VVVulnVerse'26Online round
  • BriefingPage
  • OperationsPage
  • StandingsPage
  • IntelPage
  • Rules of engagementPage
  • SquadPage
  • ProfilePage
--:--Event
VulnVerse'26Online round

Rules of engagement

  1. 01Squads

    1. 1.1

      A squad has 2–4 players. One account per person, one squad per account.

    2. 1.2

      Once operations open you can still form or join a squad, but you can't leave one.

    3. 1.3

      Accounts are personal. Don't share a login or play on someone else's.

    4. 1.4

      Organisers rename any squad name that is offensive.

  2. 02Window

    1. 2.1

      Operations open at H-hour and close at the end time on the briefing clock. Flags are accepted only in between.

    2. 2.2

      If the board freezes in the final stretch, Intel announces it. Solves after a freeze still count.

    3. 2.3

      Some operations release later in the event. Their opening time shows on the sealed card.

  3. 03FlagsBreach = disqualification

    1. 3.1

      Flags look like FLAG{…} unless the dossier says otherwise.

    2. 3.2

      Many flags are unique to your squad. A flag submitted by the wrong squad is logged as flag sharing, and both squads can be disqualified.

    3. 3.3

      Submissions are limited to 5 per 30 seconds per operation and 30 per 5 minutes per account. Some operations cap total attempts.

    4. 3.4

      Don't brute-force the flag form. Every attempt is logged.

  4. 04Scoring

    1. 4.1

      Scoring is dynamic: an operation is worth less as more squads clear it, and every squad that cleared it holds its current value.

    2. 4.2

      Hints cost the points shown on them, deducted when unlocked, solved or not.

    3. 4.3

      First blood is marked on the dossier and the board. It earns no extra points.

    4. 4.4

      Ties go to the squad that reached the score first.

    5. 4.5

      Organisers may adjust a score for a rule breach. Adjustments show on the board.

  5. 05TargetsBreach = disqualification

    1. 5.1

      Attack only the targets a dossier gives you. The platform, its hosting, other squads and organisers' systems are out of scope.

    2. 5.2

      Instances are per squad and run 45 minutes. A squad can start 6 per 10 minutes.

    3. 5.3

      No denial of service against anything, instances included.

    4. 5.4

      Found a bug in the platform? Report it to the organisers. Don't use it.

  6. 06ConductBreach = disqualification

    1. 6.1

      Don't share flags, solutions or hints outside your squad until the event ends. Writeups are welcome after that.

    2. 6.2

      Harassing players or organisers gets a squad removed.

  7. 07Finals

    1. 7.1

      The top squads go on to the on-campus round at IAR University. How many is announced on Intel.

  8. 08Decisions

    1. 8.1

      GDGoC IAR and CyberDefence Lab rule on anything these rules don't cover. Their call is final.