Prop AMM Teardown
The wall#22 other closed program

Meteora

Eo7WjKq67rjJQSZxS6z3YkapzY3eMj6Xy8X5EQVn5UaBSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 57,955
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:Eo7W…5UaB. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow DPv3mj…2wRhLG · USDC account BEKmHU…kjKiew

print of ELF sha256 f4f830919517d0d4…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
457,247,107
ELF sha256
f4f830919517d0d452faad436ace949507759b4bf08120709ecd71858beec6b1
ELF size
1,429,984 bytes (1.36 MB)
Snapshot taken
2026-11-02 15:30 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

161,384
sBPF instructions in .text
789
functions reached by internal calls
7,152
internal call sites
12
syscalls used

Sections

.text1,335,488
.rodata25,312
.data.rel.ro9,328
.dynamic176
.dynsym360
.dynstr208
.rel.dyn58,176
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0xa7b7825,040
0x8e14024,680
0xbfe1824,448
0x758e024,256
0x5ce4024,152
0x4b3e815,448
0x2791014,280
0x6dda013,888
0x7148813,888
0x8675013,888
0x89e3813,888
0xa003813,888

Strings in .rodata (26)

uNotFoundTimedOut
(bytes
Deadlockdeadlockoperator
Kcalled `Result::unwrap()` on an `Err` valuesrc/accounts/account_loader.rsfrom_bytesfrom_bytes_mut
The given account is not mutableInstruction: SetWhitelistedVault
programs/amm/src/depeg/solido.rsExceed max amplification changesindex out of bounds: the len is
AccountNotAssociatedTokenAccount
Instruction: AddBalanceLiquidityA signer constraint was violatedR
:programs/amm/src/state/config.rsAn owner constraint was violated
5Instruction: EnableOrDisablePoolProgramError caused by account: src/lib.rssrc/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/…
ConstraintHasOneConstraintSignerconnection reset) when slicing `Division by zerometadata_programentity not foundhost unreachablepayer is not setinvalid filenamerange end index . Error Number:
AccountNotSignerPermissionDeniedno storage spacetreasury_token_aAddrNotAvailable0123456789abcdeftreasury_token_bInvalidProgramIdsrc/bits.rsMaxSeedLengthExceededInvalidSeedsIllegalOwnerUnexpected variant index: TryFromInt…
poolcode
fromkind:
userbase1
rent >
programs/amm/src/access_control.rsprograms/amm/src/activation_handler.rsprograms/amm/src/curve/curve_stable_swap.rsprograms/amm/src/curve/curve_type.rsprograms/amm/src/depeg/marinade.rsprograms/amm/src/depeg/spl_stake_po…
programs/amm/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: IdlWri…
Psrc/bn.rssrc/roots.rssrc/token.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/accum.rssrc/extension/mod.rssrc/state.rssrc/instruction.rssrc/state.rs
Sa Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsErrorMaxSeedLengthExceededInvalidSeedsIllegalOwnerCustomInvalidArgumentInvalidIn…
but the index is : { , {
,library/core/src/fmt/num.rs0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394…
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rsattempt to divide by zero
hmg$9e

Instruction sample

12 instructions to this program in 12 recent transactions (11 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
f8c69e91e17587c81115×9 16×224B×11
a9204f8988e84689118×116B×1

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
457,247,107f4f830919517d0d452faad436ace949507759b4bf08120709ecd71858beec6b11.36 MB2026-11-02 15:30 UTC