Prop AMM Teardown
The wall#30 other closed program

Saber

SSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 12,941
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:SSwp…g1UZ. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow CkXrKs…vQEyho · USDC account 6vfYir…YYoq9B

print of ELF sha256 eeacf0770556dabc…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
119,721,738
ELF sha256
eeacf0770556dabc19c0c5e11e3f3d743367e200781bdc3d9d1c5b49c2ca6992
ELF size
217,192 bytes (212.1 KB)
Snapshot taken
2026-11-02 16:08 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

23,175
sBPF instructions in .text
346
functions reached by internal calls
1,099
internal call sites
10
syscalls used

Sections

.text190,664
.dynsym312
.gnu.hash36
.hash112
.dynstr174
.rel.dyn13,568
.rodata8,161
.eh_frame156
.data.rel.ro2,688
.dynamic208
.shstrtab92

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_invoke_signed_rustsol_log_sol_log_64_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x1b3e88,200
0x1dff06,016
0xb5885,776
0x17eb05,384
0x15c905,208
0x22f85,064
0x4e584,568
0x2d7184,528
0x170e83,528
0x193b83,504
0xcd382,968
0x1d3f02,968

Strings in .rodata (11)

Error: Token mints must have same decimalsError: Admin transfer deadline exceededError: No active admin transfer in progressError: Active admin transfer in progressError: Insufficient ramp timeError: Ramp is locked in th…
stable-swap-program/program/src/processor/admin.rsInstruction: SetNewFeesInstruction: CommitNewAdminInstruction: ApplyNewAdminInstruction: SetFeeAccountInstruction: UnpauseInstruction: PauseInstruction: StopRampAInstruct…
attempt to divide by zerostable-swap-math/src/bn.rsinteger overflow when casting to u64/home/runner/work/bpf-tools/bpf-tools/out/rust/library/core/src/slice/mod.rsstable-swap-client/src/state.rs Some <= FeesNoneadmin_…
/root/.cargo/registry/src/github.com-1ecc6299db9ec823/bs58-0.4.0/src/encode.rscalled `Result::unwrap()` on an `Err` value/root/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.9.5/src/entrypoint.rsUnsuppo…
)EIWde
INOWY^_
)14:EFIJNOde\
..called `Option::unwrap()` on a `None` value[...]byte index is out of bounds of ``begin <= end ( is not a char boundary; it is inside (bytes ) of `BorrowErrorBorrowMutError
:: Utf8Errorvalid_up_toerror_len
library/core/src/unicode/unicode_data.rs
but the index is {

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
119,721,738eeacf0770556dabc19c0c5e11e3f3d743367e200781bdc3d9d1c5b49c2ca6992212.1 KB2026-11-02 16:08 UTC