Prop AMM Teardown
The wall#55 other closed program

Sanctum SOLS

so1f7APRw5pJ5iNJrM9g5X9tQgXzk8kMUnXxDNdt99bSolscan
0.00
USDC in the pot
0
backers
0
attempts
556
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:so1f…t99b. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 8FSkak…Zkv94r · USDC account BrnmZS…1CCSpW

print of ELF sha256 84694df6a52f948f…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
Upgrade authority
Last deploy slot
451,354,174
ELF sha256
84694df6a52f948f8d45acf79a989de2699bd056038d61056cbbfa746dac46da
ELF size
164,168 bytes (160.3 KB)
Snapshot taken
2026-11-02 18:15 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

17,379
sBPF instructions in .text
320
functions reached by internal calls
573
internal call sites
11
syscalls used

Sections

.text149,216
.rodata2,369
.data.rel.ro1,016
.dynamic176
.dynsym336
.dynstr187
.rel.dyn9,920
.shstrtab72

Syscalls

abortsol_get_return_datasol_get_sysvarsol_invoke_signed_csol_log_sol_log_pubkeysol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x222b05,392
0x159204,496
0xf8a84,488
0xcc83,240
0x1e0c03,064
0x70802,984
0x135682,976
0x12af02,680
0x62282,224
0xf0102,200
0x37182,176
0x1d2c02,016

Strings in .rodata (17)

src/lib.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs
src/typedefs/coption.rs
program/src/acc_utils.rs
program/src/instructions/rebal/end.rs
program/src/instructions/rebal/start.rs
/home/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec/mod.rs
Not enough liquidity. Required: index out of bounds: the len is
ProgramDerivedAddress
not in portfoliorange end index SetRRRControllernot whitelisted SOL value calculator
poolInit PDA Got:yportfolioxwsol_bridge
internal error: entered unreachable codea Display implementation returned an error unexpectedlydest is out of boundsErrorholding must have 0 outstandingmint must not have freeze authmint must have 9 d.p.EndRebalinvalid m…
portfolio length > u32::MAXcannot be wSOLonly tokenkeg mints alloweda
cannot garbage collect active poolSVC not a program
Wrong account. Expected:Signer privilege escalated for:CloseSetManagerSetHoldingRemHoldingSetSOLTSetRebalancerStartRebalSetRRRSetPFCSetPFSetSWAAddSvcRemSvcSetPFBCPFSyncRentPoolGarbageCollectInitProtocol** PANICKED **
Error: memory allocation failed, out of memorycapacity overflow[ but the index is : , ,
]0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899 out of range for…

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
451,354,17484694df6a52f948f8d45acf79a989de2699bd056038d61056cbbfa746dac46da160.3 KB2026-11-02 18:15 UTC