set_quote_control_mint_reserves

DecompiledHidden

Hidden admin instruction (absent from the public IDL) that overwrites the stored "reserves" number for one quote mint listed in pump.fun's QuoteControl PDA (seeds "quote-control"). Only the QuoteControl reserves admin, the QuoteControl admin, or the global pump.fun authority (Global.authority) can sign it; anyone else gets custom error 6000, and a mint that isn't already on the list fails with error 6068. Any u64 value is accepted with no checks. It emits an event with the old and new values and moves no SOL or tokens. This handler does not show how the stored reserves value is used later.

Discriminator: 0x74dc6b53bf2c2049
Calls in the sample: 0
Reproduced, seen by the agent: —
Reproduced, never shown to the agent: —

Bytecodefn_25ba1

25ba1mov64   r6, r5
25ba2mov64   r8, r4
25ba3mov64   r9, r3
25ba4mov64   r7, r2
25ba5stxdw   [r10-2768], r1
25ba6lddw    r1, 0x1ae7b8  ; "Instruction: SetQuoteControlMintReserves"
25ba8mov64   r2, 0x28
25ba9call    sol_log_
25baaldxdw   r3, [r6-4088]
25babjlt     r3, 0x20, +127  ; -> 25c2b
25bacldxdw   r2, [r6-4096]
25badldxdw   r1, [r2+6]
25baeldxb    r4, [r2+14]
25bafstxb    [r10-1344], r4
25bb0stxdw   [r10-1352], r1
25bb1and64   r3, -0x8
25bb2jeq     r3, 0x20, +120  ; -> 25c2b
25bb3ldxdw   r3, [r10-1351]
25bb4ldxdw   r4, [r2+32]
25bb5stxdw   [r10-2776], r4
25bb6ldxh    r4, [r2+4]
25bb7stxh    [r10-2684], r4
25bb8ldxw    r5, [r2+0]
25bb9stxw    [r10-2688], r5
25bbaldxb    r0, [r2+31]
25bbbldxdw   r6, [r2+23]
25bbcldxdw   r2, [r2+15]
25bbdstxw    [r10-32], r5
25bbestxh    [r10-28], r4
25bbfstxdw   [r10-25], r3
25bc0stxb    [r10-26], r1
25bc1stxdw   [r10-17], r2
25bc2stxdw   [r10-9], r6
25bc3stxb    [r10-1336], r0
25bc4stxb    [r10-1], r0
25bc5stb     [r10-2689], 0xff
25bc6sth     [r10-2691], 0xffff
25bc7stxdw   [r10-2680], r8
25bc8stxdw   [r10-2688], r9
25bc9mov64   r1, r10
25bcaadd64   r1, -0xa83
25bcbstxdw   [r10-4088], r1
25bccmov64   r1, r10
25bcdadd64   r1, -0x548
25bcemov64   r3, r10
25bcfadd64   r3, -0xa80
25bd0mov64   r5, r10
25bd1mov64   r2, r7
25bd2call    fn_1b71f
25bd3ldxdw   r8, [r10-1336]
25bd4ldxdw   r6, [r10-1344]
25bd5ldxdw   r9, [r10-1352]
25bd6lddw    r1, 0x8000000000000000
25bd8jeq     r9, r1, +101  ; -> 25c3e
25bd9mov64   r1, r10
25bdaadd64   r1, -0xa58
25bdbmov64   r2, r10
25bdcadd64   r2, -0x530
25bddmov64   r3, 0x510
25bdecall    fn_35367
25bdfstxdw   [r10-2656], r8
25be0stxdw   [r10-2664], r6
25be1stxdw   [r10-2672], r9
25be2ldxh    r1, [r10-2691]
25be3stxh    [r10-1320], r1
25be4ldxb    r1, [r10-2689]
25be5stxb    [r10-1318], r1
25be6ldxdw   r1, [r10-2680]
25be7stxdw   [r10-1328], r1
25be8ldxdw   r1, [r10-2688]
25be9stxdw   [r10-1336], r1
25beamov64   r1, r10
25bebadd64   r1, -0xa70
25becstxdw   [r10-1344], r1
25bedstxdw   [r10-1352], r7
25beemov64   r1, r10
25befadd64   r1, -0xa98
25bf0mov64   r2, r10
25bf1add64   r2, -0x548
25bf2mov64   r3, r10
25bf3add64   r3, -0x20
25bf4ldxdw   r4, [r10-2776]
25bf5call    fn_0c6d6
25bf6ldxdw   r6, [r10-2712]
25bf7jeq     r6, 0x2, +1  ; -> 25bf9
25bf8ja      +73  ; -> 25c42
25bf9mov64   r1, r10
25bfaadd64   r1, -0xaa8
25bfbmov64   r2, r10
25bfcadd64   r2, -0xa70
25bfdlddw    r3, 0x1adff9
25bffmov64   r4, r7
25c00call    fn_00d61
25c01mov64   r6, 0x2
25c02ldxdw   r2, [r10-2728]
25c03jeq     r2, 0x2, +9  ; -> 25c0d
25c04ldxdw   r3, [r10-2720]
25c05mov64   r1, r10
25c06add64   r1, -0xab8
25c07lddw    r4, 0x1adefd  ; "quote_control"
25c09mov64   r5, 0xd
25c0acall    fn_005a9
25c0bldxdw   r8, [r10-2736]
25c0cldxdw   r6, [r10-2744]
25c0dldxdw   r1, [r10-2528]
25c0eldxdw   r2, [r10-2536]
25c0fldxdw   r3, [r2+0]
25c10add64   r3, -0x1
25c11stxdw   [r2+0], r3
25c12jne     r3, 0x0, +3  ; -> 25c16
25c13ldxdw   r3, [r2+8]
25c14add64   r3, -0x1
25c15stxdw   [r2+8], r3
25c16ldxdw   r2, [r1+0]
25c17add64   r2, -0x1
25c18stxdw   [r1+0], r2
25c19jne     r2, 0x0, +3  ; -> 25c1d
25c1aldxdw   r2, [r1+8]
25c1badd64   r2, -0x1
25c1cstxdw   [r1+8], r2
25c1dldxdw   r1, [r10-2480]
25c1eldxdw   r2, [r10-2488]
25c1fldxdw   r3, [r2+0]
25c20add64   r3, -0x1
25c21stxdw   [r2+0], r3
25c22jne     r3, 0x0, +3  ; -> 25c26
25c23ldxdw   r3, [r2+8]
25c24add64   r3, -0x1
25c25stxdw   [r2+8], r3
25c26ldxdw   r2, [r1+0]
25c27add64   r2, -0x1
25c28stxdw   [r1+0], r2
25c29jne     r2, 0x0, +20  ; -> 25c3e
25c2aja      +53  ; -> 25c60
25c2blddw    r1, 0x1b3c60
25c2dcall    fn_33e71
25c2emov64   r1, r0
25c2fand64   r1, 0x3
25c30mov64   r2, r1
25c31add64   r2, -0x2
25c32jlt     r2, 0x2, +5  ; -> 25c38
25c33jeq     r1, 0x0, +4  ; -> 25c38
25c34ldxdw   r1, [r0-1]
25c35ldxdw   r2, [r0+7]
25c36ldxdw   r2, [r2+0]
25c37callx   r2
25c38mov64   r1, r10
25c39add64   r1, -0xac8
25c3amov64   r2, 0x66
25c3bcall    fn_32b09
25c3cldxdw   r8, [r10-2752]
25c3dldxdw   r6, [r10-2760]
25c3eldxdw   r1, [r10-2768]
25c3fstxdw   [r1+8], r8
25c40stxdw   [r1+0], r6
25c41exit   
25c42ldxdw   r8, [r10-2704]
25c43ldxdw   r1, [r10-2528]
25c44ldxdw   r2, [r10-2536]
25c45ldxdw   r3, [r2+0]
25c46add64   r3, -0x1
25c47stxdw   [r2+0], r3
25c48jne     r3, 0x0, +3  ; -> 25c4c
25c49ldxdw   r3, [r2+8]
25c4aadd64   r3, -0x1
25c4bstxdw   [r2+8], r3
25c4cldxdw   r2, [r1+0]
25c4dadd64   r2, -0x1
25c4estxdw   [r1+0], r2
25c4fjne     r2, 0x0, +3  ; -> 25c53
25c50ldxdw   r2, [r1+8]
25c51add64   r2, -0x1
25c52stxdw   [r1+8], r2
25c53ldxdw   r1, [r10-2480]
25c54ldxdw   r2, [r10-2488]
25c55ldxdw   r3, [r2+0]
25c56add64   r3, -0x1
25c57stxdw   [r2+0], r3
25c58jne     r3, 0x0, +3  ; -> 25c5c
25c59ldxdw   r3, [r2+8]
25c5aadd64   r3, -0x1
25c5bstxdw   [r2+8], r3
25c5cldxdw   r2, [r1+0]
25c5dadd64   r2, -0x1
25c5estxdw   [r1+0], r2
25c5fjne     r2, 0x0, -34  ; -> 25c3e
25c60ldxdw   r2, [r1+8]
25c61add64   r2, -0x1
25c62stxdw   [r1+8], r2
25c63ja      -38  ; -> 25c3e

Reconstructedset_quote_control_mint_reserves

// discriminator 74dc6b53bf2c2049  (NOT in the public IDL)
// args (borsh): mint: Pubkey (data[8..40]), reserves: u64 (data[40..48])
// pc 25bab / 25bb2: data shorter than 32 / 40 bytes -> InstructionDidNotDeserialize (102)
#[derive(Accounts)]                      // fn_1b71f, declaration order as consumed
pub struct SetQuoteControlMintReserves<'info> {
    pub authority: Signer<'info>,                        // fn_02590 -> 3010 AccountNotSigner
    #[account(seeds = [b"global"], bump)]                // Account<Global>, pc 1b84f -> 2006 ConstraintSeeds "global"
    pub global: Account<'info, Global>,
    #[account(mut, seeds = [b"quote-control"], bump)]    // pc 1b873 -> 2006 "quote_control"; pc 1b902 !is_writable -> 2000 ConstraintMut
    pub quote_control: Account<'info, QuoteControl>,
    /// CHECK: seeds = [b"__event_authority"]            // pc 1b923 -> 2006 "event_authority"
    pub event_authority: AccountInfo<'info>,
    pub program: Program<'info, Pump>,                   // 3008-ish "program" if missing/wrong
}
// QuoteControl on-chain layout (borsh, after 8-byte discriminator):
//   [8..40)   admin            (Pubkey)   -- names inferred from sibling instructions
//   [40..72)  reserves_admin   (Pubkey)
//   [72..104) <third pubkey>   (not used here)
//   [104..)   mints: Vec<(mint: Pubkey, reserves: u64)>   (u32 len, 40-byte entries)
pub fn set_quote_control_mint_reserves(ctx, mint: Pubkey, reserves: u64) -> Result<()> {
    msg!("Instruction: SetQuoteControlMintReserves");
    // access control (inside try_accounts, pc 1b7d3..1b806)
    let a = ctx.accounts.authority.key();
    require!(a == quote_control.reserves_admin      // memcmp #1  (bytes 40..72)
          || a == quote_control.admin               // memcmp #2  (bytes 8..40)
          || a == global.authority,                 // memcmp #3  (Global field)
          ErrorCode(6000) /* "authority" */);
    // fn_0ccc6 (quote_control/state.rs)
    let entry = quote_control.mints.iter_mut().find(|e| e.mint == mint)
        .ok_or(ErrorCode(6068))?;                   // 0x17b4, state.rs line 113
    let old_reserves = entry.reserves;
    entry.reserves = reserves;                      // no bounds / sanity check on the value
    // emit_cpi! (fn_0c6d6)
    let ts = Clock::get()?.unix_timestamp;
    let event = QuoteControlMintReservesSet {       // discriminator a9 43 27 6d 66 86 b6 e8
        quote_control: quote_control.key(),
        authority:     a,
        mint,
        old_reserves,
        new_reserves:  reserves,
        timestamp:     ts,
    };                                              // 128 bytes
    invoke_signed(
        Instruction { program_id: crate::ID,
                      accounts: [event_authority (signer, read-only)],
                      data: [0xe4,0x45,0xa5,0x2e,0x51,0xcb,0x9a,0x1d] ++ event },  // 136 bytes
        &[&[b"__event_authority", &[bump]]]);
    // exit: quote_control re-serialized (fn_00d61). No SOL or token movement.
    Ok(())
}

Replay model

The executable model the agent wrote. Every tally above comes from running it against mainnet.

// no model entered yet

Accounts

Not published. The accounts and arguments were recovered from the bytecode; see the reconstruction.

program 6EF8rr…BEwF6P