Verdict: SECURE — no reachable path to the bounty. The v2 challenge withstands every avenue examined: mathematical, implementation, RNG, network/node, and the complete public catalog of community-found breaks. Confidentiality reduces cleanly to the 128-bit entropy of the wallet mnemonic over a verified-clean key generation. There is no consolation payout — the 500,000 OCT write-up reward pays only after an actual key recovery.
| Item | Value |
|---|---|
| Challenge | Octra HFHE Challenge v2 |
| Bounty | 1,000,000 OCT (500,000 held in-wallet + 500,000 write-up reward) |
| Target wallet | octC5eR9pLGKbpzTbDgHowkFt8HW7LZYb2gzehzxHamxuAZ — confirmed funded |
| Winning condition | Recover the mnemonic encrypted in seed.ct and submit a valid transaction from the funded wallet before the challenge is withdrawn |
| Challenge repo | octra-labs/hfhe-challenge — release v2_fix, commit 08bf879 |
| Core library | octra-labs/pvac_hfhe_cpp — pinned commit 071b0e9 |
| Artifacts | pk.bin, seed.ct, params.json, manifest.json, SHA256SUMS, pvac_commit.txt |
| Manifest note | "No passphrase, PBKDF2, AES, sealed envelope" — plaintext is a raw BIP39 mnemonic string |
HFHE ("Hypergraph FHE") over the Mersenne prime field GF(2¹²⁷−1). The encrypted object is a 79-byte lowercase BIP39 mnemonic, packed into 15-byte blocks (5 × 15 bytes + one 4-byte block) and encoded as field elements.
x is published as T = x · R, where R ∈ F_p* is a secret, uniformly-distributed field element.L = P(g) = Σ sgnᵢ · wᵢ · g^idxᵢ, with edge weights wᵢ = R · coefᵢ.v = L0/R0 + L1/R1; masked as L0 = R0(v+m), L1 = R1(−m); recovery c_k = −L1/L0 (18 zero-padded blocks).prf_R_noise → AES-CTR → LPN (n=4096, τ=1/8) → Toeplitz extraction → F_p.powg_B = [g⁰ … g³³⁶] (trivial DLP, B=337), h_col_wt = 192, 22 ciphers / 44 layers, 44 unique nonces, 127-bit extraction, DFR = 0.Key-derivation chain (
keygen_from_seed):wallet_privkey→master = SHA256("OCTRA_PVAC_MASTER_V1" ‖ wallet_privkey)→canon_tag = SHA256("OCTRA_PVAC_TAG" ‖ master)[0:8](published as0x760802093a19931…) →sk_seed = SHA256("OCTRA_PVAC_SK" ‖ master)→prf_k, lpn_s_bitsfromseeded_rng(sk_seed). AES key =SHA256(prf_k ‖ canon_tag ‖ H_digest ‖ seed ‖ dom).
The challenge was attacked adversarially across five independent surfaces, plus the full public record of prior community breaks:
071b0e9), v1 → v2 hardening.lite_node OCaml source (consensus, stealth, balance encryption, RPC).pvac_hfhe_cpp issues and PRs.