Public verifier

A monitor and a floating keyboard drawn in white line

Re-run Proof #0001

One line

SITE=https://www.decompilebounty.com
curl -fsSL "$SITE/verifier/verify.sh" | SITE="$SITE" sh -s -- 0001

# what verify.sh does, in order
#  1  GET /api/v1/verdicts/<n>            read the hashes: program, corpus, candidate, source, report
#  2  GET /verifier/SHA256SUMS            check the replayer source tarball
#  3  GET /api/v1/corpus/<sha256>         check the corpus bundle
#  4  GET /api/v1/teardown/<program>/elf  the original ELF from the snapshot
#  5  GET /api/v1/candidates/<sha256>     the binary the judge built from the source
#  6  cargo build --release --locked      build the replayer, check both binary hashes
#  7  replayer replay ... --fuzz 10000    re-run every case
#  8  sha256 report.json                  MATCH when it equals the published report hash

Files

File	sha256	Size
replayer-src.tar.gz The replayer source: Cargo.toml, Cargo.lock and src/	2207d88e1e4a8269307880db39e0ea4aa3f2566dd61060bf88df84ecfd807833	29.3 KB
verify.sh Downloads a verdict and its inputs, checks every hash, re-runs the replay	2c384e6cb71e54217f5c09868c972b40ddb7a44113dc1acccfdb1e8661b157b3	4.1 KB
README.txt What the files are and how to run them	f871f6aabd5524bb8d48ed9db2669c966761955b022c985a4881be2a72f731e6	1.2 KB
SHA256SUMS The hashes above

Every rule the replayer applies is in The judge and the replay, and the steps by hand are in Verifying a verdict.

Questions

What do I need?

curl, tar and a Rust toolchain with cargo (1.89 or newer). python3 helps read the JSON; the script falls back to sed without it.

Why would my report hash be the same as the judge's?

The report holds no timestamp and no host data, and the fuzzed cases come from a seed derived from the corpus hash. The same binaries and the same corpus give the same bytes on any machine.

Can I use it before submitting?

Yes. Build your crate with cargo build-sbf, take the bounty's corpus and the original ELF, and run the replayer yourself. Submit only what passes on your machine.

What if my hash differs?

The script stops and keeps every file in its work folder, report.json included, so the two reports can be compared line by line.