Prop AMM Teardown
The wall#9 prop AMM

SolFi

SoLFiHG9TfgtdUXUjWAxi3LtvYuFyDLVhBWxdMZxyCeSolscan
0.00
USDC in the pot
0
backers
0
attempts
108
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:SoLF…xyCe. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 7GXbLh…3E9v9n · USDC account EFvmSm…SgZqoS

print of ELF sha256 bef6297be33312a4…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
343,329,392
ELF sha256
bef6297be33312a49c80cf855b9881f873511cd57f5b6c548d967490ffe5bce1
ELF size
243,848 bytes (238.1 KB)
Snapshot taken
2026-11-02 19:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

25,655
sBPF instructions in .text
380
functions reached by internal calls
1,018
internal call sites
11
syscalls used

Sections

.text214,672
.rodata6,863
.data.rel.ro4,760
.dynamic176
.dynsym336
.dynstr210
.rel.dyn15,888
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_memcpy_sol_memmove_sol_memset_sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x755057,360
0x49a011,176
0x22f685,648
0x320905,216
0x31484,840
0x1d3d84,000
0x265283,872
0x181403,352
0xb803,176
0x1c4d02,360
0x155982,352
0x2ab982,312

Strings in .rodata (24)

Unexpected variant index: failed to fill whole buffer
Invalid bool representation:
program/src/instructions/swap.rsindex out of bounds: the len is
attempt to add with overflow/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/slice/iter.rsmarketprogram/src/instructions/change_user_or_program_market_status.rsconfig
attempt to multiply with overflow
attempt to add with overflowsrc/instruction.rssrc/state.rs()assertion failed: min <= max/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/cmp.rs/home/runner/work/platform-tools/platform-tools/out/…
attempt to multiply with overflowdescription() is deprecated; use Display
attempt to add with overflowTryFromIntErrorMaxSeedLengthExceededInvalidSeedsIllegalOwnerconnection reset) when slicing `entity not foundZ2V0IGNvb2tlZA==host unreachableinvalid filenamerange end index PermissionDeniedno s…
attempt to subtract with overflowSpline y[] must be less than max_valuePoints must be monotonically increasing in both x and ySpline x[0] must be 0Spline length must be greater than 0 and 8 or lessLast mini_percent_y mus…
codeKindkindSome <= None Points must be monotonically increasingnew_value is greater than u64::MAXsize_spline.y[] is greater than u32::MAXapi/src/state/mod.rscalled `Result::unwrap()` on an `Err` value
attempt to negate with overflowmarketapi/src/lib.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/adapters/enumerate.rs
attempt to add with overflow
src/error.rsbacktrace capture failed:
Caused by:
attempt to subtract with overflow
attempt to multiply with overflowcalled `Result::unwrap()` on an `Err` valueIoInvalidUtf8EncodingInvalidBoolEncodingInvalidCharEncodingInvalidTagEncodingDeserializeAnyNotSupportedSizeLimitSequenceMustHaveLengthCustomUtf8…
NotFoundTimedOut (bytes Deadlockdeadlockpermission deniedconnection refusednetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would …
Errorlibrary/alloc/src/raw_vec.rscapacity overflowa formatting trait implementation returned an errorlibrary/alloc/src/fmt.rs
called `Option::unwrap()` on a `None` value)invalid argslibrary/core/src/fmt/mod.rs..BorrowErroralready mutably borrowed: :panicked at :
but the index is : { , {
,library/core/src/fmt/num.rs0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394…
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rs

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
343,329,392bef6297be33312a49c80cf855b9881f873511cd57f5b6c548d967490ffe5bce1238.1 KB2026-11-02 19:15 UTC