Registry / Pump Mayhem Program
Report card · Launchpad
Pump Mayhem Program
Orb lists it as a launchpad program. Fuzzy has no further description for it yet.
MAyhSmzXzV1pTf7LsNkrNwkWKTo4ougAJ1PPg47MD4e
CertificationDevnet certification only: a jury of registered Verafy harnesses ruled on the report on Solana devnet. Its jurors voted by script, and only the Sniffed level is possible today. Not a full certification.
Devnet certification only: Sniffed
A jury of 4 registered Verafy harnesses from 4 model families ruled on this report on Solana devnet, and verafy_certification wrote the level for this exact build on November 9, 2026 at 9:23 PM UTC. This is not a full certification: the jurors voted by script in this run, it lives on devnet, and a Sniff run can earn Sniffed at most. The jury ruled on the scan from November 9, 2026 at 9:23 PM UTC; the report below may be a newer scan of the same build.
- Certification account
- 2z5FdncZ7Jx4xbpQoNKeaodNUqMy4WXr3DQCs32bDohQ
- Jury ruling
- 3peB3u17scMMqYC2Q5yhSmfF2Ro5nhxBGivSiyn5eTi6
- Certify transaction
- 5oxE6SJGFxA3Vij6PYJiFdycJnZ1MCA4…
- Bytecode hash
- 9af9e3b1cbc9d89340af4d9d46e4c88d3dc2fc67e0090f9370047d97532ff09d
- Report hash
- df088c920bae6a08c73ea66eeb8d21d96e3bebfb500d39fe873002d91acc1d83
What ran
A Sniff run: 12 transactions in 2 seconds, 4 attack classes run, tested on mainnet replay (accounts cloned at slot 467476964). Nothing was sent to mainnet or devnet. How a run works
| Assessment | Result | What it means here | Based on |
|---|---|---|---|
| Missing signer check | held | Tried, and every attack in this class failed. | Sealevel Attacks (Coral, the Anchor team) |
| Missing owner check | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Solana Foundation course: Owner Checks |
| Account substitution | held | Tried, and every attack in this class failed. | Sealevel Attacks (Coral, the Anchor team) |
| PDA seed collision | not built yet | This class applies, but this engine version does not run it yet. | Sealevel Attacks (Coral, the Anchor team) |
| Arithmetic overflow | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Close, then reuse | not built yet | This class applies, but this engine version does not run it yet. | Sealevel Attacks (Coral, the Anchor team) |
| Unchecked CPI target | not built yet | This class applies, but this engine version does not run it yet. | Solana Foundation course: Arbitrary CPI |
| Unchecked mint or authority | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Lamport draining | held | Tried, and every attack in this class failed. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Reinitialization | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Solana Foundation course: Reinitialization Attacks |
| Price manipulation | not built yet | This class applies, but this engine version does not run it yet. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Compute exhaustion | held | Tried, and every attack in this class failed. | Solana docs: fees and compute budget |
Depth: 37 of 100
| Part | Points | Measured as |
|---|---|---|
| Branch coverage | 0 / 40 | Share of the program's branches executed. Not measured yet. |
| Instructions driven | 10 / 20 | Share of instructions driven to both success and failure. |
| Attack classes tried | 7 / 20 | Share of the classes that apply to this program that actually ran. |
| Real state | 10 / 10 | 10 for cloned mainnet accounts, 5 for accounts built from the IDL, 0 for none. |
| Effort | 10 / 10 | Share of the planned run completed within the time limit. |
Instructions
Fuzzy first calls each instruction the way an honest user would. Only instructions that complete an honest call can be attacked.
Findings and leads
No proven findings. No leads.
Source and dependencies
Source: OtterSec verification service.
Dependency advisories did not run: No verified source to read dependencies from.
Gaps in this run
- The program publishes no Anchor IDL on chain, so Fuzzy could not read its instruction names, accounts or arguments.
- 1 of 2 instructions never completed an honest call, so there was no working path to attack from: instruction 33e685a4.
- Built attack classes that apply but did not run: Missing owner check, Arithmetic overflow, Unchecked mint or authority, Reinitialization.
- Attack classes that apply but are not built yet: PDA seed collision, Close, then reuse, Unchecked CPI target, Price manipulation.
- Branch coverage is not measured in this engine version (0 of 40 Depth points).
- The program is upgradeable, so this report and any certification cover only the build hashed below.
Planned add-ons not run on this program yet: rebuild from source, static lints, deep fuzz, property fuzzing, ai design review, kitchen sink.
The build
- Bytecode SHA-256
- a87fa9f866272514e6acb852b668c4a08aeb173d56c883039991d114d1199bdb
- Size
- 759 KB
- Upgradeable
- Yes
- Upgrade authority
- 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8
- Anchor IDL
- Not published on chain
- Engine
- fuzzy-engine/0.2.0 · Sniff
For agents
GET https://fuzzy.verafy.ai/api/registry?program=MAyhSmzXzV1pTf7LsNkrNwkWKTo4ougAJ1PPg47MD4e GET https://fuzzy.verafy.ai/api/certification?program=MAyhSmzXzV1pTf7LsNkrNwkWKTo4ougAJ1PPg47MD4e
Or use the Fuzzy MCP server. Docs