Prop AMM Teardown
The wall#37 other closed program

Token Swap

SwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8Solscan
0.00
USDC in the pot
0
backers
0
attempts
est. 4,189
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:SwaP…gAC8. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow G4hsc4…KwJRto · USDC account BLC4QA…JqiyAt

print of ELF sha256 f61de0a846ac6b08…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
73,737,036
ELF sha256
f61de0a846ac6b08a418c1818109f611ea10cfeebd81b096119ec3ab57aad26c
ELF size
290,504 bytes (283.7 KB)
Snapshot taken
2026-11-02 17:00 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

32,824
sBPF instructions in .text
483
functions reached by internal calls
2,029
internal call sites
4
syscalls used

Sections

.text266,408
.dynsym168
.gnu.hash36
.hash64
.dynstr90
.rel.dyn10,800
.rodata8,242
.eh_frame188
.data.rel.ro3,184
.dynamic208
.shstrtab92

Syscalls

abortsol_create_program_addresssol_invoke_signed_rustsol_log_

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x17f1013,848
0x69409,896
0x112389,512
0xb8a08,128
0x1c0887,536
0x29286,616
0x2ae105,280
0x149d85,072
0xf8a04,976
0x9f684,920
0x31a184,800
0xe6204,728

Strings in .rodata (19)

) when slicing `division by zeroalready borrowedrange end index already mutably borrowedtoken-swap/program/src/processor.rs
HfoTxFR1Tm6kGmWgYWD6J7YHVy1UwqSULUGVLXkJqaKN (bytes
Instruction: WithdrawSingleTokenTypeExactAmountOutInstruction: DepositSingleTokenTypeExactAmountInInstruction: WithdrawAllTokenTypesInstruction: DepositAllTokenTypesInstruction: SwapInstruction: Inittoken-swap/program/sr…
/home/armaniferrante/Documents/code/src/github.com/solana-labs/solana-program-library/libraries/math/src/uint.rstoken-swap/program/src/curve/stable.rsStableCurveampError: The operation cannot be performed on the given cu…
Unsigned integer can't be created from negative valuelibraries/math/src/uint.rsInteger overflow when casting to usize
attempt to divide by zerocalled `Option::unwrap()` on a `None` valuelibraries/math/src/precise_number.rslibraries/math/src/uint.rsInteger overflow when casting to u128libraries/math/src/uint.rs
attempt to divide by zero/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/slice/mod.rs123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz
/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/alloc/layout.rscalled `Result::unwrap()` on an `Err` value/home/armaniferrante/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.6.2/…
Unsupported PubkeyError/home/armaniferrante/.cargo/registry/src/github.com-1ecc6299db9ec823/solana-program-1.6.2/src/pubkey.rsSlice must be the same length as a Pubkey/home/armaniferrante/.cargo/registry/src/github.com-1…
libstd rust_begin_panic/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/alloc/layout.rscalled `Result::unwrap()` on an `Err` value/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/allo…
LayoutErrorprivatePanicked at: '', :called `Option::unwrap()` on a `None` value/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/slice/memchr.rs
[...]byte index is out of bounds of ``begin <= end ( <= is not a char boundary; it is inside ) of `/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/unicode/printable.rs
)EIWde
INOWY^_
)14:EFIJNOde\
align_offset: align is not a power-of-two/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/ptr/const_ptr.rs: /home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/unicode/unicode_d…
BorrowErrorBorrowMutError
but the index is ()Error/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/fmt/builders.rs {
(,)/home/runner/work/bpf-tools/bpf-tools/out/rust-bpf-sysroot/src/core/src/str/pattern.rs

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
73,737,036f61de0a846ac6b08a418c1818109f611ea10cfeebd81b096119ec3ab57aad26c283.7 KB2026-11-02 17:00 UTC