Prop AMM Teardown
The wall#33 other closed program

Hylo Exchange

HYEXCHtHkBagdStcJCp3xbbb9B7sdMdWXFNj6mdsG4hnSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 6,863
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:HYEX…G4hn. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow ANpEN4…ygwpzV · USDC account J5wBdC…bXyWxy

print of ELF sha256 f39cc54f5e9a4721…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
462,249,329
ELF sha256
f39cc54f5e9a472117fee82794f5d116b2068fe4caa00a7a6b29e209ee98d52d
ELF size
1,767,864 bytes (1.69 MB)
Snapshot taken
2026-11-02 17:00 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

191,433
sBPF instructions in .text
1,188
functions reached by internal calls
11,655
internal call sites
14
syscalls used

Sections

.text1,625,528
.rodata37,216
.data.rel.ro13,384
.dynamic176
.dynsym408
.dynstr263
.rel.dyn89,952
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcpy_sol_memmove_sol_memset_sol_set_return_datasol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0xd0c4021,928
0x6de8016,024
0x60d3815,784
0x9242015,592
0x5137815,088
0x695f815,048
0xc4db014,960
0xcc80814,904
0x9b23814,368
0x96ee014,080
0x8a3b013,744
0xbf82013,744

Strings in .rodata (79)

Instruction: RedeemStablecoinExoThe given account is not mutableInstruction: UpdateUsdcRedeemFeeInstruction: UpdateLevercoinFees
index out of bounds: the len is
Instruction: AcceptAddressUpdateAccountNotAssociatedTokenAccount
RefCell already mutably borrowedOracle exponent is out of range.A signer constraint was violatedLST stake pool is not supported.An owner constraint was violatedInstruction: RedeemStablecoinLstInstruction: CancelAddressUp…
library/alloc/src/fmt.rs
programs/hylo-exchange/src/instructions/swap_exo_usdc.rs
programs/hylo-exchange/src/instructions/settle_virtual_stablecoin_exo.rs
programs/hylo-exchange/src/instructions/settle_virtual_stablecoin_usdc.rs
library/alloc/src/string.rs
src/bpf_writer.rs
library/alloc/src/raw_vec/mod.rs
src/instruction.rs
library/core/src/num/flt2dec/strategy/grisu.rs
src/de/mod.rs
src/context.rs
src/state.rs
library/core/src/unicode/printable.rs
src/internal.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rs
programs/hylo-exchange/src/instructions/swap_lst_usdc.rs
programs/hylo-exchange/src/state/lst_registry.rs
library/core/src/num/bignum.rs
programs/hylo-exchange/src/state/hylo.rs
library/core/src/str/mod.rs
src/price_update.rs
src/generated/instructions/create_metadata_account_v3.rs
src/accounts/program.rs
src/tuple_impl.rs
src/common.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/navigate.rs
library/alloc/src/slice.rs
library/core/src/num/flt2dec/strategy/dragon.rs
library/core/src/fmt/mod.rs
programs/hylo-exchange/src/state/address_update_proposal.rs
programs/hylo-exchange/src/state/usdc_pair.rs
src/encode.rs
programs/hylo-exchange/src/state/exo_pair.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/str/mod.rs
src/ser/mod.rs
programs/hylo-exchange/src/events.rs
programs/hylo-exchange/src/lib.rs
programs/hylo-exchange/src/instructions/settle_virtual_stablecoin_lst.rs
library/core/src/num/flt2dec/mod.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec/mod.rs
library/core/src/num/diy_float.rs
-0..mid > lenfailed to fill whole buffer()a Display implementation returned an error unexpectedlyUnexpected length of inputInvalid bool representation: ErrorNot all bytes readMaxSeedLengthExceededInvalidSeedsIllegalOwner…
Invalid Option representation: . The first byte must be 0 or 1called `Result::unwrap()` on an `Err` value
fromkind
userbase
programs/hylo-exchange/src/instructions/accept_address_proposal.rsprograms/hylo-exchange/src/instructions/admin_exo_pair.rsprograms/hylo-exchange/src/instructions/convert_exo_pair.rsmint_authprograms/hylo-exchange/src/in…
>programs/hylo-exchange/src/instructions/mint_levercoin_exo.rsprograms/hylo-exchange/src/instructions/mint_levercoin_lst.rsprograms/hylo-exchange/src/instructions/mint_redeem_usdc.rsusdc_vault_authprograms/hylo-exchange/…
sequencefee_authr
NotFoundTimedOut
0LstToUsd
kproposaltreasury
;ExoToUsdBuyZone1Deadlocklst_mintBuyZone2
exo_pairprograms/hylo-exchange/src/instructions/withdraw_fees.rssettlement_auth
programs/hylo-exchange/src/state/address_update_proposal.rsprograms/hylo-exchange/src/state/exo_pair.rsprograms/hylo-exchange/src/state/hylo.rsprograms/hylo-exchange/src/state/lst_registry.rsprograms/hylo-exchange/src/st…
MinInputOverflowConstraintHasOneConstraintSignerInterpArithmeticRebalanceSwapPnlassertion `left ) when slicing `collateral_vaultNoRedemptionLanemetadata_programLstSolPriceDeltalst_a_vault_authSlippageExceededrange end in…
TotalValueLockedAccountNotSignerPermissionDeniedlst_b_vault_authAddrNotAvailable right` failed: floating point `0123456789abcdefInvalidProgramIdCannot redeem levercoin due to Depeg. NAV would be 0 or lower.Levercoin to s…
|!Instruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: IdlWriteprograms/hylo-excha…
a Display implementation returned an error unexpectedlyError
DepegSellZone2SellZone1NeutralTotalSolCacheDecrementTotalSolCacheIncrementTotalSolCacheOverflowTotalSolCacheUnderflowTotalSolCacheOutdatedLstSolPriceEpochOrderLstSolPriceOutdatedLstSolPriceConversionSolLstPriceConversion…
E/]acalled `Result::unwrap()` on an `Err` valueinvalid value: , expected invalid length an array of length 32called `Result::unwrap()` on an `Err` valueIoInvalidUtf8EncodingInvalidBoolEncodingInvalidCharEncodingInvalidTa…
The arguments provided to a program instruction were invalidAn instruction's data contents was invalidAn account's data contents was invalidAn account's data was too smallAn account's balance was too small to complete th…
Errorcapacity overflowa formatting trait implementation returned an error when the underlying stream did not
assertion failed: d.mant > 0assertion failed: d.minus > 0assertion failed: d.plus > 0assertion failed: buf.len() >= MAX_SIG_DIGITSassertion failed: d.mant.checked_sub(d.minus).is_some()assertion failed: d.mant.checked_ad…
assertion failed: d.mant + d.plus < (1 << 61)assertion failed: !buf.is_empty()assertion failed: d.mant < (1 << 61)
;assertion failed: buf[0] > b'0'assertion failed: parts.len() >= 4.0.-+NaNinf0assertion failed: buf.len() >= maxlenattempt to add with overflowattempt to subtract with overflowattempt to multiply with overflow)..RefCell …
but the index is ==!=matches right` failed
right:
left: : { , {
,0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989900000000000000000…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `
)14:EFIJNOde
INOWY^_
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0attempt to divide by zerorange start index out of range for slice of length slice index starts at but ends at

Instruction sample

24 instructions to this program in 12 recent transactions (24 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
e445a52e51cb9a1d121×1252B×7 102B×4 134B×1
0e0ea31ae0b69f9b718×717B×7
3362dfca0d61b702415×417B×4
ce9cf763ebc7a64f116×135B×1

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
462,249,329f39cc54f5e9a472117fee82794f5d116b2068fe4caa00a7a6b29e209ee98d52d1.69 MB2026-11-02 17:00 UTC