Review the code.
Examine the application, its withdrawal logic, and the contracts supporting it. The source is public.
Honeypot repository (opens in a new tab)PRT Honeypot v2
Break the rules.
Claim the pot.
Real assets. Open code. An invitation to put Cartesi’s security to the test. Find a way to drain the funds locked in the Honeypot.
CTSI locked in the pot
Check the balanceCTSI
View the current balance on Ethereum.
Drain the pot to complete the challenge. No hacking recipe to submit and no hidden puzzle to uncover.
Verify on Etherscan (opens in a new tab)PRT fraud proofsPermissionless Refereed Tournaments
EthereumOnchain settlement and dispute resolution
Stage 2 appchain ↗L2BEAT assessment of PRT Honeypot v2 (opens in a new tab)
A simple rule.
A serious test.
The application accepts CTSI deposits, but only one preconfigured address can withdraw them. The challenge is to break that rule. Every attempt tests the application and the infrastructure protecting it.
Run a validator.
Reproduce execution and follow the rollup’s state with the Honeypot validator node.
Node instructions (opens in a new tab)Test the assumptions.
Understand how the application and fraud-proof system work together, then put them to the test.
Read the deep dive (opens in a new tab)Before you
take it apart.
How the challenge works, what to watch, and where to begin.
What happens if I deposit funds?
There is no exit for deposits. Any funds you send are treated as a donation to help test Cartesi Rollups’ security assumptions. The Foundation is the only authorized withdrawal address. We do not encourage deposits.
Can I follow along without being a developer?
Yes. Follow the contract’s activity on Etherscan (opens in a new tab), or keep up with updates on X (opens in a new tab) and Discord (opens in a new tab).
What counts as breaking the Honeypot?
Draining the funds in violation of the application’s withdrawal rule. The challenge is to demonstrate that the application or the system protecting it can be broken, with real assets at stake.
What happens when Cartesi Rollups is upgraded?
Development continues alongside the challenge. Major Rollups versions can lead to a new Honeypot deployment, with funds progressively transferred to the updated pot. For patches, the upgraded validator node is restarted. Follow the repository for the configuration and instructions for each deployment.
Is Honeypot a starting point for building an application?
Honeypot is designed as a security challenge. To start building, use the developer documentation (opens in a new tab) and the Rollups examples (opens in a new tab).
Where can I investigate the technical details?
Start with the Honeypot source (opens in a new tab), the technical deep dive (opens in a new tab), and the PRT paper. The resources below link directly to the contracts, node, research, and independent assessment.
Everything you need.
Out in the open.
Honeypot sourceThe application and its configuration.↗ (opens in a new tab)
Rollups contractsThe contracts behind the rollup.↗ (opens in a new tab)
Rollups nodeSoftware for operating a node.↗ (opens in a new tab)
PRT research paperThe fraud-proof protocol and its foundations.↗ (opens in a new tab)
L2BEAT assessmentPRT Honeypot v2’s architecture and trust assumptions.↗ (opens in a new tab)
Developer docsExplore Cartesi Rollups and the Cartesi Machine.↗ (opens in a new tab)