Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#72 other closed program

Heaven

HEAVENoP2qxoeuF8Dj2oT1GHEnu49U5mJYkdeC8BAX2oSolscan
0.00
USDC in the pot
0
backers
0
attempts
1
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:HEAV…AX2o. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 67trHD…7GdRh1 · USDC account 4BZwsV…h22UGw

print of ELF sha256 0e18c5af66c10c7f…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
DuevhUr92TiYhu3dgdMDkHdjsK72fqgNr5er4jkRFRCy
Upgrade authority
3VAxiBzxbxgH4FYfCjGKsGc1oTkJPJN6SiwMaTWaRfuU
Last deploy slot
410,580,266
ELF sha256
0e18c5af66c10c7f8ccadfa915203303895c0fd977f11f8e57b44331cb0720f1
ELF size
1,382,968 bytes (1.32 MB)
Snapshot taken
2026-11-02 19:30 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

148,683
sBPF instructions in .text
852
functions reached by internal calls
6,577
internal call sites
16
syscalls used

Sections

.text1,241,192
.rodata37,459
.data.rel.ro21,384
.dynamic176
.dynsym456
.dynstr288
.rel.dyn81,072
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_set_return_datasol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x5529821,136
0xc065813,904
0x6734813,488
0xdccc812,976
0x7d31812,704
0x51f2812,672
0x73aa811,800
0x61c8811,192
0xbae8810,856
0x5e1b010,808
0x64a3010,520
0xca85010,504

Strings in .rodata (39)

NotFoundTimedOut
receiver
bfilenameB
B (bytes
Deadlockdeadlock
called `Result::unwrap()` on an `Err` valuesrc/accounts/account_loader.rsfrom_bytesfrom_bytes_mut
Invalid protocol swap fee walletThe given account is not mutableInstruction: AddLiquidityProPool
Overflow deposit_token_a_reserveKaminoPriceListRefreshIxNotFoundindex out of bounds: the len is
amount_in must be greater than 0AccountNotAssociatedTokenAccount
Instruction: AdminSetTransferFeeInvalid marinade sol leg accountA signer constraint was violatedFailed to deserialize obligationfz
withdraw_accounts_lending_marketAn owner constraint was violatedDepositing liquidity is disabled
Instruction: SetProtocolSlotFeesOverflow deposit_token_b_reserveProgramError caused by account: Index out of boundssrc/lib.rssrc/extension/mod.rs
src/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/Users/runner/work/platform-tools/plat…
Unexpected length of inputFor portability reasons we do not allow to deserialize NaNs.Invalid bool representation: ErrorTargetAlignmentGreaterAndInputNotAlignedOutputSliceWouldHaveSlopSizeMismatchAlignmentMismatch/Users/…
Invalid fee modeConstraintHasOneTrading volume: Invalid swap taxConstraintSignerSwap is disabledconnection resetassertion `left ) when slicing `Lp tokens lockedentity not foundhost unreachableinvalid filenamerange end in…
AccountNotSignerPermissionDeniedmsol_token_vaultNo fees to claimno storage spacewsol_token_vaultAddrNotAvailable right` failed: 0123456789abcdefdivision by zeroInvalidProgramIdobligation_ownerAnchorErrorProgramErrorSourc…
swapfromkind
userbaseSome <=
lineNone
rent mintMaxSeedLengthExceededInvalidSeedsIllegalOwnererror_nameerror_code_numbererror_msgerror_origincompared_valuesAccountNameTryFromIntErrorValuesPubkeysUnexpected variant index: CustomInvalidArgumentInvalidInstruc…
Cuser_metaprograms/heaven-anchor-amm/src/utils/token_util.rsprograms/heaven-anchor-amm/src/utils/epoch.rsarithmetic operation overflowprotocol_configadmintoken_programpayerlookup_tablecurrent_owneraddress_lookup_programs…
programs/heaven-anchor-amm/src/instructions/mod.rsInvalidLockLiquidityProviderTokenPercentageCannotCreatePoolWithDisabledProtocolConfigVersionInvalidLiquidityProviderTokenLockVaultInvalidUserLiquidityProviderTokenVaultIn…
Hprograms/heaven-anchor-amm/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInst…
src/instruction.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/accum.rs
src/extension/transfer_fee/instruction.rssrc/extension/mod.rssrc/state.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/num/mod.rssrc/instruction.rs
a Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsErrorMaxSeedLengthExceededInvalidSeedsIllegalOwnerCustomInvalidArgumentInvalidIn…
src/encode.rsBufferTooSmallUtf8Errorvalid_up_toerror_lenUnsupported PubkeyErrorsrc/lib.rs
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnable to find a viable program address bump seedcalled `Result::unwrap()` on an `Err` valuesrc/encode.rsTargetAlignmentGreaterAndInputNotAlignedOutputSliceWouldH…
library/core/src/num/flt2dec/strategy/dragon.rsassertion failed: d.mant > 0assertion failed: d.minus > 0assertion failed: d.plus > 0assertion failed: buf.len() >= MAX_SIG_DIGITSassertion failed: d.mant.checked_sub(d.minu…
library/core/src/num/flt2dec/strategy/grisu.rsassertion failed: d.mant + d.plus < (1 << 61)assertion failed: !buf.is_empty()assertion failed: d.mant < (1 << 61)
;library/core/src/num/flt2dec/mod.rsassertion failed: buf[0] > b'0'assertion failed: parts.len() >= 4.0.-+NaNinf0assertion failed: buf.len() >= maxlenattempt to add with overflowattempt to subtract with overflowattempt t…
but the index is ==!=matches right` failed
right:
left: : { , {
,library/core/src/fmt/num.rs0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `library/core/src/str/mod.rslibrary/core/src/unicode/printable.rs
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rslibrary/core/src/num/bignum.rsassertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0attempt to divide by zero

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
410,580,2660e18c5af66c10c7f8ccadfa915203303895c0fd977f11f8e57b44331cb0720f11.32 MB2026-11-02 19:30 UTC