Prop AMM Teardown
The wall#2 prop AMMTarget of the week

TesseraV

TessVdML9pBGgG9yGks7o4HewRaXVAMuoVj4x83GLQHSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 16,941,176
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:Tess…GLQH. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 734cAZ…bHMCnX · USDC account tNxeok…LAmQGc

print of ELF sha256 d7709524ab16022f…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
446,053,401
ELF sha256
d7709524ab16022f59521b3b44df1476572b5109afce0515ac86c1e44430763f
ELF size
347,936 bytes (339.8 KB)
Snapshot taken
2026-11-02 15:11 UTC
OtterSec verify
no verified build
Corpus
1,000 real mainnet instructions from 743 transactions, slots 464,554,596 to 464,554,617, 244 account states, plus 10,000 fuzzed variants at replay · sha256 09d7a489b2a679f8…

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

37,198
sBPF instructions in .text
253
functions reached by internal calls
1,252
internal call sites
13
syscalls used

Sections

.text311,744
.rodata10,659
.data.rel.ro6,736
.dynamic176
.dynsym384
.dynstr239
.rel.dyn17,056
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_last_restart_slotsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x98b054,704
0x16e6023,216
0x2203018,512
0x388012,440
0x384508,744
0x30eb07,920
0x3a6787,544
0x3c3f06,016
0x80385,824
0x2a1185,504
0x497c85,200
0x269683,648

Strings in .rodata (20)

invalid value: , expected invalid length an array of length 32src/de/mod.rsvariant index 0 <= i < 13struct variant SystemInstruction::AllocateWithSeed with 4 elementsstruct variant SystemInstruction::AssignWithSeed with …
index out of bounds: the len is
MIAC_01
connection resetassertion `left ) when slicing `src/processor.rsentity not foundhost unreachableinvalid filenamesrc/utils/set.rsrange end index
PermissionDeniedno storage spaceAddrNotAvailable right` failed: floating point `0123456789abcdefAC_03AC_02S-00:
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzAC_04src/utils/batch_clock.rsG
src/utils/swap_math.rssrc/entrypoint.rsUnexpected variant tag: internal error: entered unreachable codesrc/instruction.rs
src/state.rssrc/lib.rssrc/lib.rssrc/lib.rssrc/lib.rscalled `Result::unwrap()` on an `Err` valuesrc/lib.rsIoInvalidUtf8EncodingInvalidBoolEncodingInvalidCharEncodingInvalidTagEncodingDeserializeAnyNotSupportedSizeLimitSeq…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnable to find a viable program address bump seedcalled `Result::unwrap()` on an `Err` valuesequenceNotFoundTimedOut (bytes Deadlockdeadlockbyte arrayboolean ``in…
library/core/src/num/flt2dec/strategy/dragon.rsassertion failed: d.mant > 0assertion failed: d.minus > 0assertion failed: d.plus > 0assertion failed: buf.len() >= MAX_SIG_DIGITSassertion failed: d.mant.checked_sub(d.minu…
library/core/src/num/flt2dec/strategy/grisu.rsassertion failed: d.mant + d.plus < (1 << 61)assertion failed: !buf.is_empty()assertion failed: d.mant < (1 << 61)
;library/core/src/num/flt2dec/mod.rsassertion failed: buf[0] > b'0'assertion failed: parts.len() >= 4.0.-+NaNinf0assertion failed: buf.len() >= maxlenlibrary/core/src/fmt/mod.rs)..BorrowErrorBorrowMutErroralready borrowe…
but the index is ==!=matches right` failed
right:
left: : { , {
,]library/core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `library/core/src/str/mod.rslibrary/core/src/unicode/printable.rs
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rslibrary/core/src/num/bignum.rsassertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0attempt to divide by zeroattempt to calcul…

Instruction sample

16 instructions to this program in 15 recent transactions (6 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
0d0400000200000052×5784B×5
1100b5be870f0000214×219B×2
0d1400000200000022×2784B×2
11002e96670f0000114×119B×1
10005c3152110000114×118B×1
100060c2d7000000114×118B×1
0d1f00000200000012×1784B×1
0d0100000200000012×1784B×1
100169473f200000114×118B×1
0d1a00000200000012×1784B×1

Full kit from the judge

Computed by the judge machine on 2026-11-02 16:01 UTC.

37,198
instructions disassembled
320
functions
1,000
real instructions in the corpus
V0
sBPF version

Download the disassembly (37,838 lines, sha256 330c5d46928496e4…) · corpus bundle

Syscalls and call counts

abort ×8sol_get_clock_sysvar ×1sol_get_last_restart_slot ×1sol_get_rent_sysvar ×1sol_get_return_data ×1sol_invoke_signed_rust ×1sol_log_ ×3sol_memcmp_ ×1sol_memcpy_ ×1sol_memmove_ ×1sol_memset_ ×1sol_sha256 ×2sol_try_find_program_address ×1

Instruction patterns over the corpus

Per discriminator: count, account and data sizes, then each account slot as signer (s) and writable (w).

DiscriminatorCountAccountsData bytesSigner and writable slots
0d01000001000000682784sw -w
0d04000001000000532784sw -w
0d1a000001000000482784sw -w
0d0a000001000000472784sw -w
0d1f000001000000432784sw -w
0d01000002000000382784sw -w
0d14000001000000362784sw -w
0d07000001000000262784sw -w
0d0d000001000000232784sw -w
0d0a000002000000232784sw -w
0d13000001000000192784sw -w
0d04000002000000182784sw -w
0d1a000002000000182784sw -w
0d1f000002000000172784sw -w

Account owners and sizes

Tokenk…3VQ5DA151 accounts165B×146 82B×5
111111…11111169 accounts0B×69
TessVd…83GLQH13 accounts1264B×11 10240B×1 2048B×1
Tokenz…pPxuEb9 accounts175B×7 171B×1 474B×1
tickUc…ULWY6N1 accounts88B×1
T1TANp…aNXvGT1 accounts9B×1

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
446,053,401d7709524ab16022f59521b3b44df1476572b5109afce0515ac86c1e44430763f339.8 KB2026-11-02 15:11 UTC