v8CTF Rules
The v8CTF is a part of the Google VRP in which we reward successful exploitation attempts against a V8 version running on our infrastructure.
This program is orthogonal to the Chrome VRP, if you find a bug and exploit it, you can submit the bug to the Chrome VRP and use the exploit for the v8CTF.
Rules
The following rules apply to the eligibility of exploits starting with M156:
- Your exploit needs to exfiltrate the flag from our v8CTF infrastructure.
- Every bug used in the submission (e.g. V8 memory corruption, V8 sandbox) must have been found by you as the first reporter.
- Exploits need to be reasonably fast and stable. We accept submissions with an average runtime of less than 1 minute and at least 80% success rate.
- Valid submissions get a reward of $20,000.
Submission Process
- Make sure to report the bugs first to the Chrome VRP.
- Exploit the bug and capture the flag from our v8CTF environment.
- The flag format is v8CTF{$unix_timestamp:$signature}.
- Create a .tar.gz archive of your exploit and calculate its sha256, e.g. with
sha256sum exploit.tar.gz.
- Provide an archive that can be verified using our reproduction setup (see kctf/challenge-templates/repro-chrome/README.md)
- Please double check that the exploit doesn’t have any external dependencies.
- Fill out this form with the flag and the exploit sha256 sum. You need to use the same email address you reported the bugs from.
- A bug in the Google Issue Tracker will be filed on your behalf. Attach the exploit matching the sha256 sum and a short write up to the bug.
- Give us a few days to validate your submission.
Setup
You can find a description of our v8CTF infrastructure in the README.
Communication
We have two discord channels set up on the Capture The Flag server:
- #v8ctf-announcements: will be used for announcements such as changes to the rules and the start time for n-day submissions.
- #v8ctf: is open to all. If you have any questions, please ask here.
And you can find data about existing submissions in this sheet.