Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#38 other closed program

Stabble Weighted Swap

swapFpHZwjELNnjvThjajtiVmkz3yPQEHjLtka2fwHWSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 3,719
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:swap…fwHW. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow BojA6x…p8UFif · USDC account DkyejS…A8257R

print of ELF sha256 fd4703de8422f6b8…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
4FcCErmtQ69JaMgDMH7qCezVyEN5yNtDr7vBcceWQFHp
Upgrade authority
9rHUPE2ng7stBuaeAM7heiVHLLGPAqGjYKQ3BBUWxKSP
Last deploy slot
460,237,949
ELF sha256
fd4703de8422f6b828c8b63311299ea94a285c281c1b8bd4189e6948064b923c
ELF size
482,496 bytes (471.2 KB)
Snapshot taken
2026-11-02 16:45 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

48,982
sBPF instructions in .text
465
functions reached by internal calls
2,609
internal call sites
13
syscalls used

Sections

.text412,920
.rodata23,803
.data.rel.ro11,824
.dynamic176
.dynsym384
.dynstr235
.rel.dyn32,208
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x140d014,256
0x115389,840
0x53f089,232
0x1bb388,408
0x201008,184
0x573187,392
0x18bf87,336
0x228287,120
0x1e2b06,064
0x273605,952
0xa8785,808
0x336585,384

Strings in .rodata (32)

The given account is not mutablecore/src/unicode/unicode_data.rsindex out of bounds: the len is
AccountNotAssociatedTokenAccount
A signer constraint was violated
An owner constraint was violatedProgramError caused by account: src/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/l…
NotFoundTimedOut
filename
(bytes
Deadlock
poolcode
KindfromkindbaseSome
lineNone
MaxSeedLengthExceededInvalidSeedsIllegalOwnererror_nameerror_code_numbererror_msgerror_origincompared_valuesAccountNameTryFromIntErrorValuesPubkeysUnexpected variant index: CustomInvalidArgumentInvalidInstructionDataInva…
Invalid Option representation: . The first byte must be 0 or 1ProgramErrorWithOriginprogram_errorsrc/lib.rsprograms/weighted-swap/src/instructions/initialize.rsassertion failed: num_tokens >= weighted_math::MIN_TOKENSass…
VU5programs/weighted-swap/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstru…
ConstraintHasOneConstraintSigneralloc/src/fmt.rsassertion `left ) when slicing `range end index . Error Number:
AccountNotSignerPermissionDeniedAddrNotAvailable right` failed: 0123456789abcdefInvalidProgramIdsol_destinationaccountauthoritybufferidltoprogramfailed to fill whole buffera Display implementation returned an error unexp…
programs/vault/src/lib.rsfailed to fill whole buffer()/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/s…
src/lib.rssrc/base_pool_math.rssrc/weighted_math.rssrc/extension/mod.rs
[OTSUmd
qhI6DU
Sp!oWT
src/token.rssrc/extension/mod.rssrc/token.rs
src/instruction.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/extension/mod.rssrc/state.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnsupported PubkeyErrorsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/Users/runner/work/platform-tools/platform-tools/out/rust/l…
but the index is ==!=matches right` failed
right:
left: : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
)14:EFIJNOde
INOWY^_
number not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
460,237,949fd4703de8422f6b828c8b63311299ea94a285c281c1b8bd4189e6948064b923c471.2 KB2026-11-02 16:45 UTC