Live on Sepolia · block 11,947,898
The ladder
The same levels run on 3 chains, each with its own escrow and its own record. Open levels sit on the line. A fallen level drops below it, with the time it took.
Win a bounty. Pick a level, solve it, get paid by the contract. The smallest levels solve in your browser.
How to solveYear one
Fixed prizes on a fixed schedule, so fall times stay comparable. Every prize is in escrow before its level opens.
- Oct 19, 2026FrontierElliptic curve · secp256k1-shaped · 128-bitOpen
- Oct 19, 2026FrontierLattice · near-SVP · dimension 220Open
- Oct 19, 2026FrontierHash · reduced rounds · 6 roundsOpen
- Oct 19, 2026Sentinel A · release 1Elliptic curve · secp256k1-shaped · 104-bit250 tUSDOpen
- Oct 14, 2026Testnet demo · release 1Elliptic curve · secp256k1-shaped · 64-bit25 tUSDFallen
- Dec 13, 2026Sentinel A · release 2Elliptic curve · secp256k1-shaped · 104-bit250 tUSDScheduled
- Feb 11, 2027Sentinel A · release 3Elliptic curve · secp256k1-shaped · 104-bit250 tUSDScheduled
- Apr 12, 2027Sentinel A · release 4Elliptic curve · secp256k1-shaped · 104-bit250 tUSDScheduled
- Jun 11, 2027Sentinel A · release 5Elliptic curve · secp256k1-shaped · 104-bit250 tUSDScheduled
- Aug 10, 2027Sentinel A · release 6Elliptic curve · secp256k1-shaped · 104-bit250 tUSDScheduled
Elliptic curves
Discrete logarithms on secp256k1-shaped and random curves. The math behind every wallet signature.
secp256k1-shaped
22424025627264-bit · secp256k1-shapedfell in 18 h72-bit · secp256k1-shapedest. under $1 on CPU80-bit · secp256k1-shapedest. under $1 on CPU88-bit · secp256k1-shapedest. $7 on CPU96-bit · secp256k1-shapedest. $112 on CPU104-bit · secp256k1-shapedest. $1,792 on CPU112-bit · secp256k1-shapedest. $28,666 on CPU120-bit · secp256k1-shapedest. $458,659 on CPU128-bit · secp256k1-shapedest. $7.3×10⁶ on CPU136-bit · secp256k1-shapedest. $2.6×10⁸ on CPU
random curve
22424025627264-bit · random curveest. under $1 on CPU72-bit · random curveest. under $1 on CPU80-bit · random curveest. under $1 on CPU88-bit · random curveest. $12 on CPU96-bit · random curveest. $194 on CPU104-bit · random curveest. $3,103 on CPU112-bit · random curveest. $49,651 on CPU120-bit · random curveest. $794,421 on CPU128-bit · random curveest. $1.3×10⁷ on CPU136-bit · random curveest. $4.6×10⁸ on CPU
| Level | Role | Prize | Est. cost (CPU) | Status |
|---|---|---|---|---|
| 64-bit secp256k1-shaped | Record | — | under $1 | Open |
| 72-bit secp256k1-shaped | Record | — | under $1 | Open |
| 80-bit secp256k1-shaped | Record | — | under $1 | Open |
| 88-bit secp256k1-shaped | Record | — | $7 | Open |
| 96-bit secp256k1-shaped | Record | — | $112 | Open |
| 104-bit secp256k1-shaped | Record | — | $1,792 | Open |
| 112-bit secp256k1-shaped | Record | — | $28,666 | Open |
| 120-bit secp256k1-shaped | Record | — | $458,659 | Open |
| 128-bit secp256k1-shaped | Frontier | — | $7.3×10⁶ | Open |
| 136-bit secp256k1-shaped | Record | — | $2.6×10⁸ | Open |
| 64-bit random curve | Record | — | under $1 | Open |
| 72-bit random curve | Record | — | under $1 | Open |
| 80-bit random curve | Record | — | under $1 | Open |
| 88-bit random curve | Record | — | $12 | Open |
| 96-bit random curve | Record | — | $194 | Open |
| 104-bit random curve | Record | — | $3,103 | Open |
| 112-bit random curve | Record | — | $49,651 | Open |
| 120-bit random curve | Record | — | $794,421 | Open |
| 128-bit random curve | Record | — | $1.3×10⁷ | Open |
| 136-bit random curve | Record | — | $4.6×10⁸ | Open |
Lattices
Short integer solutions. The hard problem behind post-quantum signatures such as ML-DSA.
near-SVP
248264280dimension 100 · near-SVPest. $4 on CPUdimension 112 · near-SVPest. $38 on CPUdimension 124 · near-SVPest. $400 on CPUdimension 136 · near-SVPest. $3,936 on CPUdimension 148 · near-SVPest. $38,762 on CPUdimension 160 · near-SVPest. $381,775 on CPUdimension 172 · near-SVPest. $3.5×10⁶ on CPUdimension 184 · near-SVPest. $3.5×10⁷ on CPUdimension 196 · near-SVPest. $3.2×10⁸ on CPUdimension 208 · near-SVPest. $3.1×10⁹ on CPUdimension 220 · near-SVPest. $3.3×10¹⁰ on CPUdimension 232 · near-SVPest. $3.0×10¹¹ on CPU
module
248264280dimension 96 · moduleest. $2 on CPUdimension 128 · moduleest. $857 on CPUdimension 160 · moduleest. $381,775 on CPUdimension 192 · moduleest. $1.5×10⁸ on CPUdimension 224 · moduleest. $6.6×10¹⁰ on CPU
approximate
240256272288step 1 · approximateest. under $1 on CPUstep 2 · approximateest. $2 on CPUstep 3 · approximateest. $50 on CPUstep 4 · approximateest. $2,783 on CPUstep 5 · approximateest. $356,209 on CPUstep 6 · approximateest. $7.0×10⁶ on CPUstep 7 · approximateest. $2.6×10⁸ on CPUstep 8 · approximateest. $1.7×10¹⁰ on CPUstep 9 · approximateest. $2.1×10¹² on CPU
Hash control
Keccak partial preimages. Their cost is known exactly, so they calibrate everything else.
24 rounds
24025627240-bit target · 24 roundsest. under $1 on CPU44-bit target · 24 roundsest. $14 on CPU48-bit target · 24 roundsest. $221 on CPU52-bit target · 24 roundsest. $3,530 on CPU56-bit target · 24 roundsest. $56,475 on CPU60-bit target · 24 roundsest. $903,594 on CPU64-bit target · 24 roundsest. $1.4×10⁷ on CPU68-bit target · 24 roundsest. $2.3×10⁸ on CPU72-bit target · 24 roundsest. $3.7×10⁹ on CPU76-bit target · 24 roundsest. $5.9×10¹⁰ on CPU
| Level | Role | Prize | Est. cost (CPU) | Status |
|---|---|---|---|---|
| 40-bit target 24 rounds | Record | — | under $1 | Open |
| 44-bit target 24 rounds | Record | — | $14 | Open |
| 48-bit target 24 rounds | Record | — | $221 | Open |
| 52-bit target 24 rounds | Record | — | $3,530 | Open |
| 56-bit target 24 rounds | Record | — | $56,475 | Open |
| 60-bit target 24 rounds | Record | — | $903,594 | Open |
| 64-bit target 24 rounds | Record | — | $1.4×10⁷ | Open |
| 68-bit target 24 rounds | Record | — | $2.3×10⁸ | Sealing |
| 72-bit target 24 rounds | Record | — | $3.7×10⁹ | Open |
| 76-bit target 24 rounds | Record | — | $5.9×10¹⁰ | Sealing |
| 3 rounds reduced rounds | Record | — | see method | Open |
| 4 rounds reduced rounds | Record | — | see method | Sealing |
| 5 rounds reduced rounds | Record | — | see method | Sealing |
| 6 rounds reduced rounds | Frontier | — | see method | Open |
Activity
Straight from contract events. Newest first.
- PaidElliptic curve · 64-bit15 h ago0xa929…30e5
- CommitmentElliptic curve · 64-bit15 h ago0xd8d0…0e6d
- CommitmentElliptic curve · 64-bit15 h ago0xaa4d…a4d7
- Solution revealedElliptic curve · 64-bit4 days ago0x9b15…5046
- CommitmentElliptic curve · 64-bit4 days ago0xc05d…6ec9
Costs are estimated, not benchmarked: single-core CPU measurements and lattice-estimator, priced at $0.02 per core-hour. GPU calibration replaces them before mainnet. Method