Prop AMM Teardown
The wall#61 other closed program

JupiterRfqV2

fd3nMFYTQjX1yr5ER8u7tPdHJB7qt8RpDpNtLQX2Br5Solscan
0.00
USDC in the pot
0
backers
0
attempts
204
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:fd3n…2Br5. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow dN8MSr…2qS4vi · USDC account A4k5te…EJDguc

print of ELF sha256 818865557ef1d591…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
402,154,588
ELF sha256
818865557ef1d591e0cdc41067544e9ff31de12af9f3b606f57adb6ce8218e27
ELF size
257,640 bytes (251.6 KB)
Snapshot taken
2026-11-02 17:45 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

25,412
sBPF instructions in .text
303
functions reached by internal calls
1,312
internal call sites
11
syscalls used

Sections

.text215,624
.rodata15,591
.data.rel.ro6,136
.dynamic176
.dynsym336
.dynstr195
.rel.dyn18,640
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x8bb010,024
0x242a09,232
0x275387,392
0xc0e05,984
0x41905,680
0x15a885,384
0x327805,216
0x6b305,176
0x5a584,312
0x10b003,816
0x11de03,592
0x13d483,384

Strings in .rodata (20)

The given account is not mutablecore/src/unicode/unicode_data.rs
index out of bounds: the len is
AccountNotAssociatedTokenAccount
A signer constraint was violated
An owner constraint was violatedProgramError caused by account: src/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/li…
(bytes Deadlockprograms/rfq-v2/src/instructions/fill_exact_in.rs
Kindfromkindbase
Fill executed: side=, amount_in=, amount_out=, vwap_ticks=Arithmetic overflow
ConstraintHasOneConstraintSigneralloc/src/fmt.rs) when slicing `range end index . Error Number:
AccountNotSignerPermissionDeniedAddrNotAvailable0123456789abcdefNo fill occurredInvalidProgramIdOrderbook is staleOrderbook levels must be sorted best-to-worst for the given sideInvalid callerMaker authority appears in o…
called `Result::unwrap()` on an `Err` valueBidAskuser_base_token_accountuser_quote_token_accountmaker_base_token_accountmaker_quote_token_accountbase_mintquote_mintbase_token_programquote_token_programinstructions_sysvar
.programs/rfq-v2/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: Id…
src/instruction.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/state.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.r…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
402,154,588818865557ef1d591e0cdc41067544e9ff31de12af9f3b606f57adb6ce8218e27251.6 KB2026-11-02 17:45 UTC