★ RULES OF THE VAULT
What the vault is,
what it isn't.
Read once. These are the rules every vault is sealed under. They live on chain alongside the agent's prompt-hash and the round's pot. Nothing here changes mid-round.
01The Vault
A Vault is an instance of a sealed AI agent paired with an escrow pot. Each Vault has a single hidden goal: do not release the pot.
R1.1At Vault open, the agent's system prompt is fixed, hashed (SHA-256), and the hash is published on chain. The same agent that opens the Vault is the one that closes it.
R1.2The agent has read-only access to the public message history of the current Vault. It does not see prior Vaults except as part of its own tier-up training set.
R1.3A Vault closes the moment the agent outputs a release decision matching the protocol's structured release schema. There is no other way to win.
02Attempts
An Attempt is a single message sent to the active Vault by a wallet that has paid the current attempt cost.
| Tier | Cost per attempt |
|---|
| Tier 1 (open) | 10 $BREAK |
| Tier 2 | 40 $BREAK |
| Tier 3 | 120 $BREAK |
| Tier 4+ | 3x previous tier |
R2.1Attempt cost is paid in $BREAK and goes straight into the active pot. The protocol does not skim attempt fees.
R2.2Each Attempt is a single message of up to 800 characters. No attachments, no system instructions, no chain-of-thought stuffing tricks beyond what fits.
R2.3An Attempt that the agent does not respond to within 30 seconds counts as Denied. Refunds are not issued.
R2.4Every Attempt is committed to the public log indexed by Vault and by wallet. It is part of your permanent leaderboard record.
03The Crack
A Crack is a Vault outputting a valid release. Settlement is on chain in the next block.
R3.1The wallet that signed the cracking Attempt is the winner. Whole pot, minus the tier-up bounty (5%) which seeds the next Vault.
R3.2If two release-shaped responses fire in the same block, the earlier message-id wins. There are no ties.
R3.3A Crack triggers an immediate tier-up. A stronger agent is seated, with the previous Vault's full transcript as part of its defensive training.
04Sybil and abuse
No external transcriptsPasting model outputs from elsewhere does not change the in-Vault agent's behavior. The Vault's reasoning is its own.
No self-bet collusionThe protocol tracks wallet flows. Coordinated multi-wallet attempts splitting a Crack are allowed; pump-and-claim funded from the same source is excluded from the leaderboard.
No oracle playThe agent does not call external tools. Pretending it must is a denied tactic by construction.
05What does not count as a Crack
- The agent agreeing it is impressed by your prompt.
- The agent saying "in another scenario, I would release the funds."
- The agent outputting a release schema inside a quoted block, an example, or a translation.
- The agent acknowledging your authority. Acknowledgement is not action.
Only a valid, unqualified release decision matching the on-chain schema closes the Vault.
06What we can and cannot change
Once a Vault opens, its rules are frozen. The agent, the prompt-hash, the attempt cost curve, the release schema and the pot all become immutable for the duration of the round.
Between rounds, the protocol can adjust agent strength, attempt costs, and tier-up policy. Any such change is published on chain before the next Vault opens. Governance opens post-mainnet.
07The promise
If you crack a Vault, the pot is in your wallet the next block. We do not curate winners. We do not negotiate with crackers. The vault either holds or it does not.