ctf in 202(6-7)

Each replay plays a new game from the start, one key at a time. It stops after each step. Press next step to run the next one. Each step sets its own speed. Move the slider to set your own. Your keys do nothing while a replay runs. Your saves are not touched. The last step opens the inventory and shows the flag.

1. 1 Shop flag

   Dustfall Village

   The shop subtracts the cost before it checks the quantity.

   spoiler

   confirmPurchase runs gold -= cost * quantity first. Only the inventory write is guarded by quantity > 0. The quantity prompt accepts a minus sign. So buying -100000 arrows at 1 gold each pays the player 100000 gold. The same shop sells the flag for 1000.

   play the exploit

2. 2 Sokoban flag

   The Sunken Storehouse

   A box can be pushed into a wall if that square also holds a button, item, gold or exit.

   spoiler

   The flag is outside a wall four squares thick. canPushBox returns true as soon as the destination holds a button, item, gold or an exit. It checks for a wall after that. pushBox then moves the whole line of boxes without checking again. Pushing five boxes onto one button moves the line one square into the wall each time. That opens a tunnel to walk out through. The five buttons are a decoy. Solving them opens a door further in. The replay takes 517 keys.

   play the exploit

3. 3 Dragon flag

   The Dragon’s Hoard

   No bug. This is the normal route. It unlocks Workshop maps, which the Nowhere flag needs.

   spoiler

   Buy a long spear, chainmail and potions. Take the crypt gate key and the crypt key. Solve the storehouse properly. Kill all seven defenders in the antechamber. The gate stays locked until the last one dies. The dragon has 64 HP and does not move. The long spear reaches two squares. The dragon reaches one. So it is hit from out of reach, with a potion at low health.

   play the exploit

4. 4 Nowhere flag

   Nowhere

   A Workshop map picks the starting level. Nothing checks that the map declared that level.

   spoiler

   The world holds a level called flag. No exit, door or teleport leads to it. The dragon flag unlocks Workshop maps. loadWorkshopText sets currentLevelId = workshop.start.level and teleports there. It never checks that the uploaded map declared that level. So a map whose start level is flag lands in it. The pickup is automatic. The map is served from this site because the fetch runs in the browser and has to pass CORS. The bug is unchanged.

   play the exploit

5. 5 Ember flag

   The Ember Run

   A coin flip decides the fire. 200 flips are enough to recover the generator.

   spoiler

   Each turn the hall burns if random() < 0.5. Standing in it undefended kills the player and wipes all ten save slots. That comparison is the top bit of a draw. Each draw comes from V8’s xorshift128+ state. The state only changes by xors and shifts. So each watched turn is one linear equation in the 128 unknown state bits. The replay watches 200 turns from safety. It solves the system over GF(2) in the browser. It checks the answer against 40 flips it held back. Then it defends on the turns that will burn and moves on the turns that will not.

   play the exploit

Each replay plays a new game from the start, one key at a time. It stops after each step. Press next step to run the next one. Each step sets its own speed. Move the slider to set your own. Your keys do nothing while a replay runs. Your saves are not touched. The last step opens the inventory and shows the flag.

1. 1 Casino flag

   Charon Holdings

   A save stores gold but not the state of the random number generator.

   spoiler

   The wheel pays double on one spin in four. Saving before each spin and reloading after each loss keeps the wins and cancels the losses. So betting everything every time reaches 1000000 gold in a couple of hundred spins. That is what the House Flag costs.

   play the exploit

2. 2 Stone flag

   Falling Stones

   All 135 stones must be crossed in one path. Each one falls as it is left.

   spoiler

   The sealed door opens only after every stone has fallen. A stone falls as soon as the player steps off it. So there is one valid route and no way back. A wrong move leaves the player stranded. The replay walks a Hamiltonian path found offline. It takes 136 keys.

   play the exploit

3. 3 Circuit flag

   The Substation

   25 levers feed a redstone adder. The vault door follows its output lamp.

   spoiler

   The circuit is three 8-bit inputs and a carry, eight full adders, sixteen gates and thirty-two comparators. Exactly one of the 33.5 million lever settings lights the lamp. Solving it as constraints instead of by brute force gives 13 levers up and the rest down. There are two traps. Pulling a lever flips the first one in reach in world order, so the replay only stands next to a single lever. Turning the lamp off after entering locks the player in the vault.

   play the exploit

4. 4 Escape flag

   The Storehouse, Again

   The 2026 box-pushing bug is still here.

   spoiler

   Same missing wall check in canPushBox. Same recursion in pushBox. Same 517 keys to push five boxes through a wall four squares thick. Only the way in is different. The rats on the route need armour, so the replay wins 80 gold at the wheel and buys Infernal Mail first. Rats hit for 1 and the mail absorbs 1.

   play the exploit

5. 5 Demon flag

   The Killing Floor

   The killing squares are only drawn on the death screen. That screen shows 520 coin flips at once.

   spoiler

   Every five turns the floor rerolls which squares of a 40×13 rectangle kill. That is one random() < 0.5 per square. The demon pays out after 1000 turns spent on the floor. The layout is invisible while alive, so playing blind ends around turn 70. The replay saves on the stairs, because the floor cannot be saved on. Then it walks in and dies. The death screen shows 520 squares, which is 520 coin flips in a row. Recovering the generator needs 128 bits, so this is four times enough. It then reloads and steps only on squares the next reroll leaves safe.

   play the exploit