How the ladder works.

Nobody picks an instance

A level is scheduled with its parameters only. When it opens, anyone can commit it to a block a few seconds in the future. Once that block exists, anyone can seal the level: the seed is the hash of the level id and that block's hash, read through the EIP-2935 history contract. If nobody seals it within about an hour, it is committed to a new block. The publisher does this automatically, but every step is open to anyone.

seed = keccak256("SHORLINE/v1" ‖ "/seed" ‖ rung_id ‖ blockhash(N) ‖ 0³²)

The full byte-level specification, test vectors and two independent reference implementations are in the source repository. The contracts and this site reproduce the same vectors.

The contract checks every parameter

Elliptic-curve levels are checked onchain before any prize is locked: the field and group order pass 64 rounds of Miller–Rabin with bases derived from the numbers themselves, the generator is re-derived from the curve, the group order is confirmed, and the curve is ruled out for anomalous and low-embedding-degree attacks. Lattice levels check the modulus and the bound. Hash levels check the shape.

Nobody can steal a claim

A solver first commits to a fingerprint that binds the solution to their own payout address, then reveals it a few blocks later. Copying the fingerprint still pays the original solver. Copying a revealed solution only produces a later commitment, and the earliest valid commitment wins. Hash solutions include the solver's address in the input, so they are worthless to anyone else.

Small lattice solutions are verified in full at reveal. Large ones are accepted with a bond and can be disproved during the settlement window by naming a single row of A·z that is not zero. The publisher checks every such claim and files the proof itself; anyone else can too.

Every cost is labeled

Today's costs are estimated, not benchmarked. Elliptic-curve and hash costs come from real solves and throughput measured on a single CPU core, extrapolated with the standard rho and brute-force models. Lattice costs come from lattice-estimator, which is conservative next to published sieving records. Dollar figures assume $0.02 per CPU core-hour. A GPU calibration run replaces all of this before mainnet prizes.

How to solve a level

1. Open a level on the ladder and copy its parameters. Everything needed is on the level page.
2. Solve it with any method. Small elliptic-curve levels solve in the browser, right on the level page. The repository also includes a parallel Pollard rho solver:

   cargo run --release --bin solve_ecdlp -- p a b n Gx Gy Qx Qy

3. Paste the answer into the claim form. It is checked in your browser before anything is sent.
4. Commit, wait a few blocks, reveal. After the settlement window anyone can finalize, and the prize is paid.

The full guide, with the open levels, the commands and the API for programs.

Year one

A $5,000 seed funds the first year. Three sentinel series at a fixed $250 release on a fixed schedule, so their fall times stay comparable. Three frontier levels sit above the public state of the art. Every other step of the ladder is open as a record level with no prize. Mainnet waits for an independent audit, a parameter review and GPU calibration.

See the schedule · Sources