×725B×7
e445a52e51cb9a1d71×7105B×7

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
454,575,41882e71b87f999fd36bfb448767e049691d92be192373699ec446f0e99ba7cbad2556.6 KB2026-11-02 16:00 UTC