TRY TO BREAK IT
Attack it yourself.
Every row below is a real attack, run live from your browser against Thuli's proof vault on Base Sepolia, which is a separate vault from the demo campaign's, or against this site's own routes. Nothing here is a recording. The vault rows ask the chain to try each call without sending it, so no transaction is made and you need no wallet. Press a button and read what comes back.
0 of 10 run
READING THE VAULT'S ACTIVE ROOT
- 01VAULT
Claim another wallet's reward
A wallet that is not on the list asks the vault for the 1 USDC.
- 02VAULT
Claim the same reward twice
The wallet that was already paid asks again with its real proof.
- 03VAULT
Claim more than the list says
The listed wallet asks for double its amount.
- 04VAULT
Thuli's own key takes the pool
The key that posts lists tries to withdraw the vault's money.
- 05VAULT
A stranger posts a new list
An address with no role posts a list that pays itself.
- 06API
A mistyped address
One wrong letter in an address must be refused, never quietly accepted.
- 07API
A paid answer without paying
Ask the paid route for a screening and send no payment.
- 08API
A forged payment
Send the paid route a payment header that is not a payment.
- 09API
An oversized request
Send two kilobytes where one is the limit.
- 10PAGE
Markup in a reason
A reason is model text. If it carried a script, it must show as text and do nothing.
WHAT THIS PAGE CANNOT SHOW
- A replayed payment. That needs a funded wallet. The proof run paid once and replayed the same payment ten times for nothing: the settlement on BaseScan
- A forged appeal. That needs a wallet with a held decision in a campaign. The appeal route refuses a signature that does not match its text, and that check is tested.
- Talking the model into paying a farm. The protection is structural: what the model reads holds only numbers, fixed words, addresses and hashes, and code sets a ceiling the model cannot lift.
- Farmers who leave no shared trace. Thuli does not catch them, and says so. Limits