Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#11 other closed program

Quantum

QuaNtZsgYRe5Z9Bk4LZ4cTD9tbkVoyCNf1R2BN9bBDvSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 600,834
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:QuaN…bBDv. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow CSGjWW…8KeERh · USDC account 2T6fyj…pPFiAV

print of ELF sha256 594ddd559a0f05d7…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
7mcuRHpxz7umw9qi11ZybbiDtQu9AjWMb563Yrnam6BW
Upgrade authority
qtSTQb8FwK27pGSJMUXE3vqAN8doEVWAbvSxUPQhCCg
Last deploy slot
464,985,056
ELF sha256
594ddd559a0f05d72e5e0746671aa1846e414c3f4f5f0185687fbbc156bb1e73
ELF size
150,528 bytes (147.0 KB)
Snapshot taken
2026-11-03 22:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

16,133
sBPF instructions in .text
166
functions reached by internal calls
718
internal call sites
10
syscalls used

Sections

.text133,256
.rodata5,975
.data.rel.ro1,464
.dynamic176
.dynsym312
.dynstr180
.rel.dyn8,224
.shstrtab72

Syscalls

abortsol_get_rent_sysvarsol_get_return_datasol_get_sysvarsol_invoke_signed_csol_log_sol_memcmp_sol_memcpy_sol_memset_sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0xbfb011,320
0x161988,088
0x1e6705,216
0x12df85,192
0x97f83,344
0xa9482,792
0x7c602,728
0x1f282,496
0x1b5482,392
0x8b082,384
0x3ab82,344
0x158d82,240

Strings in .rodata (12)

core/src/unicode/unicode_data.rs
Yindex out of bounds: the len is
failed to fill whole buffer/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsUnable to f…
) when slicing `src/processor.rsrange end index 0123456789abcdefconfigpool <= vault_avault_bwthrdn
kxSqU@
\IXF_R
FAFTsrc/state.rssrc/token.rs** PANICKED **
/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError: memory allocation failed, out of memorycapacity overflow).. (bytes called `Option::unwrap()` on a `None` value but the index is :…
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
out of range for slice of length slice index starts at but ends at

Instruction sample

13 instructions to this program in 31 recent transactions (13 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
07b8314102000000110×118B×1
0711270000000000110×118B×1
0710270000000000110×118B×1
0768d1b808000000110×118B×1
0737611600000000110×118B×1
07a8b98c02000000110×118B×1
070fa54600000000110×118B×1
07bd6a3103000000110×118B×1
07d6683300000000110×118B×1
07a80a9501000000110×118B×1
07be737313000000110×118B×1
0763000000000000110×118B×1
07e0a8e50e000000110×118B×1

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
464,985,056594ddd559a0f05d72e5e0746671aa1846e414c3f4f5f0185687fbbc156bb1e73147.0 KB2026-11-03 22:15 UTC
462,400,514c38799347abc3ed2ddf9cbfc4f7e7bd79c6d2570c150443d75b8fa865126260f157.9 KB2026-11-02 15:19 UTC