Competition Rules & Fair Play Policy

We will try to enforce the below rules to the best of our ability.

All participants are expected to compete fairly, respect others, and uphold the spirit of the competition. By participating, you agree to the following rules.

1. Artificial Intelligence (AI) Usage

Core principle: AI may assist with narrow, participant-directed tasks, but it must not discover vulnerabilities, develop exploits, or solve challenges on a participant's behalf. The participant must perform the substantive investigation, reasoning, and exploitation themselves.

Prohibited uses:

• Autonomous or agentic AI. AI must not independently investigate challenge targets, identify vulnerabilities, plan attacks, execute tools, or carry out a challenge-solving workflow.
• AI-led vulnerability discovery or exploitation. Do not provide a challenge, binary, source code, or target to AI and ask it to find the vulnerability, determine the exploit path, or produce the solution for you.
• AI exploit generators. Tools or services that automatically generate working exploits, payloads, or end-to-end challenge solutions are prohibited.
• Tool-enabled AI chatbots and assistants. Online or local AI assistants with access to tools (such as terminals, code execution, browsers, target interaction, or agent integrations) are prohibited for challenge solving, even when used through a chat interface. Standalone search and retrieval tools are covered by the permitted-use exception below.

Permitted uses:

• Using AI as a search or retrieval (RAG) aid to locate documentation, recall concepts, or explain general technical material.
• Delegating small, well-defined, time-consuming tasks, such as identifying function names, explaining an isolated code fragment, or deobfuscating code in a pwn challenge.
• Generating routine commands or snippets (for example, Bash commands), provided the participant reviews, understands, and controls how they are used.

The boundary: AI may help with individual supporting steps; it may not make the key technical discoveries or assemble the attack or solution. Participants must be able to independently explain their methodology, identify the vulnerability, justify their decisions, and demonstrate how their solution works.

Penalties:

• First offense: All points earned from the affected challenge will be deducted.
• Repeated offenses: The team may be disqualified.

2. Teams, Accounts & Collaboration

• Qualifications: There is no limit on the number of members per team.
• Finals: Each team may have up to 4 members. Finalists do not have to be from the same country.
• Each participant may belong to one team only throughout the competition. Sharing members between teams is prohibited.
• Every participant must use their own account. Account sharing, credential sharing, and creating multiple accounts to gain an unfair advantage are prohibited.
• Collaboration is allowed only between registered members of the same team. Sharing solutions, challenge-specific hints, exploits, or other private challenge materials with other teams is prohibited.
• Receiving direct challenge-solving assistance from individuals outside your team, including outsourcing challenges to third parties, is prohibited.
• Public documentation, educational resources, and general-purpose technical tools are permitted, subject to the AI usage policy.

3. Flags & Solution Sharing

• Flag sharing is strictly prohibited. Sharing, selling, buying, or trading flags with other teams or external parties is not allowed.
• The member who solves a challenge must submit its flag using their own account. Submitting flags on behalf of another team member is prohibited.
• Flag hoarding is prohibited. Participants must not intentionally delay submitting solved flags to conceal progress, manipulate rankings, or gain an unfair advantage.
• Brute-forcing flags, mass-guessing, or using automated flag submission tools against the competition platform is prohibited.
• Publishing writeups, spoilers, or broadcasting active challenge solutions before the writeup embargo ends is prohibited without organizer permission.

4. Infrastructure & Fair Play

• Only systems and services explicitly designated as challenge targets may be attacked. Attacking the CTF platform, scoreboard, authentication systems, or other competition infrastructure is prohibited.
• Denial-of-Service (DoS/DDoS), excessive automated scanning, resource exhaustion, and other activities that disrupt challenge availability are prohibited.
• Attacking other participants or interfering with their progress is prohibited. This includes damaging shared environments, deleting challenge files, or intentionally crashing services.
• Exploiting scoreboard bugs, submission vulnerabilities, or unintended platform behavior to gain an advantage is prohibited. Any discovered infrastructure vulnerabilities must be reported privately to the organizers.
• Participants must follow challenge-specific instructions. Harassment, threats, impersonation, and other misconduct will not be tolerated.

Challenge-specific instructions may explicitly permit otherwise restricted techniques against designated targets.

5. Qualification Interviews & Solution Verification

All qualifying teams will undergo mandatory technical interviews to verify that their results reflect genuine technical understanding.

• Team members may be asked to explain the challenges they solved, their methodology, and the technical concepts involved.
• Interviews may include follow-up questions, practical demonstrations, or small variations of the original challenge to verify understanding.
• Simply memorizing or repeating a writeup is not sufficient. Participants must demonstrate that they understand how and why their solutions work.
• Failure to attend a required interview without an accepted justification may result in penalties.

Penalties:

• Failure to demonstrate adequate understanding may result in the deduction of the affected challenge's points.
• Repeated failures or deliberate misrepresentation may result in team disqualification.

6. Reporting Violations

• Suspected cheating, rule violations, or security issues must be reported privately through official competition channels.
• Participants should not publicly accuse other teams of cheating without reporting their concerns to the organizers.

Self-Reporting Protection:

Teams are encouraged to report violations committed by their own members. If a team voluntarily reports a violation and cooperates with the investigation:

• Points earned through the violation will be deducted, but the team will be allowed to attempt the affected challenge again.
• The responsible member will be banned.
• The remaining team members may continue competing, provided they were not involved in or knowingly concealing the violation.

This protection does not apply to teams that participated in or deliberately concealed the misconduct.

7. Monitoring & Enforcement

To maintain fair competition, organizers may use a combination of statistical analysis, submission timestamps, platform logs, technical interviews, solve artifacts, and other reasonable verification methods.

Special attention will be given to qualifying teams.

• Suspicious activity may trigger an investigation, but statistical indicators alone will not automatically establish a violation.
• Participants must cooperate with reasonable verification requests. Refusing to cooperate, providing misleading information, or obstructing an investigation may result in penalties.
• Depending on the severity and frequency of violations, penalties may include warnings, point deductions, individual bans, team disqualification, or revocation of qualification and prize eligibility.
• Serious misconduct, deliberate cheating, or attacks on competition infrastructure may result in immediate disqualification.
• Violations discovered after the competition may still affect final rankings and qualification.

8. Final Decisions

• The organizers reserve the right to interpret and enforce these rules, including addressing behavior that clearly violates the spirit of fair competition even if it is not explicitly covered.
• Rules may be updated when necessary, with significant changes communicated through official competition channels.
• The organizers' decisions regarding violations, scoring, and qualification are final.