Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#44 other closed program

Sanctum

SPMBzsVUuoHA4Jm6KunbsotaahvVikZs1JyTW6iJvbnSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 1,421
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:SPMB…Jvbn. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow HqPvng…PB1ShF · USDC account EGsyyU…QDfLWN

print of ELF sha256 e582297b2e18b070…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
HxBTMuB7cFBPVWVJjTi9iBF8MPd7mfY1QnrrWfLAySFd
Upgrade authority
47SND7bGKvNXrqfP1bjsLCbwTgZhFBzAgmZ42QSkRScz
Last deploy slot
371,704,232
ELF sha256
e582297b2e18b07008c07201d7dfa7fd711c175331d9ed65387b3ea65046073b
ELF size
395,064 bytes (385.8 KB)
Snapshot taken
2026-11-02 17:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

41,552
sBPF instructions in .text
428
functions reached by internal calls
1,891
internal call sites
13
syscalls used

Sections

.text345,928
.rodata18,027
.data.rel.ro6,992
.dynamic176
.dynsym408
.dynstr271
.rel.dyn22,320
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_epoch_rewards_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x1583010,032
0x3ea689,000
0x43a188,824
0x195988,584
0x1ec307,816
0x06,480
0x46b505,968
0x248905,448
0x229d85,296
0x2ff105,280
0x524105,216
0x2e0504,872

Strings in .rodata (32)

src/lib.rssrc/extension/mod.rssrc/de/mod.rsfailed to write whole bufferfailed to fill whole bufferUnexpected length of inputFor portability reasons we do not allow to deserialize NaNs./home/runner/work/platform-tools/pla…
alloc/src/fmt.rsconnection reset) when slicing `Stake pre merge entity not foundhost unreachableError: Immutableinvalid filenamerange end index Validator stake
PermissionDeniedTokenGroupMemberno storage spaceAddrNotAvailable0123456789abcdefConfidentialMintBurnScaledUiAmountPausableAccountInvalid enum valueError: UnknownError: InvalidArgumentError: InvalidInstructionDataError: I…
core/src/unicode/unicode_data.rsInstruction: UpdateTokenMetadataError: Wrong pool staker accountInstruction: CreateTokenMetadataError: AccountAlreadyInitializedInstruction: SetFundingAuthorityindex out of bounds: the len…
is the current possible maximum
Error: UninitializedAccountError: NotEnoughAccountKeysError: AccountBorrowFailedError: MaxSeedLengthExceededError: InvalidSeedsError: BorshIoErrorError: AccountNotRentExemptError: UnsupportedSysvarError: IllegalOwnerErro…
SPL Stake Pool
project_url
https://spl.solana.com/stake-pool
contacts
link:https://github.com/solana-labs/solana-program-library/security/advisories/new,mailto:security@solana.com,discord:https://solana.com/discord
policy
https://github.com/solana-labs/solana-program-library/blob/master/SECURITY.md
preferred_languages
source_code
https://github.com/solana-labs/solana-program-library/tree/master/stake-pool/program
source_revision
b7dd8fee93815b486fce98d3d43d1d0934980226
source_release
stake-pool-v1.0.0
auditors
https://github.com/solana-labs/security-audits#stake-pool
src/instruction.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/extension/mod.rssrc/state.rssrc/lib.rscalled `Result::unwrap()` on an `Err` valuesrc/lib.rs/home/runner/work/plat…
src/instruction.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rssrc/lib.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rscalled `Result::unwrap()` on an `Err` values…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `core/src/unicode/printable.rs
)14:EFIJNOde
INOWY^_
number not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

This program embeds a security.txt; its contacts are the place to report anything found while reading it.

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
371,704,232e582297b2e18b07008c07201d7dfa7fd711c175331d9ed65387b3ea65046073b385.8 KB2026-11-02 17:15 UTC