A guy with no engineering background
and an AI built a server-mesh defence system.
Four nodes. Four providers. One threshold key that exists nowhere. Forge a signature against today's rune and the cluster goes dark. No bounty. Just glory.
…
Bifrost watch — cluster status
Four edges, four jurisdictions, polled every 30 seconds. Heimdall's job: all four must agree on group_pub or the bridge is fractured.
The five trials — Heimdall's vigil
Heimdall guards the Bifrost. He sees all, hears all. Can you reach the other side before he sounds the Gjallarhorn?
- Draugr Barrow-breach
Find a planted flag on any single edge. The draugr stirs. - Berserker Hall-breaker
Recover a flag from a guarded database. Heimdall turns his head. - Skald Bridge-walker
Flags from two or more edges. You moved between realms uninvited. - Seiðr Rune-forger
Forge the cluster's threshold signature. The Gjallarhorn sounds. Bifrost shatters. - Einherjar The Unseen
Achieve Seiðr without a single alert. Heimdall saw nothing. Valhöll awaits.
Canaries, honey ports, and DNS sentinels do not banish you — they silently record that Einherjar is no longer in play. Full trial details on the rules page.
Today's rune — the Seiðr challenge
This is what you need for the crown jewel. Draugr, Berserker, and Skald captures use planted flags — you'll know the format when you find them.
——
—
How the Seiðr works
- Get the cluster to FROST-sign the canonical bytes shown above.
- Paste the resulting Ed25519 signature below (64 bytes, 128 hex chars).
- Verifier runs
ed25519.Verify(group_pub, canonical_bytes, signature). - If valid: cluster broadcasts SHUTDOWN over Gleipnir, all four edges go dark, your name goes in Valhöll.
The canonical preimage is SHA-256("hyveheim-challenge-v1" || 0x00 || YYYY-MM-DD || 0x00 || group_pub_bytes). It rotates daily at 00:00 UTC. Future days can't be precomputed because group_pub is part of the input — and a season rollover (new DKG) replaces group_pub entirely. Ragnarök every 90 days.
Modern browsers (Chrome 113+, Firefox 130+, Safari 17+) verify signatures locally via WebCrypto Ed25519 before the form ships them — you'll see VALID or INVALID before the cluster sees a thing.
Cast your runes — submit a capture
One form for all five trials. The cluster auto-detects the format and verifies in constant time. No email required. Email at
[email protected]
(PGP key) is reserved for CVE-style vulnerability disclosure only.
Rules of engagement — short version
- In scope: the four edge nodes, their published services, and any service advertised on this page.
- Out of scope: denial-of-service, attacks on providers / Cloudflare / registrar, social-engineering the operator, attacks on other tenants.
- Safe harbour: we will not pursue legal action against in-scope research. Full text on the rules page.
- Disclosure: PGP-encrypted email to
[email protected](key). Acknowledgement within 72h.
The eight locks — active defences
Eight mechanisms guard the Bifrost. Each one independently detects or prevents a class of attack. Researchers: this is what you're up against.
What Huginn & Muninn saw — activity
Memory and Thought, ravens of Odin. They count what touches the perimeter. Counts roll up across all four edges, refreshed every 30s.
Technique mix — how the perimeter is being touched
Want to know how the cluster broke itself twice in one night? Read the sagas.
Valhöll — hall of fame
Empty. The mead has been poured but no warriors have arrived. First entry pending.
The skalds — registered handles
Researchers who staked an alias for credit. A small proof-of-work (~1 second) is all it takes. How to register →
loading…