Prop AMM Teardown
The wall#15 other closed program

Deriverse

DRVSpZ2YUYYKgZP8XtLhAGtT1zYSCKzeHfb4DgRnrgqDSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 297,521
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:DRVS…rgqD. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow Fu2pBb…EeHyqt · USDC account Ebsxfh…mekJeA

print of ELF sha256 95a1ad817421ac77…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
446,965,384
ELF sha256
95a1ad817421ac7747a00e0448d4966f16600e507f3fecf949ad42826ac90b3c
ELF size
1,421,056 bytes (1.36 MB)
Snapshot taken
2026-11-02 15:29 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

154,008
sBPF instructions in .text
684
functions reached by internal calls
8,254
internal call sites
14
syscalls used

Sections

.text1,284,296
.rodata45,200
.data.rel.ro16,368
.dynamic176
.dynsym408
.dynstr240
.rel.dyn73,408
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_compute_units_sol_log_datasol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_panic_sol_sha256sol_try_find_program_address

sBPF flags 1, static syscalls resolved by murmur3 hash

Largest functions

Offset in .textBytes
0xf3600147,672
0x230e024,944
0xaa96819,640
0x6e59819,440
0x61b6019,368
0xb3ae016,896
0x9bfa015,816
0x5e0a015,040
0x403e812,880
0x4b0d012,776
0x4544811,600
0x7953011,536

Strings in .rodata (100)

src/lib.rs
src/program/processor/new_holder_account.rs
src/program/processor/swap.rs
src/state/community.rs
src/state/token.rs
src/program/processor/upgrade_to_perp.rs
library/alloc/src/fmt.rs
src/state/candles.rs
src/program/processor/vm_direct_withdraw.rs
src/state/instrument.rs
src/program/perp/perp_engine.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/map/entry.rs
library/alloc/src/string.rs
src/program/processor/dividends_allocation.rs
src/program/processor/set_instr_ready_for_perp_upgrade.rs
src/program/instruction_data.rs
src/state/types.rs
library/alloc/src/raw_vec/mod.rs
src/program/settings.rs
src/instruction.rs
src/program/processor/vm_add_withdrawal_address.rs
src/program/processor/vm_init_withdraw_finalize.rs
src/value/index.rs
library/core/src/num/flt2dec/strategy/grisu.rs
src/program/spot/engine.rs
src/program/processor/deposit.rs
src/program/processor/new_base_crncy.rs
src/program/processor/vm_add_kamino.rs
src/extension/mod.rs
src/state/spots/spot_infos.rs
src/state.rs
src/errors.rs
library/core/src/unicode/printable.rs
src/syscalls.rs
src/internal.rs
src/program/processor/vm_change_list.rs
src/state/client_community.rs
src/state/spots/spot_account_header.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rs
src/program/kamino/mod.rs
src/program/processor/new_instrument.rs
src/program/processor/new_root_account.rs
src/state/client_primary.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs
library/core/src/num/bignum.rs
src/program/processor/kamino_change_position.rs
library/core/src/str/mod.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/node.rs
src/program/processor/buy_market_seat.rs
src/program/processor/new_operator.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/navigate.rs
src/state/client_primary_account_header.rs
library/core/src/num/flt2dec/strategy/dragon.rs
library/core/src/fmt/mod.rs
src/state/perps/perp_infos.rs
src/program/helper.rs
src/program/processor/withdraw.rs
src/state/perps/perp_trade_header.rs
src/encode.rs
src/program/processor/withdraw_swap_fees.rs
src/state/holder.rs
library/core/src/num/flt2dec/mod.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec/mod.rs
src/value/ser.rs
library/core/src/num/diy_float.rs
Unable to find a viable program address bump seedmid > lenInvalidOffset
operation_amountexpected_addressAllocator failedconnection resetassertion `left ) when slicing `
, max bid price PerpClientInfos2entity not foundPerpClientInfos3Invalid program host unreachableinvalid filenameCandle with tag range end index PerpClientInfos4IndexOutOfBoundsInvalid PDA for
PerpClientInfos5 < allowed time DoubleAllocationPermissionDeniedNoAvailableSlotsmax_instr_amountno storage spaceAddrNotAvailable right` failed: SpotClientInfos20123456789abcdefInvalid leverageAlignmentErrorInsufficientMe…
src/program/create_client_account.rs
src/program/perp/perp_context.rsPerp clients count must not be 0
src/state/perps/perp_accounts.rs
src/program/processor/spot_lp.rs
Couldnt find withdrawal address can't be a base crncy. Reason: index out of bounds: the len is src/program/processor/deposit.rsInvalid new expiration time for
RefCell already mutably borrowedsrc/program/processor/airdrop.rsImpossible to suspend instrumentsrc/program/spot/spot_context.rssrc/state/spots/spot_accounts.rsInvalid tokens decimals amount: src/program/helper.rs_ndxnts…
=src/program/spot/engine.rssrc/program/spot/orders.rs`'
src/state/candles.rssrc/state/client_community.rssrc/state/client_primary_account_header.rssrc/state/client_vm_account_header.rssrc/state/community.rssrc/state/holder.rssrc/state/perps/perp_trade_header.rssrc/state/root.…
Unable to find a viable program address bump seedcalled `Result::unwrap()` on an `Err` valueIoInvalidUtf8EncodingInvalidBoolEncodingInvalidCharEncodingInvalidTagEncodingDeserializeAnyNotSupportedSizeLimitSequenceMustHave…
+3<*;: accounts provided, but only are supported
TokenOriginalNotFoundTimedOut, line: varianceMarketIdasset_idlocationold_timeid_rightnew_time (bytes ZeroFeesdiscountIO ErrorDeadlockPerpMapsdeadlockinstr_idorder_idSpotMapsexpectedfee_rateVmClient accountfinal_psWithdra…
0123456789abcdefuuuuuuuubtnufruuuuuuuuuuuuuuuuuu
a Display implementation returned an error unexpectedlyErrorassertion failed: edge.height == self.height - 1assertion failed: src.len() == dst.len()assertion failed: edge.height == self.node.height - 1EOF while parsing a…
: fmt errorcannot access key in JSON booleannumberstringarrayobject
ih0sUr
7Cxl2i5n
wqBv/?
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899OptionsBidAskLimitMa…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzCustom program error:
The arguments provided to a program instruction were invalidAn instruction's data contents was invalidAn account's data contents was invalidAn account's data was too smallAn account's balance was too small to complete th…
Errorcapacity overflowa formatting trait implementation returned an error when the underlying stream did not
assertion failed: d.mant > 0assertion failed: d.minus > 0assertion failed: d.plus > 0assertion failed: buf.len() >= MAX_SIG_DIGITSassertion failed: d.mant.checked_sub(d.minus).is_some()assertion failed: d.mant.checked_ad…
assertion failed: d.mant + d.plus < (1 << 61)assertion failed: !buf.is_empty()assertion failed: d.mant < (1 << 61)
;assertion failed: buf[0] > b'0'assertion failed: parts.len() >= 4.0.-+NaNinf0assertion failed: buf.len() >= maxlenattempt to divide with overflow)..RefCell already borrowedcalled `Option::unwrap()` on a `None` value but…
right:
left: : { , {
,0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989900000000000000000…
)14:EFIJNOde
INOWY^_
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0attempt to divide by zerorange start index out of range for slice of length slice index starts at but ends at

Instruction sample

15 instructions to this program in 15 recent transactions (5 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
1a00000000000000415×432B×4
1a01000000000000214×1 15×132B×2
58a400020000ffff114×1544B×1
58d600020000ffff114×1544B×1
58a700020000ffff114×1544B×1
58a300020000ffff114×1544B×1
582a00020000ffff114×1544B×1
582900020000ffff114×1544B×1
582800020000ffff114×1544B×1
582700020000ffff114×1544B×1
58b600020000ffff114×1544B×1

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
446,965,38495a1ad817421ac7747a00e0448d4966f16600e507f3fecf949ad42826ac90b3c1.36 MB2026-11-02 15:29 UTC