Prop AMM Teardown
The wall#66 other closed program

Solayer

endoLNCKTqDn8gSVnN2hDdpgACUPWHZTwoYnnMybpATSolscan
0.00
USDC in the pot
0
backers
0
attempts
17
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:endo…bpAT. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow diZrPi…ZA2NiE · USDC account De9pga…BFjiF3

print of ELF sha256 1ff1b7ffec13ef06…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
302,204,161
ELF sha256
1ff1b7ffec13ef06b8d4d6858877b3bbb2333a4db5bf97f7cff22b6fc7f150b8
ELF size
398,232 bytes (388.9 KB)
Snapshot taken
2026-11-02 19:00 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

42,584
sBPF instructions in .text
623
functions reached by internal calls
2,411
internal call sites
11
syscalls used

Sections

.text352,720
.rodata12,623
.data.rel.ro5,440
.dynamic176
.dynsym336
.dynstr201
.rel.dyn25,792
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x156c016,456
0xf8d013,488
0x1fda010,720
0x40ce86,912
0x19e486,776
0x12d806,272
0x230f06,184
0x46d405,648
0x383705,208
0x1bef84,384
0x2bbf84,184
0x372f84,136

Strings in .rodata (25)

The given account is not mutableInstruction: UpdateTokenMetadataindex out of bounds: the len is
A signer constraint was violatedAn owner constraint was violatedProgramError caused by account: src/sysvar/mod.rssrc/de/mod.rsfailed to fill whole buffer
()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs
attempt to add with overflowErrorcalled `Option::unwrap()` on a `None` value/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/navigate.rsTryFromIntErrorUnexpected variant index:…
NotFoundTimedOut
metadataendo_avs (bytes DeadlockB
Kindfromkind
rent programs/endoavs-program/src/contexts/delegate.rsprograms/endoavs-program/src/contexts/delegate_no_init_account.rsTransferred authority to programs/endoavs-program/src/contexts/manage.rsprograms/endoavs-program/s…
programs/endoavs-program/src/lib.rscalled `Result::unwrap()` on an `Err` valueInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlClos…
attempt to add with overflow
called `Result::unwrap()` on an `Err` valuesrc/generated/instructions/create_metadata_account_v3.rssrc/generated/instructions/update_metadata_account_v2.rs
attempt to add with overflowsrc/instruction.rssrc/state.rssrc/instruction.rsassertion failed: `` does not match `AssociatedTokenAccountInstruction::Create |
AssociatedTokenAccountInstruction::CreateIdempotent`) when slicing `range end index . Error Number: CreateIdempotentPermissionDeniedAddrNotAvailable0123456789abcdefCreateRecoverNesteda Display implementation returned an …
attempt to add with overflowMaxSeedLengthExceededInvalidSeedsIllegalOwnerCustomInvalidArgumentInvalidInstructionDataInvalidAccountDataAccountDataTooSmallInsufficientFundsIncorrectProgramIdMissingRequiredSignatureAccountA…
attempt to multiply with overflowsrc/encode.rscalled `Result::unwrap()` on an `Err` valueBufferTooSmallIoInvalidUtf8EncodingInvalidBoolEncodingInvalidCharEncodingInvalidTagEncodingDeserializeAnyNotSupportedSizeLimitSeque…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/entrypoint.rssrc/instruction.rsUnsupported PubkeyErrorsrc/pubkey.rsUnable to find a viable program address bump seedsrc/rent.rsLength of the seed is too long …
Custom program error: The arguments provided to a program instruction were invalidAn instruction's data contents was invalidAn account's data contents was invalidAn account's data was too smallAn account's balance was to…
Errorlibrary/alloc/src/raw_vec.rscapacity overflowa formatting trait implementation returned an errorlibrary/alloc/src/fmt.rs
called `Option::unwrap()` on a `None` value)invalid argslibrary/core/src/fmt/mod.rs..BorrowErrorBorrowMutErroralready borrowed: already mutably borrowed: :[panicked at :
but the index is : { , {
]library/core/src/fmt/num.rs0x0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `library/core/src/str/mod.rslibrary/core/src/unicode/printable.rs
)14:EFIJNOde\
INOWY^_
library/core/src/unicode/unicode_data.rslibrary/core/src/escape.rs

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
302,204,1611ff1b7ffec13ef06b8d4d6858877b3bbb2333a4db5bf97f7cff22b6fc7f150b8388.9 KB2026-11-02 19:00 UTC