Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#69 other closed program

Boop.fun

boop8hVGQGqehUK2iVEMEnMrL5RbjywRzHKBmBE7ry4Solscan
0.00
USDC in the pot
0
backers
0
attempts
1
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:boop…7ry4. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 4wudjd…vsW92B · USDC account 6Ra9v8…Bb1suc

print of ELF sha256 3eb1d8e8470d1411…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
2Rc3zvp3SxtTSz4GerNLoHr8PBPnRMNWALSSkwZFxDGP
Upgrade authority
8vNDGweVTPBDKFSuLnnxPVWT33PgiKdCqFPj7KUSer2w
Last deploy slot
362,618,777
ELF sha256
3eb1d8e8470d1411c531a2c1d257db8a0cab34d9b97632fad5666ca6f19ce403
ELF size
1,322,784 bytes (1.26 MB)
Snapshot taken
2026-11-02 19:45 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

149,106
sBPF instructions in .text
737
functions reached by internal calls
7,027
internal call sites
13
syscalls used

Sections

.text1,230,184
.rodata23,711
.data.rel.ro11,240
.dynamic176
.dynsym408
.dynstr234
.rel.dyn55,888
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0xc62c020,872
0x45b3020,864
0x6904819,720
0x4b47819,664
0x3917019,128
0x32ba017,616
0x89cc016,752
0x8e27016,752
0x2094015,192
0x2eca815,192
0x74d0815,192
0x3ddc815,168

Strings in .rodata (44)

OverflowNotFoundTimedOut
metadatafilename (bytes
Deadlock
positionoperator
`The given account is not mutablesrc/algorithms/div/reciprocal.rsInvalid decimal: no digits foundindex out of bounds: the len is
AccountNotAssociatedTokenAccountfee_splitter_reward_pool_program
)FInstruction: CreateTokenFallbackA signer constraint was violatedfee_splitter_treasury_wsol_vaultAn owner constraint was violatedProgramError caused by account: src/lib.rssrc/de/mod.rsfailed to fill whole buffer()a Disp…
Uint conversion error: AnchorErrorProgramErrorSource
wsolpoolcode
Kindfromkind
baseSome
lineNone
ErrorStringExceedsMaximumPossibleValueLessThanMinimumPossibleValueUnderflowScaleExceedsMaximumPrecisionConversionToMaxSeedLengthExceededInvalidSeedsIllegalOwnererror_nameerror_code_numbererror_msgerror_origincompared_val…
ConstraintHasOne
ConstraintSignercreator_lp_token) when slicing `metadata_programDivision by zero
range end index input_token_mint. Error Number: locked_liquidity
AccountNotSignerPermissionDeniedAddrNotAvailablemetadata_account0123456789abcdefInvalidProgramIdNothing to splitprograms/boop/src/utils/meteora.rssrc/decimal.rs0.000000000000003FirstBuyMustBeAtMost50PercentOfTotalSupplyG…
boop.fun
project_url
https://boop.fun
contacts
email: contact@boop.fun,twitter: @boopdotfun,telegram: @boopdotfun
policy
https://docs.boop.fun/security
source_code
https://github.com/Boop-fun/boop-solana
preferred_languages
auditors
https://github.com/Frankcastleauditor/public-audits/blob/main/reports/Boop_Audit_Final_Report.pdf
programs/boop/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: IdlWr…
;Subtraction overflowedsrc/arithmetic_impls.rsAddition overflowedsrc/ops/add.rssrc/ops/cmp.rssrc/ops/common.rs
src/ops/div.rssrc/ops/mul.rssrc/str.rsInvalid decimal: emptyInvalid decimal: two decimal pointsInvalid decimal: must start lead with a numberInvalid decimal: unknown characterInvalid decimal: overflow from too many digit…
wfailed to fill whole buffera Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsErrorsrc/states.rsLockedCpLiquidityState
failed to fill whole buffera Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsInvalid bool representation: Errorsrc/states.rsAmmCon…
called `Result::unwrap()` on an `Err` valuesrc/generated/instructions/create_metadata_account_v3.rssrc/instruction.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/accum.rssrc/exte…
src/state.rssrc/instruction.rs
src/state.rsa Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rsErrorMaxSeedLengthExceededInvalidSeedsIllegalOwnerCustomInvalidArgum…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnable to find a viable program address bump seedcalled `Result::unwrap()` on an `Err` valuesrc/decode.rssrc/encode.rsOsmessageErrorCustomerrorConnectionRefusedCo…
but the index is : { , {
,library/core/src/fmt/num.rs0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `library/core/src/str/mod.rslibrary/core/src/unicode/printable.rs
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rsattempt to divide by zero

This program embeds a security.txt; its contacts are the place to report anything found while reading it.

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
362,618,7773eb1d8e8470d1411c531a2c1d257db8a0cab34d9b97632fad5666ca6f19ce4031.26 MB2026-11-02 19:45 UTC