Real elliptic-curve keys, real escrowed bounties. Find k such that kG = Q before anyone else does. Unlike manual-reward contests, every bounty here sits in the QuanthoodCanary contract on Robinhood Chain — solve, claim, and the contract pays you directly. No team approval. No waiting.
Training rungs never move the threat level — they exist to measure public solving capability and reward it. 32 bits was already solved (first blood). Every bounty is visible on-chain in QuanthoodCanary.
Eight steps are too many. Quanthood needs four — the contract does the verification.
Find k offline or in the in-browser BSGS solver (app → Canary ladder). Never paste it anywhere public before you claim.
App → Canary ladder → enter rung id + k. The app builds the claim transaction locally — nothing leaves your browser.
QuanthoodCanary checks kG against the rung pubkey itself. Wrong k? Reverted, costs you nothing but gas.
Correct k → the contract sends the full bounty to your wallet in the same transaction and emits RungBroken. You are on the leaderboard the moment the tx lands.
Read straight from RungBroken events on-chain — nobody can fake an entry. Solved rungs with the claimer, block, and bounty paid.
| # | Tier | Claimer | Bounty | Block / tx |
|---|---|---|---|---|
| Reading on-chain events… | ||||
Every funded bounty is held by QuanthoodCanary itself. Quanthood cannot withdraw, delay, or veto a payout. If the rung is armed and unbroken, the money is there.
Bounties are first-come: the first valid claim transaction to land takes the whole rung bounty. Ties resolve by block order.
Training rungs (≤112 bits) are explicitly not armed: solving them pays you but never moves the on-chain threat level. Only armed rungs (128+ bits) are early-warning signals.
Unbroken training rungs can be refunded by their funder after the refund lock — so dead bounty money returns instead of rotting. Solvers should not count on unfunded rungs.
Any method is valid: our in-browser BSGS solver, your own code, cloud compute, or a quantum computer if you have one. The contract only checks the math.
Quanthood never asks for a seed phrase or private key. Solvers keep their k secret until the claim transaction.
Train on the curve, get paid in escrow, and help map what public compute can actually break.
OPEN THE SOLVER → BACK TO QUANTHOOD.TECH