POCTF 2026 Rules

Flags & Submissions

Flags are team-specific this year. A flag that is valid for one team will not be valid for another. The contest site will validate whether a submitted flag is correct for your team.

Some challenges also include team-specific content in the prompt itself — ciphertext, image variants, or other values generated uniquely for your team. Comparing challenge text across teams is therefore not useful and may be misleading. Use your own team's challenge page as the source of truth.

Unless a challenge states otherwise, flags must be submitted through the contest website on the relevant challenge page. Submissions outside the official submission mechanism are not eligible for points.

Challenge Release & Closure

Challenges may be released in waves or stages. Some challenges may also close early. Challenge closure means the challenge is no longer eligible for points and may stop accepting submissions.

POCTF includes both jeopardy-style challenges (standalone puzzles) and narrative tracks (staged sequences, such as Forensics and Game Hacking) where later stages may depend on earlier progress. Release windows and closure times (when applicable) will be shown on the challenge page and/or announced on Discord.

Fair Play

Participants must follow the contest rules at all times. Violating rules may result in score penalties, disqualification from specific challenges, removal from the contest, and ineligibility for prizes.

Do not interfere with challenges outside your team’s access. Do not attempt to access or modify other teams’ data or instances. DDoS/DoS attacks are strictly prohibited.

Decisions made by admins or organizers regarding disputes, scoring adjustments, and enforcement are final.

Support Channels

Grievances, concerns, questions, and bug reports should be made to admins or organizers. Discord moderators are not necessarily admins or organizers; moderators help keep order on the server.

If something is unclear, ask first. If you are too frustrated to be constructive, step away and come back later. This event is optional; treat people accordingly.

One Account per Person

Each participant must register and compete using a single account. Creating or using multiple accounts or aliases to gain an advantage is not allowed.

Brackets

POCTF offers three brackets:

• Solo — a single participant competing on their own.
• Team (standard) — a group of participants who register as a team. The captain receives a join code that other members redeem.
• Academic — a team representing a single accredited institution. Eligibility is verified by organizers; admin approval is required to enter or remain in this bracket. An institutional email may be requested as part of verification.

A participant may compete in only one bracket in the same event. You may not appear on multiple rosters or submit flags for more than one registered team.

Teams

Standard teams may have between 1 and 6 participants. The size cap is enforced by the contest system at join time. Academic teams are not capped, but eligibility for the academic bracket requires admin verification.

All participants on a team must be registered on the contest site to be considered valid participants. Teams are identified by a unique ID and profile in the contest system. Team join codes and roster management are part of the official contest workflow.

No Collusion

Collaboration between competing teams is not allowed. This includes sharing flags, full solutions, step-by-step instructions, private write-ups, or other direct solution material during the contest.

Using publicly available tools, documentation, and references is allowed, provided such use does not violate laws, licenses, or these rules.

Shared Environments

Participants working from shared labs or classrooms must ensure they are not sharing solutions or flags (even inadvertently) with other participants.

Purpose & Scope

This Code of Conduct applies to all participants and covers behavior on the contest website, Discord server, challenge infrastructure, and any other official communication channels associated with POCTF.

The goals are simple: maintain a respectful, welcoming environment; protect the integrity of the contest; and ensure organizers, admins, and volunteers can run the event without harassment or abuse.

Professionalism & Respect

Treat organizers, admins, moderators, and other contestants with professionalism and basic human respect.

• Harassment, insults, personal attacks, and hostile behavior are prohibited.
• Do not target organizers or volunteers with abuse, demands, or ridicule.
• Disagreements about challenge design or difficulty do not justify disrespect.

Discord & Communication Etiquette

The official Discord exists for announcements, clarifications, and community conversation. It is not a personal complaint box or exploit lab.

• Keep discussion on-topic, civil, and appropriate for an academic setting.
• Do not spam, derail channels, or flood chats with repetitive complaints.
• Do not incite dogpiles or coordinated hostility toward organizers, challenges, or other participants.
• Use private messages for direct questions to admins when appropriate.

Feedback & Criticism

Feedback is welcome when it is constructive. Critique ideas, not people. If something is broken or unclear, explain the issue calmly and precisely.

• Report broken challenges, ambiguous wording, or technical issues via support channels.
• Avoid turning public channels into complaint threads.
• Do not recruit others into hostility toward the contest or staff.

Fair Play & Infrastructure Abuse

Respect the intended scope of the contest and its infrastructure.

• Do not attack, probe, or disrupt contest infrastructure outside of challenge scope.
• Do not attempt DDoS/DoS, brute-force platform logins, or abuse support systems or scoring APIs.
• Do not attempt to access or modify other teams’ instances or data.
• Do not use the contest environment to launch attacks against unrelated external targets.
• Do not share flags, write-ups, or full solutions before the contest officially ends.

Attacking infrastructure is not “part of the game” unless explicitly stated by a challenge. If you are unsure whether something is in scope, ask first.

Content Standards

Contest spaces must remain appropriate for an academic environment.

• No hate speech, slurs, or discriminatory language.
• No targeted harassment or sustained personal attacks.
• No NSFW, explicit, or otherwise inappropriate content on official platforms.
• No sharing of pirated tools, books, or software in official contest spaces.

Responsibility to Read Rules

Participants are responsible for reading and understanding these Rules and individual challenge statements. If something is unclear, ask for clarification before acting in ways that may break rules or damage infrastructure.

Reporting Violations

If you experience or witness behavior that violates this Code of Conduct, report it.

• Contact an organizer or admin on Discord (e.g., @CTF-Admin).
• Or email the primary contest contact: cjohnson@uwsp.edu.

Provide as much detail as possible (timestamps, usernames, screenshots). Reports will be reviewed and handled as discreetly as reasonably possible.

How Challenge Points Are Determined

POCTF uses a weighted scoring system designed to reflect how difficult a challenge turns out to be in practice, not just how difficult it looked on paper.

When a challenge is first released, its point value is intentionally hidden. During this initial period, the contest system observes how teams interact with the challenge — how many teams solve it and how players rate its difficulty. After enough data is collected, the system locks in a final point value, announces it publicly, and that value does not change again for the remainder of the contest.

Solving a challenge before its point value is finalized still counts toward your team's score; you simply learn the exact reward when the challenge freezes.

What factors influence a challenge's final score?

Each challenge starts from a common baseline value. That baseline is then adjusted based on two real-world signals:

• Solve behavior. Challenges that are solved by many teams are considered easier; challenges solved by fewer teams are considered harder. This signal is based on unique team solves and is smoothed to prevent early volatility.
• Player difficulty ratings. After solving a challenge, players may optionally rate its perceived difficulty (1–5). Only solvers may rate a challenge. Ratings are aggregated using robust statistical methods to limit the influence of outliers.

When ratings are sparse, the engine leans on solve behavior. When both signals are present, they are combined to estimate how difficult the challenge actually was for participants.

When are points finalized?

A challenge's points are finalized whenever any one of these conditions is met, whichever happens first:

• A sufficient number of teams have solved the challenge (solve quorum).
• A sufficient number of players have rated the challenge (rating quorum).
• A minimum observation period has elapsed since release (audit-period timeout).

Once finalized:

• The point value is announced in the contest Discord.
• The challenge board updates to show the final score.
• The value will never change again. There is no live point decay or retroactive rebalancing.

First Blood: the first team to solve a challenge earns a 10% bonus on top of the finalized value. This bonus is awarded once the challenge freezes.

Why does POCTF use this system?

This approach grounds point values in observed participant experience. Easy challenges don't remain overvalued, genuinely difficult challenges are rewarded appropriately, and early solvers are not penalized for being early.

The goal is a fair, transparent, and stable scoring system that rewards effort and skill without introducing surprise changes mid-competition.

Each challenge may carry up to three hints, revealed for a cost in finalized points. Hints are sequential: hint 1 must be purchased before hint 2, hint 2 before hint 3.

Cost & Spending Rules

• The default cost is 10 finalized points per hint.
• Only finalized points can be spent. Pending solves (challenges not yet frozen) do not contribute to your spendable balance.
• A team that cannot afford the cost without going negative cannot purchase. There is no debt.
• Hints are only available on unlocked, active challenges.

Authorization

For team and academic brackets, only the captain may spend the team's points on hints. Solo players spend their own points.

Refunds & Finality

Hint purchases are not refundable, including when a challenge later freezes at a lower point value than its seed. You paid for information, not insurance.

The CTF is a contest of skill. No purchase is necessary to enter. No sponsorship is offered or implied. By entering, participants agree to abide by the Rules and the decisions of the organizers.

Organizers reserve the right to refuse, withdraw, or disqualify participants at their discretion for rule violations, cheating, or misconduct. Prize eligibility requires valid registration, compliance with these rules, and (where applicable) verification of bracket requirements.

How Winners Are Determined

Unless otherwise stated by an announcement or bracket-specific policy, winners are determined by score at contest end. Organizers may implement tie-breakers if needed.

If a team solves all available challenges and earns all available points before the contest ends, the first team to do so may be declared the winner, depending on bracket rules and contest format.

The following principles guide how organizers, admins, and moderators interact with participants throughout the contest:

• No direct solutions. Organizers will not provide step-by-step exploit guidance or full solutions during the contest.
• No deception. Hints may be indirect or intentionally limited, but organizers will not intentionally mislead participants.
• Equal access to impactful clarifications. Clarifications that affect gameplay will be posted publicly when appropriate.
• Corrections. Verified mistakes will be corrected. Fixes and impactful changes will be announced.
• Challenge changes. Any modification to challenge content, wording, scoring, or availability that affects fairness will be announced.
• Checksums when feasible. When downloadable files are provided, organizers will make reasonable efforts to publish checksums for integrity verification.
• No organizer participation. Organizers, admins, challenge authors, and infrastructure staff do not compete in any bracket.
• Reasonable confidentiality. Participant data and private messages are handled with discretion and used only for contest operations.
• Consistent enforcement. Organizers aim to enforce rules fairly and consistently.
• No pre-end solution releases. Official write-ups and explanations are provided after the event concludes.