# Epsilon Drift

Solved in 2 minutes. The answer hid one unit in the last place and a negative zero.

HI Cyber Con CTF 2026. Reverse engineering. Published 2 November 2026. Challenge by Hidden Investigations.

## The brief

> Recovered from the tail of a solver run log. Step 48216, residual 3.300000000000000e+00, WARN rounding. Step 48218, calibration vector ACCEPTED, unlocked run config. The validator was kept standalone. Feed it the calibration vector as one argument, hex encoded, and it reprints the run config it unlocks. Off spec vectors just log drift. The vector itself was not archived.

- epsilon-drift.zip, 541 KB

## In short

A Linux validator reads its argument as four IEEE 754 doubles. Bit field equations pin the first two to 1.1 and 2.2, the third must be their exact rounded sum, one ulp above 3.3, and the fourth must be negative zero.

## Four doubles in 32 bytes

The validator takes one hex argument and reads its 32 bytes as four little endian doubles, d0 to d3. A wrong vector only prints calibration residual out of band, and no flag text sits in the binary.

## It checks bits, not numbers

The checker cuts d0 and d1 into a sign, an 11 bit exponent and four 13 bit mantissa slices, then ties the slices together with ten equations. Solved, they give exactly 1.1 and 2.2.

## One ulp above 3.3

d2 must carry the exact bits of d0 plus d1. In doubles 1.1 plus 2.2 is 3.3000000000000003, bits 400a666666666667, one step above the 3.3 you would type. The log's WARN rounding line was the hint.

## A zero with its sign bit set

d3 is compared with zero by an instruction that counts minus zero as equal, then the success flag is read from its sign bit. Only negative zero, 0x8000000000000000, passes both tests.

## 64 hex digits, one flag

Packed little endian, the four values make a 64 digit vector that ends in 0000000000000080. Given that one argument, the validator printed the flag, just over two minutes after the lab started.

## The insight

The validator checks bits, not values. A typed 3.3 fails, the true rounded sum passes, and only the sign bit tells negative zero from zero.

## The flag

hiCTF{1eee754_s1gn3d_z3r0_1u1p_dr1ft_eps!}

## More from this benchmark

[HI Cyber Con CTF 2026](https://p4ndora.ai/benchmarks/hi-cyber-con-2026)
[All benchmarks](https://p4ndora.ai/benchmarks)