Prop AMM Teardown
The wall#35 other closed program

Mercurial

MERLuDFBMmsHnsBPZw2sDQZHvXFMwp8EdjudcU2HKkySolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 5,957
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:MERL…HKky. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow HvwZ6w…DvwjMG · USDC account G51eP5…QezRND

print of ELF sha256 44bae35cb7e8c5bd…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
100,141,975
ELF sha256
44bae35cb7e8c5bd829145fd29f7433651ea26956cef9799082074fdbd510305
ELF size
199,592 bytes (194.9 KB)
Snapshot taken
2026-11-02 16:30 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

21,916
sBPF instructions in .text
285
functions reached by internal calls
899
internal call sites
5
syscalls used

Sections

.text179,408
.dynsym192
.gnu.hash36
.hash72
.dynstr110
.rel.dyn9,488
.rodata6,146
.eh_frame156
.data.rel.ro2,656
.dynamic208
.shstrtab92

Syscalls

abortsol_create_program_addresssol_get_rent_sysvarsol_invoke_signed_rustsol_log_

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x115807,512
0x1de086,264
0xe6905,392
0xb7a84,800
0x2aab04,536
0xa4f04,480
0x4f804,280
0x40083,960
0x9403,752
0x13ff83,616
0x8f503,528
0x109183,096

Strings in .rodata (12)

Error: UnsupportedSysvarError: AccountNotRentExemptError: BorshIoErrorError: InvalidSeedsError: MaxSeedLengthExceededError: AccountBorrowFailedError: NotEnoughAccountKeysError: UninitializedAccountError: AccountAlreadyIn…
src/processor.rs) when slicing `already borrowedrange end index already mutably borrowed/Users/runner/work/bpf-tools/bpf-tools/out/rust/library/core/src/slice/mod.rsassertion failed: mid <= self.len()called `Option::unwr…
src/curve.rsTotal iteration: GetFeeAmounts: {"amounts": }GetFeeAmount: {"amount": , "index": Error: Pool token decimals not equal precision factorError: Admin token account frozenError: No admin tokensError: Add liquidit…
attempt to divide by zero/Users/tengsiongong/.cargo/registry/src/github.com-1ecc6299db9ec823/spl-math-0.1.0/src/uint.rs
already mutably borrowed/Users/tengsiongong/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.6.8/src/account_info.rs/Users/tengsiongong/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.6.8…
called `Option::unwrap()` on a `None` valuelibrary/core/src/unicode/printable.rs
)EIWde
INOWY^_
)14:EFIJNOde\
BorrowErrorBorrowMutErrorcalled `Option::unwrap()` on a `None` value: [...]byte index is out of bounds of ``begin <= end ( <= is not a char boundary; it is inside (bytes ) of `library/core/src/unicode/unicode_data…
Error,
but the index is range start index out of range for slice of length slice index starts at but ends at source slice length () does not match destination slice length ()

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
100,141,97544bae35cb7e8c5bd829145fd29f7433651ea26956cef9799082074fdbd510305194.9 KB2026-11-02 16:30 UTC