ctf in 202(6-7)

The shop lets you enter a negative quantity when buying an item. It calculates the price with cost * quantity and subtracts that from your gold, so a negative order adds money instead of spending it. There is a check for quantity > 0, but it only controls whether you receive the items; the money has already changed hands. Buy -100000 arrows at 1 gold each to give yourself 100000 gold, then use it to buy the flag from the same shop for 1000.

Putting a box on each button opens the route deeper into the dungeon, but this flag is outside the storehouse, behind a wall four squares thick. To reach it, you need to push the boxes through the wall. The bug is in canPushBox: when the next square contains a button, it allows the push without checking whether another box is already there or whether that box can move. pushBox then moves every box in the chain anyway, including any that end up inside a wall. By feeding all five boxes onto the same button, you can push the chain through the outer wall and follow it out to the flag.

This flag comes from playing through the dungeon and beating the dragon. The shop bug makes the preparation easier: use it to buy a long spear, chainmail and plenty of potions. Collect both crypt keys, solve the storehouse puzzle by covering all five buttons, then kill the seven defenders in the antechamber to open the gate. The dragon itself has 64 HP and stays in one place. Since your spear reaches two squares and its attacks only reach one, you can fight it from a safe distance. Keep potions handy for the approach, then collect the flag once it is dead.

There is a hidden level named flag in the world data, but nothing in the game leads to it. You can get there through the Workshop map loader, which unlocks after collecting the dragon flag. The loader trusts the starting level specified by an uploaded map without checking that the level belongs to that map. Set workshop.start.level to flag and the starting coordinates to the flag at (7, 3). Loading the map teleports you straight into the hidden level and picks it up.

The vents have a 50% chance of firing each turn, and getting caught in the fire without defending kills you and deletes all ten saves. You can watch the vents from outside the hall, though, and their pattern reveals information about the random number generator. Each random() < 0.5 result tells you one bit of an output from the V8-style xorshift128+ generator. Because its state changes through XORs and bit shifts, those observations can be turned into linear equations for its 128 state bits. The replay records 200 turns and solves those equations, keeping 40 observations aside to check the predictions. Once you can predict the fire, cross by defending on burning turns and moving on safe ones. If more than one state fits and their predictions disagree, defend until further observations resolve the uncertainty.

You can save-scum the casino because saves include your gold but not the state of the random number generator. Reloading after a loss gives you your money back without forcing the next spin to have the same result. Save before betting, go all in, and reload whenever you lose. When you win, save again to keep the profit. The wheel doubles your bet on a win, so repeating this eventually gives you the 1000000 gold needed to buy the House Flag.

Each stone collapses as you step off it, and the exit only opens once all 135 stones have fallen. You therefore need a route that visits every stone exactly once and finishes at the door, without cutting off an unvisited part of the floor. This is a Hamiltonian path problem: treat the stones as vertices in a graph and connect pairs you can step between, then search for a path through every vertex. The replay follows a route found this way ahead of time; there is no game bug needed for this flag.

The vault opens when the circuit lights its output lamp. Its 25 levers supply three 8-bit numbers and a carry bit to a network of adders and logic gates. Rather than trying millions of combinations, you can model each component as a Boolean constraint and ask a solver for inputs that make the lamp turn on. The solution raises 13 levers and leaves the others down. When setting them, stand next to only one lever at a time: the game pulls the first lever in reach, which may not be the one you intended. Once the lamp is on, leave the circuit alone and collect the flag; switching it off again closes the vault door even if you are inside.

The 2027 storehouse has the same box-pushing bug as the 2026 version. Pushing a box onto a button skips the checks for any boxes beyond it, so you can feed five boxes onto one button and force the chain through the outer wall to reach the flag. Getting to the storehouse is the extra complication this time, since the route goes through a room full of rats. Use the casino save-and-reload trick to get 80 gold, then buy and equip Infernal Mail before heading down. It absorbs the one point of damage each rat deals, letting you get through the room unharmed.

You need to stay on the killing floor for 1000 consecutive turns, but the deadly squares change every five turns and are hidden while you are alive. Dying reveals the entire layout, which is enough to predict future layouts using the same random-state recovery as the Ember Run. Each of the 520 squares comes from a separate random() < 0.5 check, so the death screen gives you a long sequence of output bits to solve from. Save on the stairs first, since saving on the floor is disabled, then walk in and let yourself die. After recovering the generator state from the revealed layout, reload the save. Reloading restores your character but leaves the generator running from where it was, so you can predict the upcoming layouts and plan your moves around each change until the demon awards the flag.