Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#28 other closed program

DefiTuna

fUSioN9YKKSa3CUC2YUc4tPkHJ5Y6XW1yz8y6F7qWz9Solscan
0.00
USDC in the pot
0
backers
0
attempts
est. 16,250
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:fUSi…qWz9. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow EJu6Tk…UaJtqA · USDC account 5hZs3N…xqQMDT

print of ELF sha256 48e1238d06f460b3…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
BE9x1sjqL2aAKV54MMqwMjHcztm5PfB23wsg1uz5ZNbN
Upgrade authority
FWFrrwQ3kd91FEBD17paLUNmWwCYwpxg9bQCXGAcq7jx
Last deploy slot
423,371,029
ELF sha256
48e1238d06f460b3875b09c909f04fccd922367870684c2878ef4d772faabdda
ELF size
1,175,560 bytes (1.12 MB)
Snapshot taken
2026-11-02 16:08 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

127,686
sBPF instructions in .text
801
functions reached by internal calls
6,438
internal call sites
13
syscalls used

Sections

.text1,077,552
.rodata27,391
.data.rel.ro14,952
.dynamic176
.dynsym384
.dynstr228
.rel.dyn53,936
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x55c4816,688
0xb12b016,400
0x2d1a814,248
0x33a0013,608
0x6580012,768
0x7e6d811,296
0x2575011,224
0x751d011,200
0x958d011,032
0x6ad0010,880
0x6224010,608
0x3813810,240

Strings in .rodata (32)

NotFoundTimedOut
receiverEa
_ d (bytes Deadlockdeadlockposition
vcalled `Result::unwrap()` on an `Err` valuesrc/accounts/account_loader.rs
\>[^The given account is not mutablecore/src/unicode/unicode_data.rsTick not found within tick arrayPosition has already been openedInstruction: OpenBundledPositionInstruction: InitializeTickArray
Yindex out of bounds: the len is
AccountNotAssociatedTokenAccount
MultiplicationShiftRightOverflow
)FOutput and input amount mismatchA signer constraint was violatedPosition has already been closed
Instruction: CollectProtocolFeesAn owner constraint was violatedProgramError caused by account: src/lib.rssrc/extension/mod.rs
mid > lensrc/de/mod.rsfailed to write whole bufferinternal error: entered unreachable codefailed to fill whole buffer()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tool…
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsInvalid bool representation: Error/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/navigate.r…
FusionAMM CollectFeesFusionAMM CollectProtocolFeesprograms/fusionamm/src/instructions/convert_tick_array.rsprograms/fusionamm/src/instructions/convert_tick_array_to_fixed.rsFusionAMM Withdrawposition_bundletick_arrayprog…
FusionAMM Trade
programs/fusionamm/src/manager/limit_order_manager.rsThe limit order can't be older than a tickprograms/fusionamm/src/manager/swap_manager.rsLimit order swap input is greater than deposited + remaining input amountprogra…
Kindfromkind
baseSome <=
rent FPPprograms/fusionamm/src/util/token_2022.rshttps://nft.fusionamm.com/position_meta/FLOhttps://nft.fusionamm.com/limitorder_metaprograms/fusionamm/src/util/v2/remaining_accounts_utils.rsTFe: , programs/fusionamm/…
InvalidEnum
ConstraintHasOnetick_array_two_0ConstraintSigneralloc/src/fmt.rsbundled_positionTokenMaxExceededconnection reset) when slicing `
limit_order_minttick_array_two_1metadata_programentity not foundLiquidityTooHighhost unreachableinvalid filenamePartialFillErrorrange end index InvalidTickIndextick_array_one_2tick_array_lowertoken_mint_input. Error Numb…
tick_array_two_2AccountNotSignerInvalidStartTickPermissionDeniedtick_array_upperno storage spaceAddrNotAvailableInvalidTimestamp0123456789abcdeftick_array_one_1InvalidProgramIdtick_array_one_0TickArrayExistInPoolTickArra…
src/ser/mod.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rscalled `Result::unwrap()` on an `Err` valuesrc/generated/instructions/create_metadata_account_v3.rssrc/instruction.rs/hom…
src/state.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/instruction.rs
src/state.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rs/home/runner/work/platform-t…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.r…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
)14:EFIJNOde
INOWY^_
attempt to divide by zeroattempt to calculate the remainder with a divisor of zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
423,371,02948e1238d06f460b3875b09c909f04fccd922367870684c2878ef4d772faabdda1.12 MB2026-11-02 16:08 UTC