Rules

Fair play

  1. Teams have at most 4 players. One account per person, and each player belongs to a single team.
  2. Do not share flags, hints or solutions with other teams, and do not publish write-ups before the competition ends.
  3. Cross-team collaboration is not allowed. Do not discuss challenges with members of other teams.
  4. Attacking the platform or its infrastructure (DoS / DDoS, scanning the scoreboard, attacking other players) is strictly prohibited. Only the targets listed in a challenge are in scope.
  5. Do not brute-force flags: submissions are rate-limited and some challenges limit the number of attempts. Automated scanners against challenge hosts are forbidden unless a challenge says otherwise.
  6. The root-me.cloud CTF organizers reserve the right to disqualify accounts or teams suspected of breaking the rules, and to adjust scores.

Flags

  1. Flags look like CTF{...} unless a challenge says otherwise.
  2. Submit flags from the challenge panel, exactly as you found them. Every submission is logged.

Scoring

  1. Every challenge is worth points. Dynamic challenges start at their full value and lose value as more teams solve them, down to a minimum. Everyone who solved a challenge gets its current value, so scores can go down during the competition.
  2. Free hints are shown on the challenge. Paid hints cost points: unlocking one deducts its cost from your team's score, once for the whole team, and cannot be undone.
  3. The organizers may award bonus points (for example for reporting a bug) or apply penalties.
  4. Teams are ranked by score. Ties are broken by who reached their score first.

Scoreboard freeze

  1. The organizers may freeze the scoreboard during the last hours. Solves made after the freeze stay hidden from the public scoreboard until the final results are revealed.

Reporting

  1. Report rule violations, unintended solutions and infrastructure issues to the organizers as soon as possible.