The wall#4 prop AMM
ZeroFi
ZERor4xhbUycZ6gb9ntrhqscUcZmAbQDjEAtCf4hbZYSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 670,807
transactions in 24 h
Chip in
USDC goes to this target's escrow with the Memo teardown:chip:ZERo…hbZY. You can take your share back any time before a PASS.
The wallet opens only when you click. Minimum 5 USDC.
Escrow ApajxU…fmjCVG · USDC account 4n7DYQ…rk5tca
print of ELF sha256 ad8c82508145bb80…, lock at 0.00% match
Snapshot.
Read from mainnet and frozen for this deploy slot.
Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
464,575,172
ELF sha256
ad8c82508145bb807a6711bed591a4c416dde590686efc1576c5f6dd36100faa
ELF size
384,848 bytes (375.8 KB)
Snapshot taken
2026-11-02 21:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists
Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.
40,847
sBPF instructions in .text
322
functions reached by internal calls
1,688
internal call sites
11
syscalls used
Sections
| .text | 344,384 |
| .rodata | 10,291 |
| .data.rel.ro | 7,896 |
| .dynamic | 176 |
| .dynsym | 336 |
| .dynstr | 198 |
| .rel.dyn | 20,624 |
| .shstrtab | 72 |
Syscalls
abortsol_curve_multiscalar_mulsol_get_sysvarsol_invoke_signed_csol_log_sol_log_datasol_memcpy_sol_memset_sol_set_return_datasol_sha256sol_try_find_program_address
sBPF flags 0, names read from .dynsym
Largest functions
| Offset in .text | Bytes |
|---|---|
| 0xcb28 | 32,952 |
| 0x26aa0 | 23,104 |
| 0x38128 | 10,528 |
| 0x1e588 | 9,000 |
| 0x341f0 | 7,024 |
| 0x21238 | 5,968 |
| 0x45a30 | 5,960 |
| 0x36bd0 | 4,928 |
| 0x42f10 | 4,840 |
| 0x19008 | 4,712 |
| 0x44818 | 4,632 |
| 0x3af08 | 4,592 |
Strings in .rodata (18)
Unable to find a viable program address bump seedsrc/syscalls.rsprograms/amm/src/process_swap.rscore/src/unicode/unicode_data.rs(
Instruction: update_vault_configindex out of bounds: the len is
src/de/mod.rssrc/logger.rslib/quoting/src/utils.rsfailed to fill whole buffer()/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rsFor portability reasons we do not allow to …
c^dsrKp
programs/amm/src/dispatcher.rsInstruction: swapInstruction: swap_v4checked aboveprograms/amm/src/prepare_v1.rsoverflow is a config errorprograms/amm/src/prepare_v2.rs
alloc/src/fmt.rs) when slicing `
range end index
assertion failed0123456789abcdefprograms/amm/src/prepare_v4.rsprograms/amm/src/process_old_update_price.rsmarket price account requiredmust have price accountprograms/amm/src/processor.rs
programs/amm/src/swap_auth.rssizes are goodcan't faillengths were checked in advancevalid argsprograms/amm/src/take_orders.rsprograms/amm/src/token2022_checks.rsunsupported unknown/minimized Swap tag: programs/amm/src/ut…
assertion failed: min <= max/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/cmp.rsdescription() is deprecated; use Displayfrom_bytes>src/internal.rslib/quoting/src/quoting.rsinvalid market pric…
src/error.rsbacktrace capture failed:
Caused by:
<= TargetAlignmentGreaterAndInputNotAlignedOutputSliceWouldHaveSlopSizeMismatchAlignmentMismatch/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError: memory allocation fail…
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
)14:EFIJNOde
INOWY^_
number not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at
Instruction sample
12 instructions to this program in 12 recent transactions (11 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.
| First 8 bytes | Count | Accounts | Data length |
|---|---|---|---|
| 10f796ff56040000 | 1 | 14×1 | 17B×1 |
| 11cdcccccccc2c35 | 1 | 6×1 | 57B×1 |
| 10002d3101000000 | 1 | 14×1 | 18B×1 |
| 1065fcf581000000 | 1 | 14×1 | 17B×1 |
| 10c8790000000000 | 1 | 15×1 | 18B×1 |
| 10c2fef502000000 | 1 | 14×1 | 57B×1 |
| 1099610456000000 | 1 | 14×1 | 57B×1 |
| 10e8fe0b00000000 | 1 | 15×1 | 18B×1 |
| 1054fa7f00000000 | 1 | 15×1 | 18B×1 |
| 10e5210d00000000 | 1 | 15×1 | 18B×1 |
| 10e0415f01000000 | 1 | 15×1 | 18B×1 |
| 1096bd4900000000 | 1 | 15×1 | 18B×1 |
Full kit from the judge
Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.
Pot.
Every transfer in and out of the escrow, read from Solana.
0 USDC, no backers yet. The first chip-in opens this pot.
Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.
No attempts yet. Submit a rebuild.
Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.
| Deploy slot | ELF sha256 | Size | Taken |
|---|---|---|---|
| 464,575,172 | ad8c82508145bb807a6711bed591a4c416dde590686efc1576c5f6dd36100faa | 375.8 KB | 2026-11-02 21:15 UTC |
| 461,839,441 | d0b3ab3ab4549f2293aadbdfa02fd355739ff892a200be1e7c387b6a2a3dcd30 | 371.3 KB | 2026-11-02 15:11 UTC |