Break the box. We pay if you do.

The prizes

Four ways in, and the amount depends on what a win would prove.

The line that sets the prize for a stolen Secret A is where the attack came from. Through the interpreter's bounds check, the property we prove, is the full amount. Around it, by breaking anything else, is half. You tell us the route, and the route decides the tier.

What you are attacking, disclosed

Two emulated machines on one host, wired the way the product describes. Guessing is slower than reading; the interpreter's whole source and its proofs are published.

• The board

  An emulated RISC-V core under qemu-system-riscv32, running a verified interpreter for a subset of eBPF with no operating system beneath it. "Bare metal" here describes the software, not the hardware: no OS, no allocator, no runtime. The machine underneath is emulated, not silicon. A program gets a 512-byte memory window, three capabilities (read state, propose a setpoint, a signing stub), and a fuel budget of 1024 steps; the interpreter clamps any run to a hard ceiling of 4096. Every memory access is bounds-checked. Its memory safety, its termination under fuel, and the confinement of its effects to the capability table are machine-checked with Kani.

• The broker

  The model-facing side: an MCP server reaching the board over a single serial line. It holds only the SHA-256 fingerprints of the secrets, never their bytes, so breaking the server does not hand you a secret. The board runs one program at a time.

• The frame reader

  The serial link's framing is itself a proven total function now, after an earlier researcher hung the board with a truncated frame. That the perimeter is where the last defect was, and the proven core held, is the point of the exercise.

Call the mission tool at the endpoint first; it discloses the objectives, the machine, and the assembly language, then submit_program runs a program and shows you exactly what happened.

The secrets, committed in advance

Published here before anyone attacked, so we cannot move the goalposts after a win. Each secret is 16 random bytes rendered as ENDSTOP-CANARY-A- or -B- followed by 32 hex characters: 128 bits of entropy, so grinding the hash is not a shortcut. The only way to the plaintext is out of the box.

Verify a candidate against the raw bytes, no trailing newline:

How a claim works

A claim needs both halves, because either alone is not evidence.

1. The plaintext. Bytes whose SHA-256 matches a hash above. We verify with sha256sum over the raw bytes.
2. A repeatable attack. The method, in enough detail that we reproduce it. A secret without a reproducible route does not pay: we cannot tell a real break from a leak we caused ourselves, and the point is to learn the vulnerability.

The automated WIN flag in the tool output is a convenience, not the arbiter. The hash and the reproduction are. A partial exfiltration that never trips the flag still pays if the plaintext and the method are sound.

Scope, and a safe harbour

In scope: the endpoint and everything behind it: the MCP server, the board and its emulator, the broker machine, the serial link, and the host file that is Secret B.

Out of scope: the Cloudflare edge and the worker in front of the endpoint; this marketing site; the cloud account and its console; any denial of service against infrastructure other than the board itself; social engineering; and anything aimed at a person rather than the box. Do not attempt to reach other tenants, other hosts, or the cloud control plane.

One payment per distinct vulnerability, to the first reproducible report; variations on one root cause are one finding. We may pause or retune this programme and will say so here when we do, honouring claims already made under the terms they were made.