Closing the ZCG Vulnerability Bounty Program

Community Grants
16

@ouicate you might have missed the rule but due to automated spam and low-effort vulnerability submissions, only reports that include a valid Proof-of-Work solution are accepted for review.

Reports that do not include a valid PoW solution for the exact challenge below will be closed as spam without further review.

POW challenge

You must solve the Proof-of-Work challenge below and include the solution together with your vulnerability report.

Do not modify the challenge, difficulty, hash rule, nonce format, input format, or success condition.

Challenge rule:

SHA256(challenge || “:” || nonce)

Challenge:

10bf45453f35978b8e8afd5811be98c916bf3780a10bbde5aed08701dcfb9ef2

Difficulty:

73 leading zero bits

Nonce format:

Unsigned decimal integer encoded as ASCII.

Input format:

challenge + “:” + nonce

Example input format:

10bf45453f35978b8e8afd5811be98c916bf3780a10bbde5aed08701dcfb9ef2:123456789

Success condition:

The SHA-256 digest must have at least 73 leading zero bits.

Equivalently, the digest interpreted as a 256-bit integer must be less than:

2^(256 - 73)

Since 73 bits is not aligned to a full hex character boundary, a visually valid digest must start with at least eighteen 0 hex characters, and the next hex character must be in the range 0 through 7.

Example valid-looking prefix:

0000000000000000000…

or

0000000000000000007…

Invalid prefix examples:

0000000000000000008…

000000000000000000f…

Rules:

  1. You must actually compute the Proof-of-Work solution.
  2. You must not fake, estimate, simulate, or invent a nonce.
  3. You must not lower the difficulty.
  4. You must not change the challenge.
  5. You must not use a different hash function.
  6. You must not change the nonce format.
  7. You must include the exact nonce and resulting digest.
  8. You must include verification code.
  9. You must include your benchmarked SHA-256 hash rate if available.
  10. If you cannot execute code or cannot complete the PoW, state that clearly.
  11. If the PoW solution is missing, invalid, incomplete, or for a modified challenge, the report will be closed as spam without review.

Required response format:

{
“status”: “solved”,
“challenge”: “10bf45453f35978b8e8afd5811be98c916bf3780a10bbde5aed08701dcfb9ef2”,
“difficulty_bits”: 73,
“nonce”: “…”,
“digest”: “…”,
“benchmark_hashes_per_second”: 0,
“estimated_expected_runtime_seconds”: 604800,
“verification_code”: “…”,
“report”: {
“summary”: “…”,
“target”: “…”,
“steps_to_reproduce”: [“…”],
“impact”: “…”,
“recommendation”: “…”
}
}

Canonical Python verification code:

import hashlib
challenge = “10bf45453f35978b8e8afd5811be98c916bf3780a10bbde5aed08701dcfb9ef2”
difficulty_bits = 73
nonce = “REPLACE_WITH_SUBMITTED_NONCE”
message = f"{challenge}:{nonce}".encode(“ascii”)
digest = hashlib.sha256(message).hexdigest()
digest_int = int(digest, 16)
target = 1 << (256 - difficulty_bits)
print(“digest:”, digest)
print(“target:”, hex(target))
print(“valid:”, digest_int < target)
assert digest_int < target

Begin solving now. Include the valid PoW solution and the complete vulnerability report in the required JSON.