Solve
Win a bounty
Each level is a math puzzle with a prize locked in a contract. Solve one first and the contract pays you. No sign-up, no permission, nobody to ask.
The puzzles are the problems that protect real keys and signatures, sized from easy to impossible. The time each one stands before it falls is the measurement LVL256 exists for. My claims
Four steps
The same on every chain. Your wallet signs two small transactions; anyone can send the last one.
- 01
Pick a level
Choose an open level below. Its page lists the numbers that define the puzzle.
- 02
Solve it
Find the secret number. Small levels solve in your browser in under a minute. Big ones take serious hardware, which is the point.
- 03
Commit
Send a sealed fingerprint of your answer, tied to your payout address. Nobody can read it, and copying it would still pay you.
- 04
Reveal, get paid
A few blocks later, reveal the answer. After a short settlement window anyone can finalize, and the contract pays the prize.
Open now
117 open on BNB testnet, Sepolia and Solana devnet. Biggest prizes first, then the easiest.
| Level | Chain | Prize | Est. cost (CPU) | Solve with |
|---|---|---|---|---|
| 104-bit Elliptic curve · secp256k1-shaped | BNB | 250 tUSD | $1,792 | GPU |
| 104-bit Elliptic curve · secp256k1-shaped | ETH | 250 tUSD | $1,792 | GPU |
| 64-bit Elliptic curve · secp256k1-shaped | BNB | record | under $1 | In your browser |
| 64-bit Elliptic curve · secp256k1-shaped | ETH | record | under $1 | In your browser |
| 64-bit Elliptic curve · random curve | BNB | record | under $1 | In your browser |
| 64-bit Elliptic curve · random curve | ETH | record | under $1 | In your browser |
| 72-bit Elliptic curve · secp256k1-shaped | BNB | record | under $1 | GPU |
| 72-bit Elliptic curve · secp256k1-shaped | ETH | record | under $1 | GPU |
| 72-bit Elliptic curve · random curve | BNB | record | under $1 | GPU |
| 72-bit Elliptic curve · random curve | ETH | record | under $1 | GPU |
107 more open levels. See them on the ladder
Solving
Two ways in: the browser for small levels, your own machine for the rest.
In your browser
Open a small level and press Start.
The 64-bit elliptic-curve levels are small enough for a laptop. The level page runs a Pollard rho search on every core you give it, about 20 million steps a second per core. An average 64-bit run is 3.8 billion steps, about 24 s on 8 cores. The answer is checked in your browser and dropped straight into the claim form.
Solve the 64-bit levelOn your machine
The reference solver, from the source.
The same rho search in native Rust, on every core. It prints d as 32-byte hex, ready to paste into the claim form. This command is filled in for the open level above.
cd packages/ref-rs cargo run --release --bin solve_ecdlp -- \ 9223372036854783571 0 7 9223372034947717963 \ 2617508912950131665 5997218944238621264 \ 1196436043811112316 1981393852820478748
Needs Rust. Curves up to 64 bits.
Big levels
Above 64 bits the reference tools stop on purpose. The larger elliptic-curve levels need a GPU implementation of Pollard rho with the negation map and, on secp256k1-shaped curves, the curve's extra symmetry. Lattice levels need lattice reduction or sieving tools, and hash levels a large search. Each level page states the estimated work (from 2³⁰·⁵ steps at 64 bits to 2⁶⁶·⁵ at 136 on secp256k1-shaped curves), and the instance on the page plus the method is everything a solver needs.
Winners
Every fallen level on every chain, with the transaction that paid it.
| Level | Solver | Stood for | Prize | Paid |
|---|---|---|---|---|
| 64-bit Elliptic curve · secp256k1-shaped · ETH | 0x4690…42EF | 18 h | 25 tUSD | Oct 15, 2026 |
| 64-bit Elliptic curve · secp256k1-shaped · BNB | 0xc8F2…A1Fa | 31 s | 25 tUSD | Oct 14, 2026 |
For developers and AI agents
Everything on this site is readable by a program, and every action is a plain contract call. Agents can take part on the same terms as people.
Read: the JSON API
curl https://publisher-production-0301.up.railway.app/api/states curl https://publisher-production-0301.up.railway.app/api/rung/<rungId>
/api/states lists every chain with its ladder address and levels: id, family, size, status, prize, the encoded parameters and the public instance. /api/rung/<id> returns one level, its chain id and its events. The same data is onchain in getRung(id).
For agents
/llms.txt describes the whole loop in plain text for a language-model agent: where the open levels are, how to decode them, how to commit safely, and when to reveal.
Write: the contract
# c = keccak256("SHORLINE/v1" ‖ "/commit" ‖ chainid ‖ rungId ‖ keccak256(solution) ‖ claimant ‖ salt)
C=$(cast call $LADDER "commitmentOf(bytes32,bytes,address,bytes32)(bytes32)" $RUNG $SOLUTION $CLAIMANT $SALT)
cast send $LADDER "commit(bytes32,bytes32)" $RUNG $C
# after revealDelay blocks
cast send $LADDER "reveal(bytes32,bytes,address,bytes32)" $RUNG $SOLUTION $CLAIMANT $SALT
# after settleWindow seconds; anyone may send it
cast send $LADDER "finalize(bytes32)" $RUNGLadder contracts: BNB 0xceE9…f856 · ETH 0x5D63…8277
ECDLP answers are d as 32 bytes, big-endian. Keep the salt until the claim is paid: without it a commitment can never be revealed.
Committed something? Your claims, their stage and the next button are on one page.
My claims