Prize pool valued at ≈ $700 USD — held in five live wallets.
Five vulnerabilities, each guarding its own Solana wallet. Exploit the weakness, extract the private key, and drain the bounty straight to your own address. No scoreboard points. No judges. The chain is the referee.
Every wallet holds exactly 1.00 SOL. What changes is how hard you fight for it.
Status is read directly from the Solana blockchain and refreshes automatically.
The application's .git directory is served to the entire internet.
Download the repository, audit the commit history, and recover what the
developers thought they had removed.
The login endpoint concatenates raw user input straight into its query. Bypass authentication, enumerate the database, and pull the key material out of the secrets table.
A URL fetcher that makes server-side requests with no allowlist and no egress filtering. Point it inward — the internal network is more talkative than the public one.
A compute endpoint evaluates arbitrary JavaScript in the server process. Escape its intended purpose, read the runtime environment, and lift the stage key from disk.
The grand prize key was split into four fragments and scattered across the previous stages. Nothing new to exploit here — only those who mapped the entire system can reassemble it. Decode, reconstruct, and claim the final wallet of the season.
Work the vulnerability. Every stage is solvable with standard tooling and technique — no guessing required.
Each stage guards private key material for its own Solana wallet. Find it in the environment you just breached.
Import the key into any Solana wallet and sweep the full balance to an address you control.
The scoreboard reads the chain directly. An emptied wallet is public, immutable proof of your claim.
Each wallet holds its full bounty. The first person to extract the key and drain it takes everything — settlement is on-chain and irreversible.
ctfxt.45.12.62.157.sslip.io (45.12.62.157) is the sole authorized target. Attacks against other participants, infrastructure providers, or third parties are out of scope.
Rate limits are enforced. Flooding, resource exhaustion, and blind brute force lead to immediate disqualification. Exploits should be surgical.
Bounties are claimed by moving funds on Solana. Transactions cannot be reversed — verify your destination address before sweeping.