296 challenges · 17 vulnerability classes · 9 languages
Security challenges.
Real code, single-line vulnerabilities. Filter by stack, difficulty, or vulnerability class.
296total
85easy
148medium
63hard
medium
FairSplit Staking
FairSplit is a yield protocol where users stake ETH and earn a share of each epoch's rewards. The team prides itself on "truly fair" distribution: every epoch, rewards are split proportionally and pushed directly to stakers so nobody has to claim manually. Staking is permissionless and there's no minimum — the docs say "stake as little as you want." Review the staking and distribution logic and look for a way an attacker could break the protocol for everyone.
LanguagesolidityVulnerabilityDoS (Denial of Service)DomainBlockchain
150 ptsOpen challenge →
medium
Chart Cache
CareCache is a telehealth portal built with gqlgen. Patients use a persisted `patientChart($id: ID!)` query to retrieve diagnoses, prescriptions, insurance details, and clinical notes before appointments. A Redis response cache was added to reduce resolver load during clinic hours. Review how the cache decides whether two GraphQL requests are the same, especially when persisted queries, variables, and authenticated patients are involved.
LanguagegoVulnerabilityInformation DisclosureDomainGraphQL
150 ptsOpen challenge →
easy
CareLink Logins
CareLink is a telehealth portal where patients book video consults and view lab results. The team recently shipped a new account system with registration and login. During a security review of the authentication module, take a close look at how patient passwords are stored and verified before this goes live for a regulated health platform.
LanguagepythonVulnerabilityAuthenticationDomainWeb
100 ptsOpen challenge →
easy
Keep Me Logged In
ShiftPay is a Spring Boot payroll portal where hourly workers sign in to view payslips and update their bank deposit details. To keep people signed in across visits, the team added a 'Keep me logged in' option that drops a long-lived remember-me cookie, and a filter reads that cookie to auto-authenticate returning users. Review how the remember-me token is generated and trusted before a forged cookie hands someone else's paychecks to an attacker.
LanguagejavaVulnerabilityAuthenticationDomainWeb
100 ptsOpen challenge →
Showing 12 of 296
Full archive
Premium unlocks all 296 challenges.
Full challenge access, the complete archive, and learning paths.