Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#36 other closed program

Jupiter Lend Earn

jup3YeL8QhtSx1e253b2FDvsMNC87fDrgQZivbrndc9Solscan
0.00
USDC in the pot
0
backers
0
attempts
est. 4,908
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:jup3…ndc9. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow DhyvGs…1fsNr5 · USDC account HtzX5d…rWhWhM

print of ELF sha256 043ec5c874ddfbe0…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
3zB5SLYJoqDPN21s54MCkLeDPuMKQH9vNCSaZKSWTZZd
Upgrade authority
4MsgBB5VPoTrUSp5XnfbViV386C1UnsTdifLBw33ZMSJ
Last deploy slot
453,954,884
ELF sha256
043ec5c874ddfbe0a9338620a788de96523c0c0b16df619710c53f66f0d4b473
ELF size
651,344 bytes (636.1 KB)
Snapshot taken
2026-11-02 16:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

65,621
sBPF instructions in .text
573
functions reached by internal calls
3,426
internal call sites
15
syscalls used

Sections

.text553,304
.rodata49,004
.data.rel.ro9,744
.dynamic176
.dynsym456
.dynstr274
.rel.dyn37,440
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_set_return_datasol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x219a013,768
0x2fc6012,208
0x3385011,736
0x2c2c011,528
0x5859010,200
0x70b109,232
0x250307,736
0x759e87,392
0x55dd07,344
0x28fe87,016
0xc5f86,968
0x26f286,688

Strings in .rodata (37)

metadatafilename (bytes
Deadlock
called `Result::unwrap()` on an `Err` valuesrc/accounts/account_loader.rs
The given account is not mutablecore/src/unicode/unicode_data.rsLIBRARY_TICK_RATIO_OUT_OF_BOUNDS
Instruction: SetRewardsRateModelADMIN_MODULE_USER_ALREADY_PAUSED
Yindex out of bounds: the len is
AccountNotAssociatedTokenAccount
)FA signer constraint was violatedUSER_MODULE_BORROW_LIMIT_REACHED
USER_MODULE_INVALID_CLAIM_AMOUNT
An owner constraint was violatedUSER_MODULE_INSUFFICIENT_BALANCEUSER_MODULE_OPERATE_AMOUNTS_ZEROProgramError caused by account: src/lib.rssrc/de/mod.rsfailed to fill whole buffer()a Display implementation returned an err…
Kindfromkind
Some <= lineNone
rent mintprograms/lending/src/invokes/liquidity_layer.rsprograms/lending/src/module/admin.rsuser_supply_position/home/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/iterator.rsjupiter …
ConstraintHasOneConstraintSigneralloc/src/fmt.rs) when slicing `metadata_programLIBRARY_BN_ERRORpayer is not setalloc/src/str.rsrange end index . Error Number:
AccountNotSignerPermissionDeniedAddrNotAvailablemetadata_account0123456789abcdefInvalidProgramIdtoken_reserves_liquiditytoken_programsysvar_instructionf_token_mintnew_rewards_rate_modelsupply_token_reserves_liquiditydepo…
Jupiter Lend Lending
project_url
https://jup.ag/lend
contacts
email:security@fluid.io,email:security@jup.ag
policy
https://ooosec.com/programs/jupiter#scope
preferred_languages
auditors
Zenith, Ottersec, Certora, Offside, MixBytes, code4rena
programs/lending/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: Id…
;a Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice…
programs/liquidity/src/lib.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runner/work/p…
src/ser/mod.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rscalled `Result::unwrap()` on an `Err` …
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.r…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
[...]begin <= end (`byte index is not a char boundary; it is inside ) of ` is out of bounds of `core/src/unicode/printable.rs
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

This program embeds a security.txt; its contacts are the place to report anything found while reading it.

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
453,954,884043ec5c874ddfbe0a9338620a788de96523c0c0b16df619710c53f66f0d4b473636.1 KB2026-11-02 16:15 UTC