Prop AMM Teardown
The wall#65 other closed program

Saber (Decimals)

DecZY86MU5Gj7kppfUCEmd4LbXXuyZH1yHaP2NTqdiZBSolscan
0.00
USDC in the pot
0
backers
0
attempts
21
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:DecZ…diZB. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow FFkUyf…aSZnBH · USDC account G2SEE2…du6mPR

print of ELF sha256 2d0f6e341290fba2…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
114,149,094
ELF sha256
2d0f6e341290fba2df6f2225183e7826bd9a386c80344d0f756b24e48e7cce30
ELF size
264,816 bytes (258.6 KB)
Snapshot taken
2026-11-02 19:30 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

28,111
sBPF instructions in .text
502
functions reached by internal calls
1,682
internal call sites
9
syscalls used

Sections

.text231,824
.dynsym288
.gnu.hash36
.hash104
.dynstr159
.rel.dyn18,016
.rodata9,177
.eh_frame188
.data.rel.ro3,704
.dynamic208
.shstrtab92

Syscalls

abortsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x10b2812,056
0x294f06,248
0xac084,832
0x159084,264
0x220684,248
0xc3304,152
0xfbd83,920
0x260783,368
0x13a403,296
0x334783,264
0x14d802,952
0x169b82,896

Strings in .rodata (19)

called `COption::unwrap()` on a `COption::None` value/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.9.2/src/program_option.rs/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.…
Error thrown at ) when slicing `range end index KeysMustNotMatch/root/.cargo/registry/src/github.com-1ecc6299db9ec823/base64-0.13.0/src/encode.rsInvalid UTF8
(bytes
anchor
None: self.wrapper_underlying_tokens.owner != self.wrapperLeft: Right: library/core/src/slice/memchr.rsindex out of bounds: the len is programs/add-decimals/src/lib.rslibrary/core/src/fmt/builders.rs:self.wrapper_underly…
Instruction: IdlCreateAccountInstruction: IdlCreateBufferInstruction: IdlWriteInstruction: IdlSetAuthorityInstruction: IdlSetBufferInstruction: ProcessActionInstruction: InitializeWrapperInstruction: DepositInstruction: …
/root/.cargo/registry/src/github.com-1ecc6299db9ec823/spl-token-3.2.0/src/state.rs
/root/.cargo/registry/src/github.com-1ecc6299db9ec823/anchor-lang-0.19.0/src/idl.rsanchor:idlUnexpected variant index: /root/.cargo/registry/src/github.com-1ecc6299db9ec823/base64-0.13.0/src/encode.rsusize overflow when …
/root/.cargo/registry/src/github.com-1ecc6299db9ec823/bs58-0.4.0/src/encode.rsalready mutably borrowedcalled `Result::unwrap()` on an `Err` value/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.9.2/…
IO Error: Failed to borrow a reference to account data, already borrowedThe instruction expected additional account keysAn attempt to operate on an account that hasn't been initializedAn initialize instruction was sent t…
BufferTooSmallError: memory allocation failed, out of memorylibrary/alloc/src/raw_vec.rscapacity overflowFromUtf8Errorbyteserrora formatting trait implementation returned an errorlibrary/alloc/src/fmt.rslibrary/core/src/…
)EIWde
INOWY^_
)14:EFIJNOde\
..called `Option::unwrap()` on a `None` value[...]byte index is out of bounds of ``begin <= end ( is not a char boundary; it is inside ) of `BorrowError
:: Utf8Errorvalid_up_toerror_len
library/core/src/unicode/unicode_data.rs
library/core/src/fmt/mod.rsError
but the index is {

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
114,149,0942d0f6e341290fba2df6f2225183e7826bd9a386c80344d0f756b24e48e7cce30258.6 KB2026-11-02 19:30 UTC