Vali: The Hidden Arrow
Train a simulated branch predictor and observe probe-cache timing to reconstruct bytes hidden beyond a public array.
hotwater / research archive
Pinaka CTF 2026
Cryptography, binary exploitation, reverse engineering, web and distributed-systems challenges.
11 writeups
Vaidehi: The Sealed Covenant
Recover an aggregate Schnorr signing key from nonce reuse across document revisions, then reconstruct the forged covenant seal.
Unshakken
Exploit an asynchronous approval that certifies the current document head instead of the revision submitted for review.
The Fourteen — Vanvaas Chronicle
Exploit an authorization check against an old public snapshot to read the later sealed version of a royal decree.
Sharanagati Gateway: Session Identity Unbinding
Reuse a public grant’s session ID to expose an elevation check that binds sessions but fails to bind the recipient identity.
Pinaka: The Impossible Bow
Decode an encrypted VM instruction stream and invert its bijective checks to recover the accepted 24-byte draw.
MayaMriga: Golden Deer Custody
Reorder a projection’s event replay to diverge from the authoritative custody ledger and influence the capture decision.
Kishkindha Duta-Mesh
Combine a mutable session principal with a grant for another identity to dispatch a royal message as an ordinary courier.
Janaka’s Court: The False Witness
Forge a Schnorr OR-proof when the Fiat–Shamir challenge fails to bind its commitments, using only public statement data.
DASHA-MUKHA — Ravana’s Ten Heads
Exploit a representation mismatch between recovery state and modular proofs to make locally valid authorities accept an impossible transaction.
Bhargav’s Challenge: The Bow Beyond the Bow
Trace a cross-module type confusion into forged heap metadata and an out-of-bounds write that releases the protected ASTRA result.
No matching writeups
Try another CTF event.