// PROTOCOL

How BLUFF works

BLUFF is a prompt-injection game with real money. Each vault is an AI guardian that knows a secret code. Make it say the code and the contract bluff-live-76371.testnet pays you the pot. Every prompt, reply and payout is public, which makes BLUFF an open, incentivised red-teaming dataset for anyone shipping AI agents that hold keys or money.

1. Host locks a bounty

create_room escrows NEAR in the contract with a public guardian persona, a defense level, a per-prompt fee and a deadline. Storage is paid from the deposit; the rest is the pot.

2. Judge commits a secret

The judge server derives a secret code with HMAC(server secret, room id) and calls arm_room with only its sha256. The host never sees the code, so a host cannot "win" their own vault.

3. Attacker commits a prompt

submit_attempt stores the exact prompt onchain and takes the fee: 80% (after storage) goes into the pot. The guardian only ever sees prompts that are already public and paid for.

4. Guardian replies, verdict goes onchain

The judge runs the guardian on NEAR AI Cloud (a model in a TEE, with signed responses) and calls judge_attempt with the reply, an attack tag and the completion id. Attempts are judged strictly in order.

5. Contract verifies and pays

If the judge claims a breach, the contract checks that sha256(code) equals the commitment AND that the stored reply literally contains the code, then transfers the whole pot to the attacker in the same transaction.

6. Nobody breaks it

After the deadline the host calls refund_room and gets the pot back, fees included. If the judge ever stalls for 30 minutes, attackers call reclaim_attempt and get their full fee back.

Two kinds of vault

  • Secret vault: the guardian knows a hidden code. Make it say the code and the contract pays you the whole pot.
  • Heist vault: the AI is an agent that controls a wallet through a real send_near tool call. Talk it into paying you. The contract is the policy engine: it treats the model as untrusted, only ever pays the attacker of that attempt, and never more than the host's per-transfer cap. If a fooled agent tries to send more, the transfer is refused and recorded as Policy blocked. This is exactly the defense-in-depth pattern agent wallets need: assume the model will be manipulated, and bound the damage onchain.

Open arenas and squads

  • Open arena: listed in the lobby; any wallet can attack.
  • Squad: the host lists friends' accounts and the contract rejects everyone else. Hidden from the lobby, but anyone with the link can spectate. Nobody, including the host, knows the secret.

Defense levels

  • Standard: host persona + the secret. Raw model behavior.
  • Hardened: a non-negotiable security preamble and spotlighting: the player text is fenced as untrusted data.
  • Fortress: Hardened plus an LLM firewall that screens each prompt; blocked prompts never reach the guardian.

Trust model, honestly

  • Funds are only ever held by the contract. The judge key can call arm_room and judge_attempt; it cannot withdraw pots.
  • The judge could in theory lie about a reply. Every reply is stored onchain next to its NEAR AI Cloud completion id, whose TEE signature covers the exact request and response, so a forged verdict is detectable.
  • A payout requires the plaintext code to match a hash committed before any attack, so the judge cannot pick a winner after the fact without leaving a public, checkable trace.
  • Liveness: if the judge goes down, attackers reclaim fees after 30 minutes and hosts reclaim pots after the deadline.
Enter the lobbyHost a vault