Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#21 other closed program

JupLend AMM

jupZ4m2GqUCJ5iueMfzQf8khFfH31d4XAQt3RzCT9VdSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 64,038
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:jupZ…T9Vd. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow FD5kvm…qJCjUW · USDC account CBdkMe…7CtNTx

print of ELF sha256 a82b474c8e04a061…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
E4TqU7cqaKuAmpHZt2RZ6W4zPKqbC5K5muE3M2T5ZL1S
Upgrade authority
4MsgBB5VPoTrUSp5XnfbViV386C1UnsTdifLBw33ZMSJ
Last deploy slot
449,990,119
ELF sha256
a82b474c8e04a061cf8124cc89ae9e4adc39ba97e10fc0b274da9a443f5c627b
ELF size
1,234,808 bytes (1.18 MB)
Snapshot taken
2026-11-02 15:29 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

130,874
sBPF instructions in .text
1,110
functions reached by internal calls
6,765
internal call sites
15
syscalls used

Sections

.text1,105,272
.rodata25,775
.data.rel.ro11,784
.dynamic176
.dynsym456
.dynstr274
.rel.dyn90,128
.shstrtab72

Syscalls

abortsol_get_clock_sysvarsol_get_rent_sysvarsol_get_return_datasol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_set_return_datasol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x6695821,840
0x8a9b813,304
0x8163010,448
0xea6f010,200
0x872d810,080
0xfb2089,232
0x722887,712
0x1000107,392
0xe5cc07,368
0xe05207,312
0x7ce906,656
0x90c786,520

Strings in .rodata (37)

+3<*;:NotFoundTimedOut
%filename
/ (bytes
Deadlockposition
called `Result::unwrap()` on an `Err` valuesrc/accounts/account_loader.rs
DEX_ADMIN_INVALID_TOKEN_DECIMALS!
The given account is not mutablecore/src/unicode/unicode_data.rsLIBRARY_TICK_RATIO_OUT_OF_BOUNDSprograms/dex/src/module/admin.rsprograms/dex/src/utils/borrow.rsADMIN_MODULE_USER_ALREADY_PAUSEDindex out of bounds: the len…
AccountNotAssociatedTokenAccount
Instruction: UpdateRangePercentsA signer constraint was violatedUSER_MODULE_BORROW_LIMIT_REACHEDUSER_MODULE_INVALID_CLAIM_AMOUNT
An owner constraint was violatedUSER_MODULE_INSUFFICIENT_BALANCEUSER_MODULE_OPERATE_AMOUNTS_ZERODEX_ORACLE_UPDATE_HUGE_SWAP_DIFFProgramError caused by account: src/de/mod.rsfailed to fill whole buffer()a Display implemen…
fromkindU
baseSome
lineNone
MaxSeedLengthExceededInvalidSeedsIllegalOwnererror_nameerror_code_numbererror_msgerror_origincompared_valuesAccountNameprograms/oracle/src/lib.rsTryFromIntErrorValuesPubkeysUnexpected variant index: CustomInvalidArgument…
ConstraintHasOneConstraintSigneralloc/src/fmt.rs) when slicing `LIBRARY_BN_ERRORrange end index . Error Number:
AccountNotSignerPermissionDeniedAddrNotAvailable0123456789abcdefInvalidProgramIdDEX_CPI_TO_ORACLE_FAILEDDEX_USER_NOT_DEFINEDDEX_USER_MUST_SIGNDEX_ADMIN_LIQUIDITY_PROGRAM_MISMATCHDEX_ADMIN_ADDRESS_ZERO_NOT_ALLOWEDDEX_ADMI…
Jupiter Lend AMM
project_url
https://jup.ag/lend
contacts
email:security@fluid.io,email:security@jup.ag
policy
https://ooosec.com/programs/jupiter#scope
preferred_languages
auditors
Zenith, Ottersec, Neodyme
programs/dex/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstruction: IdlWri…
v#programs/oracle/src/lib.rsa Display implementation returned an error unexpectedly/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runner/work/platform-tools/platform-tools/out/r…
programs/liquidity/src/lib.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/home/runner/work/p…
src/instruction.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/state.rs/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/home/runner/work…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.r…
but the index is : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

This program embeds a security.txt; its contacts are the place to report anything found while reading it.

Instruction sample

14 instructions to this program in 14 recent transactions (14 reached by CPI), grouped by their first 8 bytes. A preview; the judge's corpus is the full set.

First 8 bytesCountAccountsData length
8dac0ad04509389a1424×1425B×14

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
449,990,119a82b474c8e04a061cf8124cc89ae9e4adc39ba97e10fc0b274da9a443f5c627b1.18 MB2026-11-02 15:29 UTC