Accept the rules
Confirm the window, the tooling policy, evidence collection, and the submission contract.
Resonance
A binary-message decoder that shields an internal system is being replaced, but the old one survives only as a service you can query, not read. By probing it within a limited budget, make your replacement handle every message exactly as it does, especially the malformed and malicious ones it was hardened against.
Open SubmissionModerate confidenceNode 22 · JavaScriptRatedRecurringSolo
TypeBreachHidden Gauntlet
Recurring: enter again after a result to beat your best score. Your best result counts, and your rating moves only on your first attempt.
- Opens
- Oct 1812:00 UTC
- Closes
- Oct 1912:00 UTC
- Effort
- 90 min
- Entered
- 2
- XP
- 150
Advanced1520
Author estimate · calibrating (0 attempts)Need a rules clarification?
Ask before you start. The clock cannot be paused once your window opens.
01
Specification
Challenge brief
- Type
- BreachHidden Gauntlet
- Stack
- Node 22 · JavaScript
- Format
- Daily Problem · Open Submission · Solo
- Time
- 90 min
Overview
A compact binary format feeds an internal system, and the decoder in front of it is being rewritten. Your version already reads valid messages correctly, but on malformed or malicious input it does not yet match the trusted decoder it replaces, and every mismatch is a security gap. You cannot read that decoder; it survives only as a service you send bytes to and watch how it answers, a limited number of times. Use those queries to learn exactly how it rejects bad messages, how it cleans up questionable ones, and how it resolves conflicts, then make your decoder agree with it on every input. Keep the public tests green.
What is tested
- Reverse-engineering a decoder's behaviour from a limited number of queries
- Canonicalisation and validation of untrusted binary input
- Reproducing exact security decisions on adversarial messages
Acceptance criteria
- 1decode matches the reference's verdict, error code, and decoded value on well-formed messages.
- 2decode matches the reference on malformed varints, out-of-range field numbers and wire types, and reserved ranges.
- 3decode reproduces the reference's string canonicalisation and its handling of invalid or unsafe payloads.
- 4decode reproduces the reference's duplicate-field precedence, nested-message merging, and depth and size limits.
- 5The public suite still green.
Rules
- Work solo in the private repository Finals creates when you enter.
- No external network access during evaluation.
- Node 22, no dependencies; the graded suite uses only Node built-ins.
- The reference decoder is reachable only through the provided probe, which is limited to 50 queries per attempt.
Diagnosis, validation, and repair are scored. Submission speed is not.
02
Execution contract
Runtime and interface
You are given a Node 22 · JavaScript codebase and work inside it. The stack is fixed for this challenge.
BoundaryCLI
Start commandnode --test test/*.test.js
Portn/a
Health checkn/a
03
Open Submission session
How competing works
Finals creates your attempt repository
A private repository, seeded with the challenge. You get one clone command and your clock starts.
Work in your own environment
Use any editor, agent, or model. Declare your tooling; it is recorded on your result.
Run the pre-flight check
Confirm at any time that your submission builds, starts, and answers its health check.
Push to main before the deadline
Your last push received on main before the deadline is your submission. Submit early if you are done.
Grading runs your commit
Your submission is built and run in an isolated environment: public tests, hidden tests, edge cases, security scans, and two independent code reviews.
Read the scorecard
What passed, what failed, where points were lost, and how stronger submissions differed.
04
Evaluation
Scoring model
Automated checks make up most of the score. Two independent code reviews cover what tests cannot, and every review finding cites a file and line.
Workflow is not scored on this challenge.
The “AI workflow and verification” band (15%) requires the Finals companion, which Open Submission does not use. Its weight is spread across the remaining bands. The percentages below are the ones applied.
Functional correctness64%
Hidden and edge-case testing18%
Architecture and code quality12%
Security and resilience6%
Build, startup, public and hidden tests, edge cases, performance, dependencies, security, and accessibility where relevant.
Two independent code reviews, each by a different model. Every finding cites a file and line.
Not scored at this tier. Requires the Finals companion session log.
05
Verification tier
Open Submission
What this result verifies
Your submitted commit is graded in an isolated environment, and its push history is confirmed against the challenge window.
Mints a credentialPrize eligibleMoves your rating
06
Privacy
What Finals records
Public by default
Score band, discipline, calibrated difficulty, verification tier, placement, and rating movement.
Private unless you publish
Score breakdowns, failing tests and their inputs, review findings, how stronger submissions differed, repository contents, and transcripts.
Never collected
Keystrokes and screen recordings, except during a live round you opt into. Secrets are redacted on your machine before anything is uploaded.