Prop AMM Teardown
The wall#75 other closed program

GatorSwap

gatorLx9aC1e5ZWAXscv5QRKiLXnLPLXjftVc81h1HrSolscan
0.00
USDC in the pot
0
backers
0
attempts
0
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:gato…h1Hr. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 7fBbRe…NdAqvD · USDC account B6sspK…DeX1Kz

print of ELF sha256 d16949ec46aa3f06…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
459,789,083
ELF sha256
d16949ec46aa3f0663dd11ebe956b555879036a4001a2e93e3e3d59c18893773
ELF size
684,712 bytes (668.7 KB)
Snapshot taken
2026-11-02 20:16 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

79,793
sBPF instructions in .text
351
functions reached by internal calls
1,571
internal call sites
12
syscalls used

Sections

.text638,344
.rodata6,460
.data.rel.ro13,824
.dynamic176
.dynsym360
.dynstr206
.rel.dyn24,400
.shstrtab72

Syscalls

abortsol_curve_multiscalar_mulsol_curve_validate_pointsol_get_return_datasol_get_sysvarsol_invoke_signed_csol_log_sol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256

sBPF flags 2, static syscalls resolved by murmur3 hash

Largest functions

Offset in .textBytes
0x4d03063,320
0x76bc834,544
0x4ab830,464
0x8bfc824,904
0x3e45819,600
0x71a5017,720
0x6cd4015,824
0xc1b814,144
0x2acb813,320
0x69cb812,424
0x3895812,352
0x2fd2012,176

Strings in .rodata (60)

src/lib.rs
src/entrypoint/mod.rs
src/vm.rs
program/src/amms/raydium_cpmm.rs
program/src/amms/whirlpool.rs
lib/src/spline.rs
src/memory_region.rs
src/murmur3.rs
program/src/instructions/v3_admin.rs
src/logger.rs
program/src/instructions/reclaim_user_state_rent.rs
src/arith.rs
lib/src/blob.rs
program/src/token.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/ops/arith.rs
program/src/instructions/swap/swap2.rs
lib/src/v3.rs
src/interpreter.rs
program/src/guest.rs
program/src/instructions/spread_admin.rs
program/src/amms/pumpswap.rs
program/src/blob_account.rs
program/src/instructions/swap/swap.rs
program/src/user_state.rs
gator/src/lib.rs
program/src/instructions/oracle.rs
program/src/instructions/swap/refs.rs
library/core/src/unicode/printable.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rs
src/core_api.rs
program/src/amms/meteora_dlmm.rs
library/core/src/str/mod.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/node.rs
program/src/instructions/update_ref_pools.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/collections/btree/navigate.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/slice/sort/stable/quicksort.rs
program/src/amms/meteora_cpmm_v2.rs
library/alloc/src/slice.rs
library/core/src/fmt/mod.rs
program/src/router.rs
src/elf.rs
program/src/instructions/set_band_mode.rs
program/src/instructions/close_pool.rs
lib/src/transfer_fee.rs
lib/src/arith.rs
library/core/src/slice/sort/shared/smallsort.rs
src/program.rs
program/src/instructions/create_pool.rs
call_frames must be large enough for the maximum call depthentrypoint
index out of bounds: the len is
i80f48 division overflow or zero
assertion failed: idx < CAPACITYProgramDerivedAddressassertion failed: edge.height == self.height - 1assertion failed: src.len() == dst.len()assertion failed: edge.height == self.node.height - 1
pool-authorityamm_configpool <= heapout unmappedstruct unmappedabortsol_memcpy_sol_memset_mf_fp_divmf_ratio_frac48mf_spline_eval) when slicing `range end index mf_pwl_eval_frac
0123456789abcdefdivision by zeromf_cubic_evalmf_gl_integratemf_spline_x_pwlconfigvaultInstruction: SandwichGuardInstruction: DistributeFeesspreadInstruction: GatorSwapchomp!user_volume_accumulatorInstruction: GatorSwap2R…
swapidguestguest abortedmemcpy dstmemcpy srcmemset dstmid > lenprogramstackinputallocatedunallocated
arithmetic operation overflowError: memory allocation failed, out of memorycapacity overflow
attempt to add with overflowattempt to subtract with overflowattempt to multiply with overflowattempt to divide with overflowattempt to calculate the remainder with overflowattempt to negate with overflowattempt to shift…
)14:EFIJNOde
INOWY^_
attempt to divide by zeroattempt to calculate the remainder with a divisor of zerorange start index out of range for slice of length slice index starts at but ends at copy_from_slice: source slice length () does not ma…

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
459,789,083d16949ec46aa3f0663dd11ebe956b555879036a4001a2e93e3e3d59c18893773668.7 KB2026-11-02 20:16 UTC