Prop AMM Teardown
The wall#56 other closed program

Invariant

HyaB3W9q6XdA5xwpU4XnSZV94htfmbmqJXZcEbRaJuttSolscan
0.00
USDC in the pot
0
backers
0
attempts
534
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:HyaB…Jutt. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow vnez3m…YVBKwE · USDC account Anasdc…MGp1PG

print of ELF sha256 b5149b0ce7755fbd…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
343,244,916
ELF sha256
b5149b0ce7755fbd3b08bbd145fda2d5e49b954d1ff25606600dd65141c42183
ELF size
733,720 bytes (716.5 KB)
Snapshot taken
2026-11-02 19:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

82,209
sBPF instructions in .text
1,083
functions reached by internal calls
5,329
internal call sites
12
syscalls used

Sections

.text672,832
.rodata12,695
.data.rel.ro8,528
.dynamic176
.dynsym360
.dynstr220
.rel.dyn37,968
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x3997028,472
0x5643012,096
0x44ee011,696
0x85ae89,224
0x42b889,040
0x545e87,744
0x357987,688
0x30f087,640
0x1efe07,456
0x8cc287,432
0x32ce87,376
0x5fdb07,184

Strings in .rodata (27)

src/accounts/account_loader.rs
src/accounts/program.rsinternal error: entered unreachable codesrc/sysvar/mod.rsfailed to write whole buffera Display implementation returned an error unexpectedly/home/runner/work/bpf-tools/bpf-tools/out/rust/library/al…
attempt to calculate the remainder with a divisor of zero
PermissionDeniedInvalidListOwnerfloating point `InvalidAuthority) when slicing `AddrNotAvailableInvalidTickIndexalready borrowedrange end index already mutably borrowedcalled `Option::unwrap()` on a `None` valuecalled `R…
(bytes positionfee_tiersequenceDeadlockNotFoundTimedOut
integer overflow when casting to u64integer overflow when casting to u128
attempt to divide by zeroprograms/invariant/src/decimals.rsINVARIANT: CLAIM FEEprograms/invariant/src/instructions/claim_fee.rsInvariantINVARIANT: CREATE FEE TIERprograms/invariant/src/instructions/create_fee_tier.rsINVA…
Instruction: IdlCreateAccountInstruction: IdlCreateBufferInstruction: IdlWriteInstruction: IdlSetAuthorityInstruction: IdlSetBufferInstruction: CreateStateInstruction: CreateFeeTierInstruction: CreatePoolInstruction: Swa…
src/state.rs
variant index 0 <= i < 4failed to write whole buffera Display implementation returned an error unexpectedly/home/runner/work/bpf-tools/bpf-tools/out/rust/library/alloc/src/string.rscalled `Option::unwrap()` on a `None` v…
src/encode.rsalready mutably borrowedcalled `Result::unwrap()` on an `Err` valuesrc/account_info.rssrc/entrypoint.rsUnsupported PubkeyErrorsrc/pubkey.rsProgramDerivedAddressUnable to find a viable program address bump se…
MaxAccountsDataSizeExceededIllegalOwnerUnsupportedSysvarAccountNotRentExemptBorshIoErrorInvalidReallocInvalidSeedsMaxSeedLengthExceededCustomAccountBorrowFailedNotEnoughAccountKeysUninitializedAccountAccountAlreadyInitia…
Account data reallocation was invalidIO Error: Failed to borrow a reference to account data, already borrowedThe instruction expected additional account keysAn attempt to operate on an account that hasn't been initialize…
BufferTooSmall
byte arraystruct varianttuple variantnewtype variantunit variantmapnewtype structOption valueunit valuestring character ``integer `boolean `
programs/invariant/decimal/src/uint.rs
attempt to divide by zeroErrormessageOsError: memory allocation failed, out of memoryUnsupportedCustomerrorUncategorizedOtherOutOfMemoryUnexpectedEofInterruptedArgumentListTooLongInvalidFilenameTooManyLinksCrossesDevices…
library/alloc/src/raw_vec.rscapacity overflowa formatting trait implementation returned an errorlibrary/alloc/src/fmt.rsbyteserrorFromUtf8Error
assertion failed: edelta >= 0library/core/src/num/diy_float.rs
library/core/src/num/flt2dec/strategy/dragon.rsassertion failed: d.mant > 0assertion failed: d.minus > 0assertion failed: d.plus > 0assertion failed: d.mant.checked_add(d.plus).is_some()assertion failed: d.mant.checked_s…
library/core/src/num/flt2dec/strategy/grisu.rsassertion failed: d.mant + d.plus < (1 << 61)
attempt to divide by zeroassertion failed: !buf.is_empty()assertion failed: d.mant < (1 << 61)library/core/src/num/flt2dec/mod.rsassertion failed: buf[0] > b\'0\'assertion failed: parts.len() >= 40..-+0infNaNassertion fa…
[]0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798990000000000000000…
library/core/src/str/mod.rs[...]byte index is out of bounds of `begin <= end ( is not a char boundary; it is inside ) of `library/core/src/unicode/printable.rs
INOWY^_
)14:EFIJNOde\
library/core/src/unicode/unicode_data.rslibrary/core/src/num/bignum.rsassertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0TryFromIntErrorErrorUtf8Errorvalid_up_toerror_len

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
343,244,916b5149b0ce7755fbd3b08bbd145fda2d5e49b954d1ff25606600dd65141c42183716.5 KB2026-11-02 19:15 UTC