Observed arrival · 2026-10-31
Brotli2Bitcoin: a document processor with a public bounty
CodeWall presents an internet-facing document processing service as a scoped server-exploitation challenge, with a stated $1,000 Bitcoin bounty.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Security researchers interested in scoped web challenges
- Worth noticing
- The rules exclude denial of service and limit testing to brotli2bitcoin.com; the page says identity checks may be required for payout.
Field notes
The stated win condition is narrower than simply finding a flaw: the participant must obtain server code execution, run `/readflag`, and email the output together with the method. The rules authorize testing only on this domain and expressly prohibit denial of service and targeting CodeWall people or accounts. Payout is described as the wallet balance at payout, and the page says identity verification may be required.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
◎NicheUnusually specific use
One card from the complete issue