Prop AMM Teardown
APIChip in
The wallHuntVaultVerifierDocsAPI and MCP
Chip in on the wall
The wall#35 other closed program

Stabble Stable Swap

swapNyd8XiQwJ6ianp9snpu4brUqFxadzvHebnAXjJZSolscan
0.00
USDC in the pot
0
backers
0
attempts
est. 5,554
transactions in 24 h
Chip in

USDC goes to this target's escrow with the Memo teardown:chip:swap…XjJZ. You can take your share back any time before a PASS.

The wallet opens only when you click. Minimum 5 USDC.

Escrow 7mak2T…HYAET4 · USDC account edaZ79…NWmKym

print of ELF sha256 f878f7aa22ff1903…, lock at 0.00% match

Snapshot.
Read from mainnet and frozen for this deploy slot.

Loader
Upgradeable loader (v3)
Program data
5CkCpgrfyjami8wBK9oVSF8EsQEAdHp5RPR4f9wuYEVS
Upgrade authority
9rHUPE2ng7stBuaeAM7heiVHLLGPAqGjYKQ3BBUWxKSP
Last deploy slot
395,407,721
ELF sha256
f878f7aa22ff190348863b4316e7facda04b2f1078f317c4cdc1818a1ce7c526
ELF size
561,632 bytes (548.5 KB)
Snapshot taken
2026-11-02 16:00 UTC
OtterSec verify
no verified build
Corpus
built by the judge machine: up to 1,000 recent mainnet instructions and 10,000 fuzzed variants; the real N is printed once it exists

Teardown kit.
Computed from the ELF and recent transactions, no AI. Hunters start here.

58,198
sBPF instructions in .text
531
functions reached by internal calls
3,015
internal call sites
14
syscalls used

Sections

.text490,096
.rodata20,395
.data.rel.ro12,920
.dynamic176
.dynsym408
.dynstr248
.rel.dyn36,448
.shstrtab72

Syscalls

abortsol_create_program_addresssol_get_clock_sysvarsol_get_rent_sysvarsol_invoke_signed_rustsol_log_sol_log_datasol_log_pubkeysol_memcmp_sol_memcpy_sol_memmove_sol_memset_sol_sha256sol_try_find_program_address

sBPF flags 0, names read from .dynsym

Largest functions

Offset in .textBytes
0x1700014,144
0x13f789,944
0x663489,232
0x20f908,376
0x255387,664
0x697587,392
0x1e0507,336
0x27a587,120
0x4dc886,560
0xdb306,320
0x236e86,064
0x318585,952

Strings in .rodata (29)

The given account is not mutablecore/src/unicode/unicode_data.rsindex out of bounds: the len is
AccountNotAssociatedTokenAccount
A signer constraint was violated
An owner constraint was violatedProgramError caused by account: src/de/mod.rsfailed to fill whole buffer()a Display implementation returned an error unexpectedly/Users/runner/work/platform-tools/platform-tools/out/rust/l…
NotFoundTimedOut
filename
(bytes
strategyDeadlock
poolcode
KindfromkindbaseSome
lineNone
MaxSeedLengthExceededInvalidSeedsIllegalOwnererror_nameerror_code_numbererror_msgerror_origincompared_valuesAccountNameTryFromIntErrorValuesPubkeysUnexpected variant index: CustomInvalidArgumentInvalidInstructionDataInva…
Invalid Option representation: . The first byte must be 0 or 1ProgramErrorWithOriginprogram_errorsrc/lib.rsprograms/stable-swap/src/instructions/initialize.rsassertion failed: num_tokens >= stable_math::MIN_TOKENSasserti…
Bprograms/stable-swap/src/lib.rsInstruction: IdlCreateAccountanchor:idlInstruction: IdlResizeAccountdata_len should always be >= the current account spaceInstruction: IdlCloseAccountInstruction: IdlCreateBufferInstructio…
ConstraintHasOneConstraintSigneralloc/src/fmt.rsassertion `left ) when slicing `range end index . Error Number:
AccountNotSignerPermissionDeniedAddrNotAvailable right` failed: 0123456789abcdefdivision by zeroInvalidProgramIdsol_destinationaccountauthoritybufferidltoprogramfailed to fill whole buffera Display implementation returne…
programs/vault/src/lib.rsfailed to fill whole buffer()/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/slice.rsError/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/s…
src/lib.rsInteger overflow when casting to usize/Users/runner/work/platform-tools/platform-tools/out/rust/library/core/src/iter/traits/accum.rssrc/base_pool_math.rssrc/stable_math.rssrc/lib.rsUnsigned integer can't be cr…
+3<*;:src/extension/mod.rsError/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/string.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rsHVbpJAQGNpkgBaYBZQ…
src/instruction.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.rssrc/extension/mod.rssrc/state.rs/Users/runner/work/platform-tools/platform-tools/out/rust/library/alloc/src/raw_vec.…
123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyzUnsupported PubkeyErrorsrc/lib.rsProgramDerivedAddressUnable to find a viable program address bump seed/Users/runner/work/platform-tools/platform-tools/out/rust/l…
but the index is ==!=matches right` failed
right:
left: : { , {
,core/src/fmt/num.rs0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798…
)14:EFIJNOde
INOWY^_
attempt to divide by zeronumber not in the range 0..=
range start index out of range for slice of length slice index starts at but ends at

Instruction sample

Sampling recent transactions: the cron reads a few at a time from public RPC.

Full kit from the judge

Disassembly, discriminator map over the full corpus, writable and signer patterns, account sizes and owners, CPI targets: computed by the judge machine for this snapshot and published here.

Pot.
Every transfer in and out of the escrow, read from Solana.

0 USDC, no backers yet. The first chip-in opens this pot.

Attempts.
Match percentages and hashes. The source stays encrypted until the verdict.

No attempts yet. Submit a rebuild.

Upgrade history.
One snapshot per deploy slot. A submission is judged against the snapshot it targeted.

Deploy slotELF sha256SizeTaken
395,407,721f878f7aa22ff190348863b4316e7facda04b2f1078f317c4cdc1818a1ce7c526548.5 KB2026-11-02 16:00 UTC