Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#59 other closed program

Huma

HumaXepHnjaRCpjYTokxY4UtaJcmx41prQ8cxGmFC5fnSolscan
0.00
USDC in the pot
0
backers
0
attempts
235
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:Huma…C5fn. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 9MExrN…eukBtB · USDC account 8qDKEG…e2d8i1

print of ELF sha256 c74e82486deee0ae…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
TBMC1J7B6Q2qZxeozxmfAkk4gDBiVQ34nm5KEBFUtzy
Upgrade authority
D6GEJYVtQGVrLVj1QSZbxWW73NnKJyHEzMBDAtCzraaF
Last deploy slot
426,862,901
ELF sha256
c74e82486deee0ae0a4dadc2df39c8e5c77b6e31b087664b2d9ac2d3594c7d8d
ELF size
1,757,976 bytes (1.68 MB)
Snapshot taken
2026-11-02 18:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

193,956
sBPF instructions in .text
975
functions reached by internal calls
10,113
internal call sites
15
syscalls used

Sections

.text1,636,128
.rodata28,291
.data.rel.ro12,216
.dynamic176
.dynsym432
.dynstr268
.rel.dyn79,520
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_set_return_datasol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0xe825022,272
0xa3ec021,048
0x38c3020,896
0xaa05819,544
0x85d0817,032
0x8c9a816,360
0xbae1816,344
0x223f815,632
0xafb7015,440
0xfa73015,144
0x9aa6014,896
0x6577014,888

Strings in .rodata (38)

InsufficientBalanceForWithdrawalinstant_withdrawal_lender_configThe given account is not mutablecore/src/unicode/unicode_data.rs
Instruction: CloseLenderAccountsStrategyWithdrawalAmountMismatchmanual_strategy_manager_proposal
YInvalidBasisPointHigherThan10000index out of bounds: the len is
AccountNotAssociatedTokenAccount
)FInvalidNumberOfRemainingAccountsA signer constraint was violatedInsufficientBalanceForDeploymentInstruction: AddDeploymentTarget
An owner constraint was violatedProgramError caused by account: src/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/li…
fromkind
/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/num/mod.rsUnexpected length of inputFor portability reasons we do not allow to deserialize NaNs./home/runner/work/platform-tools/platform-tools/ou…
Invalid Option representation: . The first byte must be 0 or 1src/context.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rsprograms/permissionless/src/common/common_utils…
redemption_request.id <= redemption_queue.last_request_idprograms/permissionless/src/mode/instructions/close_lender_accounts.rsprograms/permissionless/src/mode/instructions/instant_withdraw.rsprograms/permissionless/src/…
?ConstraintHasOneConstraintSigneralloc/src/fmt.rs) when slicing `
?ZeroSharesMintedpayer is not setrange end index . Error Number:
AccountNotSignerPermissionDeniedAddrNotAvailable0123456789abcdefProtocolIsPauseddeployment_statedivision by zeroInvalidProgramIdsource_mode_mintInvalidStrategyProgramTargetAccountMismatchRequiredAccountsNotProvidedPoolOw…
FNotFoundTimedOut
metadataproposal (bytes V]Q
Deadlock
signerpool_configpool_stateprograms/permissionless/src/investment/instructions/add_async_deployment_target.rssystem_programasync_deployment_configasync_deployment_stateprograms/permissionless/src/investment/instructions/…
\programs/permissionless/src/lib.rs
Instruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: IdlWriteInstruction: IdlSetAu…
src/instruction.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rs
src/state.rssrc/naive/date/mod.rssrc/naive/internals.rs
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
HJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJ
JLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJLJL
NPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNP
PRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPRPR
TVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTVTV
VXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVXVX
XZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZXZ
bdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbd/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnsupported PubkeyErrorsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/home/runner/work/platform-tools/platform-tools/out/rust/li…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `core/src/unicode/printable.rs
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
426,862,901c74e82486deee0ae0a4dadc2df39c8e5c77b6e31b087664b2d9ac2d3594c7d8d1.68 MB2026-11-02 18:15 UTC