Hunting and submission rules

Hunters submit on any program, with or without a wish. The payout wallet you connect signs the submission and receives 92% of the sale.

The archive

  • A Rust crate as .zip or .tar.gz, 5 MB at most, with Cargo.toml, Cargo.lock and src/.
  • Rust only. No asm! or global_asm!, no include_bytes! or include_str! of anything over 4 KB, no build.rs.
  • Proc-macro crates only from the allow-list: the solana-program family, borsh, bytemuck, thiserror, num-derive, anchor-lang and anchor-attribute-*, pinocchio. Dependencies from crates.io only; the build runs with --locked.
  • Toolchain: one of the pinned Agave cargo build-sbf versions the judge lists in its report.

In your browser

  1. The archive is hashed: its sha256 is the source commitment, public from the first minute.
  2. It is encrypted with AES-256-GCM under a random 32-byte key K.
  3. K is sealed to the judge's X25519 public key with a tweetnacl box from a one-time key.
  4. You sign the submission (program, commitment, ciphertext hash, price, payout wallet, wish).
  5. The ciphertext uploads in 3 MB chunks and the job is queued; the site starts the judge machine.
Proof of Decompile submission program: <program id> commitment: <sha256 of the archive> ciphertext: <sha256 of the ciphertext> price: <n> USDC payout: <wallet> wish: <wish id or none> work is mine: confirmed issued: <ISO time>

Keep your archive. Its sha256 is the commitment on your ticket, and the buyer's browser checks the decrypted file against it.

WishingThe judge