Prop AMM Teardown
The wall#18 other closed program

Hadron

HADRoNbLovyqhCsocfYQYB7QdfCAAinN9HTePvBCVDQ8Solscan
0.00
USDC in the pot
0
backers
0
attempts
est. 205,323
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:HADR…VDQ8. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 2K6ibC…3fjF4Q · USDC account 87918s…djdBYX

print of ELF sha256 16c8b301828ed1e5…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
427,502,351
ELF sha256
16c8b301828ed1e51a574706ddecd0b0e946580a0b33216f884f9f061b4a5f9e
ELF size
288,640 bytes (281.9 KB)
Snapshot taken
2026-11-02 15:29 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

32,573
sBPF instructions in .text
410
functions reached by internal calls
1,124
internal call sites
10
syscalls used

Sections

.text268,280
.rodata2,692
.data.rel.ro2,264
.dynamic176
.dynsym312
.dynstr180
.rel.dyn13,792
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_sysvarsol_invoke_signed_csol_log_sol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x1d9015,176
0x358707,968
0x394d86,872
0x3f5e05,216
0x347004,464
0x384184,288
0x1ce284,144
0x332483,952
0x58d83,408
0x1bfa83,368
0x1f9583,064
0x3b3f02,960

Strings in .rodata (8)

hadron-quote/src/math.rssrc/logger.rsUnable to find a viable program address bump seedsrc/syscalls.rs
drawdown trip site=swap sum_bps=
Yindex out of bounds: the len is
fail=risk-monotonicity-post-add
dest is out of boundsCustomInvalidArgumentInvalidInstructionDataInvalidAccountDataAccountDataTooSmallInsufficientFundsIncorrectProgramIdMissingRequiredSignatureAccountAlreadyInitializedUninitializedAccountNotEnoughAccoun…
range end index division by zeroarithmetic operation overflowUnsupported AddressErrorsrc/error.rs) but the index is : , ,
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

14 instructions to this program in 9 recent transactions (7 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
05fc8c010000000013×117B×1
05bc8d010000000013×117B×1
054d93010000000013×117B×1
055296010000000013×117B×1
05dca9010000000013×117B×1
05bc81010000000013×117B×1
0300c09c8c010000119×126B×1
03004f581e0a0000119×126B×1
03010c01243f0100119×126B×1
03004b10fc010000116×126B×1
0a33787fa1a1010013×125B×1
03013f0400000000119×126B×1
0301500400000000119×126B×1
0301c3d800000000119×126B×1

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
427,502,35116c8b301828ed1e51a574706ddecd0b0e946580a0b33216f884f9f061b4a5f9e281.9 KB2026-11-02 15:29 UTC
Hadron HADR…VDQ8 | Prop AMM Teardown Engine