[ANN] HackMe Network — useful PoW pool · WASM · public coordinator · rc9

[kapa77]

HackMe Network
Useful Proof-of-Work pool · WASM validation · public coordinator · 0.1.0-rc9

What is it?
HackMe is open mining infrastructure: you run a desktop node + pool worker, connect to our public coordinator, submit verifiable work, and accrue off-chain HMC. On-chain payouts arrive after operator settlement — not automatically in every PoH block.

Website	https://hackme.tech
Downloads (SHA256 on page)	downloads.html
Pool explorer	pool/explorer
Economics	economics-model.html
Documentation	docs.html
Source (Apache-2.0)	github.com/jokeez/hackme

Miner quick start
[list=1]

• Download the Windows or Linux bundle from the official Downloads page.
  
• Verify SHA256 on that same page. Do not use random mirrors or Telegram “speed links”.
  
• Windows: run [mono]start_hackme_public_pool.bat[/mono] from the zip.
  
• Linux: set [mono]HACKME_PUBLIC_AUTHORITY_BASE=https://hackme.tech[/mono] and run [mono]scripts/ops/desktop_mode_up.sh[/mono] (see README in the repo).
  
• Configure [mono]WORKER_PAYOUT_MAP[/mono] so your worker id maps to your [mono]HMC-…[/mono] address (must match the operator map for settlement).
  
• Open http://127.0.0.1:8080 → Mining → Start pool worker.
  
• Track Unpaid worker accrual on the dashboard and payout rows on the explorer.
  

Economics (important)

Coordinator	Off-chain accrual for accepted attempts (fair mode: reward_per_m × attempts/1M + found bonus)
Blockchain	Block subsidy goes to the producing node wallet, not auto-split to every GPU
Settlement	Operator transfers accumulated HMC to your on-chain address

Accrual on the coordinator ≠ coins in your wallet until settlement runs.
Full model: economics-model.html


Security & official software

• Only trust https://hackme.tech — check the URL bar.
  
• Verify SHA256 before running any binary.
  
• Source is Apache-2.0; red-team notes ship in [mono]docs/SECURITY_AUDIT_REDTEAM.md[/mono].
  
• Report issues responsibly: contacts.html — no public 0-day posts.
  
• Forks may reuse code under the license; they may not impersonate the official HackMe pool with our name/logo on fake domains.
  

Hardware
CPU (WASM path) · optional GPU (OpenCL/CUDA) · Linux & Windows bundles


Disclaimer
Mining and cryptocurrency involve risk. HackMe is experimental RC software (0.1.0-rc9). Not investment advice. Not an ICO. Pool parameters may change with notice on the website.

Tags: [ANN][POOL][CPU][GPU][WASM][ALGO] — adjust to forum rules.

[kapa77]

HackMe Network — May 2026 update
Coordinator stress test · public pool live · MiningPoolStats listing · Windows OpenCL (AMD)


Coordinator stress test (10 min, 100 virtual workers)

We ran an isolated mega stress against the coordinator core (claim/submit flood, 30s lease boundary burst, 50 workers killed mid-flight, 1000 malformed HTTP bodies):

Hard errors (5xx, timeouts)	0%
Process crash	none
RAM (10 min)	~12 → ~20 MB — no runaway leak
Latency p50 / p99	0.9 ms / 10.3 ms
Halving block [mono]2,102,401[/mono]	reward 0.01 → 0.005 HMC (verified under load)
Bad payloads	1000/1000 fast reject — no CPU hang on parse

At unrealistic request rates the pool returns 429 backpressure instead of corrupting leases or payouts. Open-source harness: [mono]scripts/tests/coordinator_mega_stress.sh[/mono] in the repo.


Mine on the official pool

Website	https://hackme.tech
Pool stats API	.../api/pool/stats
Explorer	pool/explorer
Downloads (SHA256)	downloads.html
Source	github.com/jokeez/hackme

Important: HackMe is not Stratum. You run [mono]hackme-node[/mono] + [mono]workerpoh[/mono]; the worker claims work over HTTP at [mono]/pool/coordinator[/mono].

[list=1]

• Download Windows [mono]HackMe-Setup-0.1.0-rc11g.exe[/mono] or Linux bundle — verify SHA256 on the downloads page.
  
• Map your worker id → [mono]HMC-…[/mono] payout address ([mono]WORKER_PAYOUT_MAP[/mono] / hybrid signer).
  
• Start the pool worker from the local dashboard (127.0.0.1:8080 → Mining).
  
• Track accrual on the dashboard; on-chain settlement after operator batch (see economics).
  

GPU

• Windows / AMD: OpenCL build + RX 580 rig profile ([mono]workerpoh-opencl.exe[/mono] in rc11g installer).
  
• Linux / NVIDIA: CUDA path when driver OK ([mono]workerpoh-cuda[/mono]).
  
• CPU: always available fallback.
  

MiningPoolStats
We submitted HackMe Official Pool for review (HTTP coordinator — not TCP Stratum on :3333). Stats URL for moderators: api/pool/stats.


Security

• Official domain only: hackme.tech
  
• No ICO · no token sale
• Responsible disclosure: contacts.html
  

Experimental RC — verify payouts on the explorer before scaling. Pool parameters may change with notice on the website.

[kapa77]

HackMe Network
HMC economics — full guide
Chain emission · coordinator pool · settlement · audit orders

TL;DR for miners

You are NOT on Stratum	HTTP coordinator + [mono]workerpoh[/mono] leases — no :3333 share accounting
Your paycheck story	Coordinator accrual for accepted work → operator settlement → your [mono]HMC-…[/mono] wallet
PoH block subsidy	Goes to the block-producing node’s primary wallet — not auto-split to every remote GPU
More miners ≠ more coins	~120 blocks/hour network-wide (30s target) — fleet size splits competition, not inflation

Read once before scaling hashrate. Numbers below match open-source constants in [mono]internal/chain/economics.go[/mono] and the live economics page.


The #1 misconception (please read)

“If I mine on the HackMe pool, every new block pays my GPU like a classic BTC pool.”

No. HackMe separates consensus emission (PoH blocks on the chain) from pool accounting (coordinator + settlement). Remote workers earn through accepted lease work credited off-chain, then settled on-chain — unless you yourself operate the node that appends blocks.

Three layers — one picture

Code:

   YOUR RIG (CPU / OpenCL / CUDA)
        |
        |  claim lease  +  submit batch (hybrid-signed)
        v
 +---------------------------+
 |   COORDINATOR (pool)    |  <-- off-chain ledger: payout_hmc, stats
 +---------------------------+
        |
        |  settlement timer / operator batch
        v
   YOUR HMC- ADDRESS  (on-chain balance after credit)

   (parallel, network-wide)

 +---------------------------+
 |   PoH CHAIN (consensus)   |  ~30s blocks, halving schedule
 +---------------------------+
        |
        |  block reward -> primary wallet of PRODUCING NODE only
        v
   operator / leader node wallet (not auto per GPU)

Three layers = three different clocks. Accrual can move every minute; chain height moves every ~30s; your wallet updates when settlement runs.


Layer 1 — Chain (PoH emission)

What it is
Useful Proof-of-Work: WASM-gated nonce search, dynamic difficulty [mono]target_mod[/mono], tip grows on valid blocks.

Supply cap

Max supply	100,000,000 HMC
Genesis policy	Locked in code ([mono]policy_hash[/mono] in metrics) — no hidden mint switch

Base block reward (empty mining — no open paid order on block)
Halving every 2,102,400 blocks (~2 years at 30s/block target), then a tail floor:

Epoch (blocks after genesis)	Base reward / block	Notes
0 — blocks 1 … 2,102,400	0.010000 HMC	Initial schedule
1 — … 4,204,800	0.005000 HMC	First halving (verified under coordinator stress load)
2 — … 6,307,200	0.002500 HMC
3+ (floor reached)	0.002000 HMC	Tail floor [mono]RewardTailFloorHMC[/mono] — long-term incentive

Network-wide emission (empty mining only)
Roughly 120 blocks/hour × current base reward — independent of how many pool workers exist.

At 0.01 HMC/block	~1.2 HMC/hour total base emission (whole network)
At 0.005 HMC/block	~0.6 HMC/hour (post first halving)

Who receives the block subsidy on-chain?
The implementation credits the node’s primary wallet row (so [mono]GET /api/wallet[/mono] matches ledger state). The block may still record a [mono]minerAddress[/mono] for transparency — credits follow primary wallet, not a blind header split.


Layer 2 — Coordinator (how your rig earns on the public pool)

Official fair pool mode ([mono]payout_found_only=0[/mono], [mono]reward_auto=1[/mono], hybrid signer strict):
You earn for accepted attempts inside each lease (capped by batch size), plus a found bonus when you submit a valid hit.

Formula (matches coordinator code + site docs):

Code:

payout_per_submit  =  (paid_attempts / 1_000_000) × reward_per_m  +  found_bonus (if valid found)

reward_per_m       ≈  base_reward_hmc × 1_000_000 / target_mod
                     (auto-synced from canonical chain metrics when reward_auto=1)

Worked example (illustrative — live [mono]target_mod[/mono] moves with pool load):

base_reward_hmc	0.01
target_mod	1,000,000
reward_per_m	0.01 × 1,000,000 / 1,000,000 = 0.01 HMC per million attempts
Your batch (lease cap)	4,000,000 attempts accepted
Attempt payout	(4M / 1M) × 0.01 = 0.04 HMC
Valid found hit	+ found_bonus (pool default often ~0.01 HMC — see [mono]/api/pool/stats[/mono])

Higher pool difficulty ([mono]target_mod[/mono]↑) lowers [mono]reward_per_m[/mono] so coordinator payouts stay tied to chain economics — not arbitrary inflation.

Fairness guards on the public pool

• Hybrid Ed25519 on submits when strict mode is on — reduces fake-attempt payout games.
  
• Per-worker lease cap — official pool configures a max concurrent leases per worker id so one rig cannot monopolize the fleet.
  
• 429 backpressure under abuse — coordinator rejects overload instead of corrupting leases.
  
• Replay / stale work protection — bad submits do not accrue.
  

What you see locally

• Dashboard → Unpaid worker accrual (pool paycheck meter).
  
• Pool API → [mono]total_payout_hmc[/mono], worker stats.
  
• This is off-chain until settlement — not the same as wallet balance yet.
  

Layer 3 — Settlement (off-chain → on-chain)

Flow
[list=1]

• You map [mono]worker-id=HMC-youraddress[/mono] via [mono]WORKER_PAYOUT_MAP[/mono] (must match operator map on settlement host).
  
• Coordinator accumulates [mono]payout_hmc[/mono] per worker id.
  
• Operator runs [mono]settle_worker_payouts[/mono] automation (official pool: timer on the order of minutes, not “once a week”).
  
• Explorer / wallet shows on-chain credit to your [mono]HMC-…[/mono] address.
  

Rule of thumb
Accrual ≠ wallet until settlement completes. Always verify on pool/explorer before scaling hardware spend.


Layer 4 (product) — Paid audit orders

HackMe is also a useful-work marketplace: clients escrow HMC for WASM-gated audit tasks; PoH blocks tied to an open order must match task reward or the chain rejects the append.

When a customer opens a prepaid order

Escrow (prepaid)	[mono]reward_hmc × target_solves[/mono] — held for miners solving the task
Platform fee	5% of prepaid → [mono]DevFeeAddress[/mono] ([mono]OrderPlatformFeeRate = 0.05[/mono])
Burn accounting	10% of prepaid tallied as burned supply metadata ([mono]OrderBurnRate = 0.10[/mono]) — separate from transfer fees

On-chain transfer fees (different split — do not mix with order open):

Burn share	30% of [mono]fee_units[/mono]
Dev/platform share	70% of [mono]fee_units[/mono]

Orders are the long-term demand layer for useful compute; the public pool’s steady accrual path is coordinator-based even when you are not solving a commercial order yourself.


HackMe vs classic Stratum pool

	Classic Stratum (BTC-style)	HackMe official pool
Protocol	TCP :3333 shares	HTTP [mono]/pool/coordinator[/mono] leases
Share → block	Pro-rata block reward split	Coordinator [mono]payout_hmc[/mono] policy + settlement
Block finder	Pool wallet often central	Producer node primary wallet + separate pool ledger
Work unit	Hash on block header	WASM PoH nonce ranges + hybrid signatures

Miner checklist (official pool)

[list=1]

• Download only from hackme.tech/downloads.html — verify SHA256.
  
• Set [mono]HACKME_PUBLIC_AUTHORITY_BASE=https://hackme.tech[/mono].
  
• Configure [mono]WORKER_PAYOUT_MAP[/mono] → your real [mono]HMC-…[/mono] payout address.
  
• Start [mono]hackme-node[/mono] + [mono]workerpoh[/mono] (Windows installer or Linux bundle).
  
• Watch Unpaid worker accrual on 127.0.0.1:8080.
  
• Confirm settlement on explorer before buying more rigs.
  

Live numbers & transparency

Economics page	hackme.tech/economics-model.html
Pool stats API	.../api/pool/stats
Canonical metrics	[mono]/api/metrics[/mono] on authority node ([mono]econ_*[/mono] fields)
Open-source policy	economics.go · MINER_POOL_ECONOMICS.md

FAQ

Q: I found a block — why didn’t my GPU wallet jump instantly?
A: Block subsidy credited the producing node’s primary wallet path. Your rig’s income is still coordinator accrual → settlement unless you run the producer yourself.

Q: Does adding 1,000 miners mint more HMC per hour?
A: No for base schedule — only ~120 blocks/hour. More miners compete for coordinator accrual and block-finding probability.

Q: Is this an ICO or pre-mine sale?
A: No ICO · no token sale. Experimental RC network — verify everything on explorer before trusting payouts.

Q: Can policy change?
A: Pool coordinator knobs and settlement timing are operator policy (announced on News). Chain constants require a coordinated upgrade — not a silent remote toggle.


Disclaimer
HackMe Network is experimental release-candidate software (0.1.0-rc11g at time of writing). Mining and cryptocurrency involve risk. This post is technical documentation, not investment advice. Pool parameters and settlement timing may change with notice on the official website. English is authoritative; translate at your own risk.

HackMe Network · hackme.tech · source · responsible disclosure

[kapa77]

╔══════════════════════════════════════╗
║ HackMe Network ║
╚══════════════════════════════════════╝
HackMe OS — Live Bootable ISO
Zero-Knowledge Start · Release [mono]0.1.0-rc11g[/mono] · May 2026[/size]
Useful PoW · HTTP coordinator · not Stratum

◆ QUICK SUMMARY ◆

BOOT	VERIFY	MINE
Flash USB	SHA256	Auto pool

• HackMe OS — amd64 live ISO (~956 MB) for dedicated rigs. Same idea as HiveOS, built for the HackMe coordinator.
  
• Zero-Knowledge Start — no wallet file, no manual pool setup: boot → read [mono]HMC-…[/mono] + 24 words on screen → worker online.
  
• Checksums on hackme.tech/downloads — ISO is live (verified HTTP 200).
  
• Public pool ~2.4 GH/s · fair economics · hybrid signing enforced.
  

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ZERO-KNOWLEDGE START
From blank USB to hashing on hackme.tech in six steps

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

STEP	ACTION
01	Download [mono]HackMe-OS-0.1.0-rc11g-amd64.iso[/mono] + [mono]SHA256SUMS-iso.txt[/mono] from official downloads
02	Verify — [mono]sha256sum -c SHA256SUMS-iso.txt[/mono] (required)
03	Flash 8 GB+ USB — Balena Etcher or [mono]dd conv=fsync[/mono]
04	Boot GRUB entry HackMe OS (live · max performance) — [mono]toram[/mono], performance governor, RT worker priority
05	TTY1 banner — new [mono]HMC-…[/mono] payout address + 24-word recovery phrase (HackMe mining key — not BTC/Eth HD)
06	Mine — [mono]workerpoh[/mono] connects to pool/coordinator; run [mono]hackme-os-status[/mono]

Farm note: live USB without [mono]hackme-os-install[/mono] creates a new wallet each reboot — install to SSD for a fixed identity.[/color][/size]

Rig commands: [mono]hackme-os-status[/mono] · [mono]hackme-show-wallet[/mono] · [mono]hackme-os-benchmark[/mono] · [mono]hackme-os-install /dev/sdX[/mono]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RELEASE ARTIFACTS [mono]0.1.0-rc11g[/mono][/size]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

PACKAGE	DETAILS
★ ISO	File: [mono]HackMe-OS-0.1.0-rc11g-amd64.iso[/mono] (~956 MB · amd64 live)
HASH	[mono]1b7bd70e381bb0d5aee82135fe01963d27d2af43ebfba95e02dec22aabe17658[/mono]
WIN	[mono]HackMe-Setup-0.1.0-rc11g.exe[/mono] — pool token + [mono]workerpoh-opencl[/mono] (AMD RX 580 profile)
LINUX	Tarball: [mono]hackme[/mono] · [mono]workerpoh[/mono] · [mono]minersign[/mono]
DOCS	HACKME_OS.md · source (Apache-2.0)

All checksums: https://hackme.tech/downloads.html

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ISO vs ZIP — WHICH PATH?

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

TOPIC	ZIP + SCRIPTS	HACKME OS ISO
Wallet	Manual config	Automatic
Pool URL / token	Copy from docs	Embedded
CPU tuning	DIY	Built-in
GPU	Per host	AMD OOTB · NVIDIA after install
Best fit	Desktop / existing OS	Dedicated rig / farm USB

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
LIVE PUBLIC POOL
HTTP coordinator — not TCP Stratum on :3333

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

METRIC	VALUE
Stats API	.../api/work/stats
Explorer	pool/explorer
Hashrate	~2.4 GH/s (coordinator aggregate)
Difficulty	[mono]target_mod[/mono] ~4.9M (dynamic)
Block reward	0.01 HMC base epoch (+ halving on chain)
Economics	Fair pool · [mono]payout_found_only=0[/mono] · pay for accepted work
Signing	Hybrid strict — ISO sets signing; unsigned → 403

Accrual on coordinator → map worker → [mono]HMC-…[/mono] → settlement → on-chain.[/i]
Full economics model →

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
OPERATOR QA

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

TEST	RESULT
[mono]go test ./...[/mono]	PASS
Chaos guard	PASS 5000 payouts · replay/tamper · init-worker
Stress (prior)	0% hard errors · p50 0.9 ms · flat RAM
ISO image	[mono]pool.token[/mono] + [mono]workerpoh[/mono] + [mono]minersign[/mono] · claim HTTP 200
CDN	LIVE direct ISO URL

THREAD CONTEXT

✓	Coordinator 10-min mega stress — 100 vworkers · halving block [mono]2,102,401[/mono] verified
✓	Windows OpenCL for AMD RX 580 (~0.12+ GH/s class vs CPU-only)
✓	MiningPoolStats submission (HTTP coordinator — not Stratum)

OFFICIAL LINKS

Website	https://hackme.tech
Downloads	downloads · HackMe OS
Source	github.com/jokeez/hackme
Security	responsible disclosure

Disclaimer — HackMe is experimental RC software ([mono]0.1.0-rc11g[/mono]). Mining involves risk. Write down your 24-word phrase. Verify SHA256 and explorer accrual before scaling. No ICO · no token sale. Pool parameters may change with notice on the website.

Re: [ANN] HackMe — HackMe OS live ISO · Zero-Knowledge Start · rc11g

[kapa77]

◆ HackMe Network
Major Update · AGPLv3 · Brand protection · ISO boot fix · Windows fairness
Release 0.1.0-rc11g · May 2026

Open client you can audit · Protected official pool · Verify SHA256 before you mine

▸ Why this update matters

HackMe is growing. That attracts copy-paste forks, fake download sites, and impersonators. This post explains how we protect the real pool at hackme.tech — while keeping the miner client fully open for inspection.

TL;DR

• License: Apache-2.0 → AGPL-3.0 (public pool forks must open server code)
  
• Brand: HackMe™ name & logo are not free to clone
  
• ISO: fixed [mono]kernel panic exitcode=0x100[/mono] — re-download + re-flash USB
  
• Windows: fixed unfair [mono]28s cooldown[/mono]; NVIDIA still ~9 GH/s OpenCL vs ~60+ GH/s CUDA on Linux/OS
  
• Trust only: hackme.tech/downloads.html + SHA256
  

▸ 1 · License: AGPL-3.0

We are moving the public repository from permissive Apache-2.0 to GNU Affero GPL v3 (AGPL-3.0).

Apache problem	Anyone can copy, rebrand, and run a commercial competing pool with almost no obligation to share changes.
AGPL answer	Code stays free & readable. Run a modified network service (public coordinator, pool API)? You must publish your server-side source under AGPL too.
For miners	You can always download, audit, and run official builds from hackme.tech.

Can I…?

Action	Allowed?
Download HackMe OS / Windows / Linux from official site	✓ YES
Read & audit source on GitHub	✓ YES
Private LAN fork (not exposed to the internet)	✓ YES (AGPL rules apply if you offer it as a service)
Public competing pool using our code + hidden backend	✗ NO (AGPL requires source disclosure)
Clone site named “HackMe Gold / Cash / Pro…”	✗ NO (trademark — see §3)

Official links

Source	github.com/jokeez/hackme · AGPL-3.0
Downloads + SHA256	hackme.tech/downloads.html
Trademark policy	[mono]TRADEMARK.md[/mono] in repo

▸ 2 · Hybrid architecture

Smart infra projects split what miners must trust from what operators keep private.

OPEN (client — prove no malware)	NOT PUBLISHED (production ops)
HackMe OS ISO build scripts Desktop miner ([mono]hackme[/mono], [mono]workerpoh[/mono]) Node + coordinator source code in repo Scripts you run on your machine	Live VPS [mono].env[/mono] & coordinator tokens Payout keys & settlement wiring Production [mono]WORKER_PAYOUT_MAP[/mono] Release signing keys

A fork of the client alone does not replace the official pool at hackme.tech. Always verify SHA256 on the website before running binaries.


▸ 3 · Trademark & brand

Under AGPL you may fork code. You may not impersonate HackMe™.

Protected	HackMe name · logo · hackme.tech as the official pool
We will act on	Look-alike domains · fake GitHub releases · “HackMe Cash/Gold” clones · DMCA to hosts & registries
Your safety	Bookmark downloads.html · check URL bar · match SHA256 every time

▸ 4 · Technical fixes (reported by miners)

ISO — kernel panic [mono]exitcode=0x100[/mono][/b]

Cause	Broken casper live config ([mono]username=root[/mono]) + bad [mono]filesystem.size[/mono] on older images
Fix	New ISO: [mono]ubuntu[/mono] live user · xz squashfs · [mono]fsck.mode=skip[/mono] · correct size metadata
You must	Re-download · verify SHA256 · fully re-flash USB (not “update in place”)
Boot menu	HackMe OS (live · recommended)
Login	[mono]ubuntu[/mono] → Enter (empty password) · or [mono]sudo -i[/mono]

Current ISO SHA256 ([mono]HackMe-OS-0.1.0-rc11g-amd64.iso[/mono]):

[mono]e7b42baca799dff005362a3bd33700f1cb10eba2ecd7ccf2fa56cf7f7e5eea12[/mono]

Manifest: SHA256SUMS-iso.txt

Windows — ~9 GH/s vs Linux ~60 GH/s (same GPU)

Why	Windows NVIDIA uses OpenCL (~9 GH/s). Linux / HackMe OS uses CUDA (~60+ GH/s on same card)
Bug fixed	Installer no longer forces [mono]HACKME_WORKER_CLAIM_COOLDOWN_MS=28000[/mono] on NVIDIA (28 s sleep after every submit)
Windows now	Run [mono]repair_hackme_env.bat[/mono] in install folder → restart miner
Max GH/s	Use HackMe OS or Linux bundle from official downloads

▸ 5 · Verify before you mine

Linux / macOS

Code:

sha256sum HackMe-OS-0.1.0-rc11g-amd64.iso
# must match e7b42baca799dff005362a3bd33700f1cb10eba2ecd7ccf2fa56cf7f7e5eea12

From repo (optional deep check):

Code:

bash scripts/tests/verify_hackme_iso.sh HackMe-OS-0.1.0-rc11g-amd64.iso

Golden rule: if the hash does not match the official sums file — do not flash, do not run.


▸ 6 · Enterprise & community

• Miners — we win with transparency: open client, signed releases, public explorer.
  
• Phasing / B2B clients — separate NDAs protect contracts, not the binary on your rig.
  
• Questions — reply in this thread or GitHub issues.
  
• Security — responsible disclosure via contacts.html.
  

Mine official. Verify hashes. Ignore clones.
hackme.tech · Downloads · Explorer · GitHub (AGPL-3.0)
— HackMe operators

Tags: [ANN][UPDATE][POOL][LEGAL][AGPL] · adjust to forum rules.

[kapa77]

HackMe Network — B2B Fuzzing Security Update
May 2026 · [mono]0.1.0-rc11g[/mono][/size]

Summary

Integrators posting paid fuzzing work on hackme.tech no longer use a web console with admin tokens. We ship a small CLI and a scoped developer token (orders only). The public website shows a read-only status tracker.

• hackme-fuzzing — Windows [.exe] and Linux binary on official downloads
  
• No browser admin — do not paste production tokens into hackme.tech pages
  
• WASM built locally — remote [mono]/api/tasks/from_code[/mono] returns 403 on the public host (compiler stays off the internet edge)
  
• Fuzz API — not exposed on hackme.tech ([mono]403[/mono])
  
• Miners unchanged — HackMe OS ISO, Windows worker, HTTP coordinator pool (~GH/s fleet on hackme.tech)
  

Integrator quick start

Code:

export HACKME_DEVELOPER_TOKEN='…'   # request via contacts on hackme.tech
export HACKME_FUZZING_BASE=https://hackme.tech
hackme-fuzzing wallet
hackme-fuzzing create manifest.json
hackme-fuzzing tasks

Public read-only tracker: fuzzing-console.html
Developer docs: developers.html


Order limits (canonical node)

difficulty_score	1 – 100
target_solves	≤ 10 000
fairness	reward ≥ 0.0005 × difficulty
rate	~3 creates / min / IP

Pool fills open orders when fuzzing escrow is active — same fair HTTP coordinator (not Stratum).


Links

• Downloads (miners + fuzzing CLI)
  
• Live pool stats
  
• Source (AGPL)
  
• ANN thread
  

B2B token requests: hackme.tech/contacts

[kapa77]

HackMe Security Note #1
Useful-PoW · WASM guard · HTML fuzz reports · full write-up on GitHub

TL;DR

We ran a useful Proof-of-Work research order on HackMe: a WASM [mono]check(i64)->i32[/mono] flags [mono]OP_PUSHDATA1 (0x4c)[/mono] with push length > 520 bytes (Bitcoin Script–style rule, simplified).

• Not a Bitcoin Core CVE — reproducible demo on our open pool / fuzz stack
  
• Useful-PoW order [mono]order-security-script-push-001[/mono] — completed
  
• Fuzz sample on the guard — clean (expected)
  
• New: fuzz reports open as styled HTML (screenshots on GitHub)
  

Full post (code, screenshots, reproduce)

github.com/jokeez/hackme — Security Note #1

Direct images (raw):

https://raw.githubusercontent.com/jokeez/hackme/main/docs/screenshots/security-note-01/01-html-report-fail_high-redteam-property-fuzz.png

https://raw.githubusercontent.com/jokeez/hackme/main/docs/screenshots/security-note-01/02-fuzz-campaigns-dashboard.png

Checker file: rust_script_push_bounds_guard.rs


Quick reproduce

Code:

git clone https://github.com/jokeez/hackme.git && cd hackme
bash scripts/build_security_task_pack.sh
bash scripts/ops/bootstrap_security_fuzz_campaign.sh

Pool: hackme.tech · ANN: this thread · TG: @hackme_tech


FAIL_HIGH in the HTML screenshot is a property-fuzz demo on rust_bounds_guard, not a claim of mass flaws in Bitcoin. Push-bound Security Note #1 fuzz was clean.

[kapa77]

HackMe × Bitcoin Core — 5-module probe
Official bitcoin/bitcoin reference · WASM sandbox · May 2026

Headline: No exploitable WASM traps in 5 guards mapped to Core master (500 inputs/module).

Repo tested: https://github.com/bitcoin/bitcoin 
Our code + report: jokeez/hackme · HTML report


What we tested (official Core locations)

Each row: HackMe WASM guard → exact area in Bitcoin Core → our source file.

#	HackMe guard	Bitcoin Core (master) — what & where	HackMe source
1	rust_script_push_bounds_guard	Script push 520 B rule script.h#L27-L28 — MAX_SCRIPT_ELEMENT_SIZE = 520 script.h#L82 — OP_PUSHDATA1 = 0x4c script.cpp#L312-L365 — GetScriptOp() (push length decode) interpreter.cpp#L447-L448 — SCRIPT_ERR_PUSH_SIZE at runtime Guard flags: OP_PUSHDATA1 + claimed len > 520 (simplified).	rust_script_push_bounds_guard.rs
2	rust_bounds_guard	Script structure / valid opcodes script.cpp#L299-L308 — CScript::HasValidOps() (item.size() > MAX_SCRIPT_ELEMENT_SIZE → invalid) Uses MAX_SCRIPT_ELEMENT_SIZE from script.h	rust_bounds_guard.rs
3	rust_overflow_guard	Transaction output amounts consensus/amount.h#L27 — MoneyRange() (0 … MAX_MONEY) tx_check.cpp#L11-L32 — CheckTransaction() → if (!MoneyRange(nValueOut))	rust_overflow_guard.rs
4	rust_state_transition_guard	Tx acceptance pipeline (simplified state machine, not a line-by-line port) validation.cpp#L795-L796 — CheckTransaction() before accept validation.cpp#L1774 — AcceptToMemoryPool() entry	rust_state_transition_guard.rs
5	cpp_script_push_bounds_guard	Same class as #1 — C++ twin of push bound interpreter.cpp#L447-L448 — vchPushValue.size() > MAX_SCRIPT_ELEMENT_SIZE Constant: script.h#L27-L28	cpp_script_push_bounds_guard.cpp

Sandbox results (HackMe, not Core CI)

Module	Verdict	WASM traps	Note
#1 script push (Rust)	CLEAN	0	168/500 violation-class hits — gate works
#2 HasValidOps-style	CLEAN	0	selective accepting set
#3 MoneyRange-style	CLEAN	0	selective accepting set
#4 validation-style	CLEAN	0	selective accepting set
#5 script push (C++)	CLEAN	0	same class as #1

Method: WASM check(i64)→i32 in HackMe sandbox (wazero), 500 samples/guard. check_fail = input outside guard's set — not "CVE in Core".


We do not claim

• A new vulnerability in Bitcoin Core — use Core fuzz tests + security@bitcoincore.org for that
  
• Full bitcoind coverage (we test small Core-inspired gates on HackMe)

Reproduce

Code:

git clone https://github.com/jokeez/hackme.git && cd hackme
bash scripts/build_security_task_pack.sh
go run ./tools/bc5_report

Link map (all URLs): docs/BITCOIN_CORE_OFFICIAL_LINKS.md

Pool · ANN · Telegram

[kapa77]

HackMe Fuzz Engine v2 — property fuzz on useful-PoW (release 0.1.0-rc11i)

We shipped a real upgrade to the fuzz worker pipeline, not a marketing rename. The pool still runs [mono]check(i64)->i32[/mono] WASM gates; the input generator and reports are what changed.

What is new (fuzz_engine_v2)

• Seed corpus — campaigns default to security-oriented 64-bit seeds (zero, OOB-class op/item patterns, overflow-class quantity). Config: [mono]"seed_corpus": [0, 1, 0x...][/mono]
• Mutation — each work item = seed + splitmix64 bit-flip rounds ([mono]mutation_rounds[/mono], default 4), not raw [mono]input_n[/mono] only
• Coverage buckets v2 — edge/path buckets derived from the actual input bytes (FNV + op/item/qty), better diversity metric for reports
• Artifacts — findings store SHA256(input), repro [mono]check(0x…)[/mono], on-disk [mono].input[/mono] artifact under [mono]data/fuzz-artifacts/[/mono]
• Diff++ — [mono]GET /api/fuzz/campaigns/{id}/diff?base_campaign_id=…[/mono] now includes [mono]coverage_delta[/mono] (new edges/paths vs baseline)
• Reports — [mono]fuzz_report_v2[/mono] + [mono]fuzz_engine[/mono] block (version, seed_count, features)
• CLI — [mono]hackme-fuzzing campaign create|status|report-url[/mono] (requires [mono]HACKME_ADMIN_TOKEN[/mono] on your local node)

What did NOT change (honest scope)

• Still WASM property gates — not full-binary AFL on your server
• Still useful-PoW + pool for scale — hashrate finds more inputs, not magic CVEs
• Customer orders still on local [mono]hackme-node[/mono] ([mono]127.0.0.1:8080[/mono]); public site stays read-only for fuzz admin

Try it

Code:

git clone https://github.com/jokeez/hackme.git
cd hackme
go test -run TestDeriveFuzzInput ./...
export HACKME_ADMIN_TOKEN=…   # local node
bash scripts/ops/fuzz_engine_v2_gate.sh
go run ./cmd/fuzzingclient campaign create -runs 200 -title "my-module-v2"

Related proof

• Bitcoin Core 5-module WASM research: report
• Downloads / pool: hackme.tech
• Source: github.com/jokeez/hackme

We do not claim to replace libFuzzer or find consensus bugs in upstream Core without a coordinated target. We claim a stronger distributed property-fuzz layer for [mono]your[/mono] WASM guards on open infrastructure.

— useful PoW · fair pool · open reports

[kapa77]

HackMe L1 Crypto Stack v3 — official Bitcoin Core fuzz corpus + upstream-pinned ports

We published a third research report that ties our WASM security pipeline to maintainer-owned fuzz inputs, not synthetic demos.

Public report (HTML):
https://hackme.tech/reports/l1-crypto-stack-v3.html

What is new in v3

• Official corpus — thousands of seeds from bitcoin-core/qa-assets ([mono]fuzz_corpora/eval_script[/mono], [mono]fuzz_corpora/tx[/mono]) fed through HackMe WASM ports of [mono]GetScriptOp[/mono] / [mono]MoneyRange[/mono]-style checks (0 sandbox traps).
  
• Pinned upstream — shallow clones of Bitcoin Core, go-ethereum, Dogecoin, Litecoin at tags recorded in [mono]upstream/pins.json[/mono]; marker fidelity script verifies our C ports against the real trees.
  
• HackMe golden — 20,000 random manifests: WASM [mono]upstream_hackme_order_gate[/mono] matches Go [mono]InsertOrderTask[/mono] economic floors.
  
• Five-chain WASM probes — same useful-PoW sandbox as Security Audit / pool miners.
  
• Repro bundle — extracted [mono]check(0x...)[/mono] cases + [mono].input[/mono] artifacts for Bitcoin/Ethereum triage:
  https://hackme.tech/reports/l1-crypto-stack-v3-repro.json
  

Companion reports
L1 stack v2 ·
Bitcoin Core 5-module

Honest scope
This is not a claim that we ran the full Bitcoin Core fuzz binary in this HTML job. It is a claim that we used the same minimized seed corpora the Core project uses (qa-assets) and executed them through our ported predicates on open HackMe infrastructure. Native libFuzzer builds: see Bitcoin doc/fuzzing.md and OSS-Fuzz.

Crash verdict (Bitcoin + Ethereum repro extraction)

• Reproducible [mono]check(0x...)[/mono] signals: yes
  
• Reproducible WASM crash traps: 0
  
• 0-day likelihood on current dataset: low (modeled policy/overflow signals, no exploitable crash evidence)
  

Reproduce

Code:

git clone https://github.com/jokeez/hackme
bash scripts/ops/run_l1_crypto_stack_v3_research.sh

Source ports: [mono]tasks/sources/security/upstream/[/mono] · Product: hackme.tech

Feedback welcome from Core maintainers — we can add a native fuzz CI job next.

HACKME (HMC) BREAKTHROUGH: NOW LIVE ON MININGPOOLSTATS

Useful PoW / PoH (WASM sandbox) enters public mining discovery

Official coin page:
https://miningpoolstats.app/coins/HMC

Why this is a major step

• Public discoverability unlocked — miners can now find HMC in the same interface they use for established PoW ecosystems.
  
• Trust signal unlocked — transparent algorithm, reward, supply, and chain profile visible on a neutral stats platform.
  
• Growth pipeline unlocked — this is the gateway to scalable worker inflow, pool competition, and stronger network security.
  

What makes HackMe different

• Algorithm: Useful PoW / PoH (WASM sandbox), not synthetic idle hashing.
  
• Current base reward: 0.01000000 HMC
  
• Max supply: 100,000,000 HMC
  
• Hybrid work model: coordinator tracks accepted work; settlement credits miner [mono]HMC-...[/mono] on-chain.
  
• SUP utility lane: support-accrual for honest hybrid mining (listing policy remains after primary HMC listing).
  

Infrastructure status (transparent note)

• We currently have a temporary host-side outage with our VPS provider (hardware/cooling incident).
• During this window, some public pool endpoints may return timeout/520/522.
• This does not change chain economics or roadmap; it only delays public pool registration switch-on.
  

Recovery playbook (already queued)

• Restore canonical stack: [mono]hackme-node + coordinator + nginx[/mono]
  
• Run end-to-end health gates + settlement verification
• Confirm stable worker accept/submit window
• Finalize MPS pool registration and publish "POOL LIVE" verification update in-thread

Call to miners / pool operators
If you mine useful-work networks and want early access positioning, watch this thread.
As soon as provider recovery is confirmed, we post:

• live pool endpoint
• verified uptime snapshot
• worker onboarding command set

Tracking link:
MiningPoolStats — HackMe (HMC)

Next update in this thread: provider recovery confirmation + pool registration activation.

[kapa77]

HackMe L1 Crypto Stack v4
Live useful-PoW fuzz · real HMC escrow · five upstream chains · May 2026

TL;DR

We moved from static research HTML (v2/v3) to a live production run on hackme.tech: five fuzz campaigns on WASM guards ported from Bitcoin · Ethereum · Dogecoin · Litecoin · HackMe, funded by real HMC escrow, executed by pool workerfuzz workers, with auto-generated [mono]fuzz_report_v2[/mono] HTML per campaign — and +17 PoH blocks mined on the hub ledger during the same window.

Master report: https://hackme.tech/reports/l1-crypto-stack-v4.html

Honest headline: this is not “we hacked Bitcoin Core.” It is “we ran paid, reproducible, on-chain useful-PoW fuzz on [mono]check(i64)->i32[/mono] guards derived from upstream L1 source files — on the same open stack our miners use.”

WHAT HAPPENED (step by step)

1 · Offline layer	Built upstream WASM ports from pinned trees ([mono]upstream/pins.json[/mono]) + probed bitcoin-core/qa-assets seeds (same class as Core [mono]eval_script[/mono] corpora). See L1 v3 report.
2 · Live escrow	Operator hub wallet locked 2.5 HMC across 5 production fuzz campaigns ([mono]0.5 HMC[/mono] each, escrow split 20% runs / 80% bounty).
3 · Pool workers	[mono]workerfuzz[/mono] processes on the public coordinator claimed distributed check-work, executed WASM in the HackMe sandbox ([mono]fuzz_engine_v2[/mono]), submitted signed results.
4 · Payouts	11 fuzz runs completed · ~0.092 HMC runs-pool paid · 1.6 HMC bounty-pool paid · per-campaign [mono]report.html[/mono] generated automatically.
5 · Chain ledger	Hub node tip height 50,956 → 50,973 (+17 blocks) while campaigns were live — mining and security research on the same infrastructure.

LIVE CAMPAIGN RESULTS

Chain	Upstream guard	Runs	Verdict	Runs paid	Bounty paid	Report
Bitcoin	[mono]GetScriptOp[/mono] · [mono]script.cpp[/mono]	1 / 12	clean	[mono]0.0083[/mono]	[mono]0.40[/mono]	HTML
Ethereum	[mono]uint256.FromBig[/mono] overflow class	7 / 12	clean	[mono]0.0583[/mono]	[mono]0[/mono]	HTML
Dogecoin	[mono]HasValidOps[/mono] · BTC-fork	1 / 12	clean	[mono]0.0083[/mono]	[mono]0.40[/mono]	HTML
Litecoin	[mono]GetScriptOp[/mono] · LTC	1 / 12	clean	[mono]0.0083[/mono]	[mono]0.40[/mono]	HTML
HackMe	[mono]InsertOrderTask[/mono] gate	1 / 12	clean	[mono]0.0083[/mono]	[mono]0.40[/mono]	HTML

Campaign IDs are permanent on the hub — you can re-open any [mono]report.html[/mono] link above without our admin token (public read route).[/color][/size]


WHAT THIS MEANS

For Bitcoin / altcoin developers

• We are probing consensus-class predicates (script push bounds, overflow paths, fork-family [mono]HasValidOps[/mono]) inside a reproducible WASM sandbox, not claiming a new CVE in upstream repos without maintainer repro.
  
• v3 showed methodology + official seeds; v4 shows the same stack can run as a paid live service with escrow, worker payouts, and customer-grade HTML reports.
  
• “Detector” findings here mean inputs outside the accepting policy set — expected for guards designed to reject oversize pushes / overflow-class values. Verdict: clean = no exploitable WASM crash evidence on this run.
  

For miners / pool participants

• Useful-PoW is not only “hash for coins” — the coordinator can route work to security checks derived from code paths miners already know from BTC/ETH/DOGE/LTC ecosystems.
  
• Escrow actually moved HMC: runs pool pays per completed check; bounty pool pays on first qualifying detector signal (80% − fee). This run: [mono]~0.092 HMC[/mono] runs + [mono]1.6 HMC[/mono] bounty disbursed.
  
• During the same session the hub chain advanced +17 blocks — live mining and fuzz research shared production infrastructure.
  

For integrators / B2B fuzz customers

• Same [mono]fuzz_report_v2[/mono] pipeline as local Security Audit orders — but now demonstrated cross-chain and pool-distributed on the public hub.
  
• Open reproduction: [mono]bash scripts/ops/run_l1_crypto_stack_v4_live.sh[/mono] (live phase uses VPS internal node + public coordinator — documented in repo).
  

ECONOMICS LEDGER (on-chain hub)

Metric	Value
Operator escrow wallet	[mono]HMC-381c0c5e2cfcc714[/mono]
Total campaigns	5
Escrow budget locked	2.5 HMC
Fuzz runs completed	11
Runs pool paid	~0.092 HMC
Bounty pool paid	1.6 HMC
Hub tip height delta	+17 blocks (50,956 → 50,973)
Bounty winner address	[mono]HMC-719006d93916ad52[/mono] (treasury worker on signed pool submits)

HOW v4 DIFFERS FROM v3

	v3	v4
Execution	Offline corpus probe	Live pool workerfuzz
Payment	Research job only	Real HMC escrow
Proof	Static HTML + repro JSON	Static HTML + per-campaign report.html
Ledger	Not in scope	+17 blocks during run

Companion reports
L1 v3 · official qa-assets corpus ·
L1 v2 · five-chain ports ·
Bitcoin Core 5-module deep-dive


TECHNICAL SCOPE (read this)

• WASM guards are portable C excerpts from named upstream files ([mono]tasks/sources/security/upstream/[/mono] + [mono]ATTRIBUTION.md[/mono]) — not full [mono]bitcoind[/mono] / [mono]geth[/mono] binaries.
  
• Live campaigns were created on the hub command node (internal API); public nginx intentionally blocks [mono]POST /api/fuzz/campaigns[/mono] — read-only [mono]report.html[/mono] is public.
  
• No 0-day claim against Bitcoin Core, go-ethereum, Dogecoin, or Litecoin from this dataset. High reject/signal rates on selective guards are by design.
  
• Next (v4.1): native libFuzzer differential on the same qa-assets seeds vs our WASM ports — the credibility jump we are building toward.
  

REPRODUCE

Code:

git clone https://github.com/jokeez/hackme
cd hackme
bash scripts/ops/run_l1_crypto_stack_v4_live.sh
# live phase: operator .secrets + NODE_SSH=hackme-vps
# report:  web/site/reports/l1-crypto-stack-v4.html

Source · github.com/jokeez/hackme 
Pool · live stats 
Downloads · 0.1.0-rc11i

Re: [ANN] HackMe — L1 Crypto Stack v4 · live useful-PoW fuzz on Bitcoin / Ethereum / Dogecoin / Litecoin upstream guards

Disclaimer — HackMe is experimental RC software ([mono]0.1.0-rc11i[/mono]). Mining and cryptocurrency involve risk. This post is technical documentation, not investment advice. Pool parameters and settlement timing may change with notice on the official website. English is authoritative.

— useful PoW · fair pool · open reports · cross-chain research —

[kapa77]

▰▰ HACKME FUZZ PILOT ▰▰[/size]

5 FREE CODE FUZZING CAMPAIGNS[/size]
No HMC payment. No hidden fees. Just a real WASM sandbox fuzz.

⚡ FIRST COME, FIRST SERVED ⚡
Limited slots — once they're gone, the pilot is closed.

---

▸ WHAT YOU GET[/size]

• Real fuzz campaign on your code (C, Rust, C++, or WAT)
  
• fuzz_report_v2 — verdict, stats, full findings summary
  

Code:

repro_cmd

for every single signal (reproducible, not guesswork)

• Optional public write-up — only with your permission
  

▸ WHAT WE NEED FROM YOU[/size]

• Short description of what your code does
• Source file(s) or order manifest
• Language + target: parser, guard, bounds, crypto helper, etc.

▸ HOW TO APPLY (5 SLOTS ONLY)[/size]

Subject line:

Code:

fuzz-pilot

• Bitcointalk: reply here or PM the ANN author
  
• Email: support@hackme.tech
  
• Telegram: @hackme_tech (DM)
  
• X: @HackMeTech (DM)
  
• Contact hub: hackme.tech/contacts.html
  

---

▸ SCOPE (HONEST)[/size]

HackMe sandbox fuzzing — great for guards, parsers, and WASM-order pipelines. 
It is not a full native audit of your entire production binary. 
We report what the engine finds — you validate before any public disclosure.

After 5 pilot slots → standard pricing via HMC escrow (local node).

---

▸ LINKS[/size]

• hackme.tech
  
• Developers / Fuzz docs
  
• Contacts
  
• GitHub (AGPL-3.0)
  
• Sample report: Bitcoin Core 5-module
  

───
HackMe Network — useful Proof-of-Work pool + WASM fuzz marketplace.

[kapa77]

[ANN][SECURITY+MINING] Free fuzzing baseline for PoW projects (no hype, reproducible)

Hi miners and builders,

We run public, reproducible security fuzzing for PoW-related stacks and publish honest reports (guard-signal triage, no fake CVE claims).

What we offer for free (limited slots weekly):
- Baseline fuzz pass for your mining/pool/node code path
- Reproducible results + triage summary
- Practical fix suggestions and retest

Our public references:
- Research hub: https://hackme.tech/research.html
- Bitcoin30 reports: https://hackme.tech/reports/bitcoin30-week1.html
- Day 8: https://hackme.tech/reports/bitcoin30-day08.html

How to apply:
Reply in thread or DM with:
1) Repo / target component
2) Build instructions
3) Main risk area (parser, tx validation, pool API, etc.)

We prioritize real maintainers and active projects.

[kapa77]

Update — 0.1.0-rc11p (Jun 2026)

Mining
• Public coordinator: https://hackme.tech/pool/coordinator
• GPU hashrate reporting fixed (home rigs show real GH/s)
• Fair pool: 90s lease, max 3 active leases per worker
• Windows one-click installer with preconfigured pool token
• Listed on MiningPoolStats: https://miningpoolstats.app/coins/HMC

Research (published on-site)
• OSS CVE wave12 — CLEAN (pcre2, yajl, json-c, cmp, uriparser @ 50k iter)
• Bitcoin Core 30-day fuzz series complete — 8,808 runs, 0 critical findings
• Hub: https://hackme.tech/research.html

B2B security fuzz
• Local node + hackme-fuzzing CLI (code stays on your machine)
• Distributed pool executes WASM-gated campaigns
• Public tracker: https://hackme.tech/fuzzing-console.html

Downloads: https://hackme.tech/downloads.html
Source (AGPL-3.0): https://github.com/jokeez/hackme
Telegram: https://t.me/hackme_tech

[kapa77]

Hello Bitcointalk,

Short research update from the HackMe security pipeline — not mining news, but
relevant to anyone who cares about parser hardening in tooling stacks.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 WHAT HAPPENED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We run Tier-D mutation fuzz (clang + ASAN/UBSan) on small open-source C parsers.
One target: Arsievert/cfgpack — a compact MessagePack decoder.

A malformed int64 payload (MessagePack tag 0xd3 + 8 bytes) triggered UBSan:

  → function: cfgpack_msgpack_decode_int64()
  → location: msgpack.c:294
  → class:   signed integer left-shift overflow (undefined behavior)

AddressSanitizer did NOT report heap corruption on this input.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 DISCLOSURE OUTCOME
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  Reported:  https://github.com/Arsievert/cfgpack/issues/1
  Fixed:     https://github.com/Arsievert/cfgpack/commit/b5e7cff
  Status:    maintainer closed issue as COMPLETED
  CVE:       none (UBSan / UB — not memory corruption)

Timeline: reported 25 Jun 2026 → fix merged 28 Jun 2026.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 WHY POST THIS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

CVE headlines get the clicks. Merged fixes on UB findings rarely get mentioned.
We publish case cards for both — because catching UB *before* it becomes a
memory bug is how you keep infrastructure boring (in a good way).

Full case study (timeline, links, honest scope):
  → https://hackme.tech/reports/oss-cve/cases/cfgpack.html

More OSS hunt cases:
  → https://hackme.tech/reports/oss-cve/

Methodology + source (AGPL-3.0):
  → https://github.com/jokeez/hackme

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 HACKME CONTEXT (for newcomers)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

HackMe is an open GPU mining network (HMC) with a public security research arm:
Bitcoin guard fuzzing, OSS parser hunts, coordinated disclosure.

  Site:      https://hackme.tech
  Pool:      https://hackme.tech/pool/coordinator
  Downloads: https://hackme.tech/downloads.html

No ROI talk here — this post is research only.

Questions welcome. We'll answer what we can without publishing weaponized PoC.

— HackMe research / jokeez
```

**Signature block (optional):**

```
---
HackMe Network · useful PoW · open source security research
https://hackme.tech · AGPL-3.0 · https://github.com/jokeez/hackme

[kapa77]

[ANN] HackMe Network — useful PoW pool · WASM · public coordinator

Pool update — July 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 POOL STATUS (live)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Official coordinator: https://hackme.tech/pool/coordinator
Stats API:            https://hackme.tech/pool/coordinator/api/pool/stats
Explorer:             https://hackme.tech/pool/explorer

Snapshot (July 9, 2026):
  • Pool hashrate: ~64 GH/s
  • Workers online: 4
  • Block height: 157785+
  • Hybrid signer: strict (signed submits required)
  • Fair pool mode: payout for accepted work → operator settlement → on-chain HMC

MiningPoolStats hosted dashboard shut down in July 2026 (project open-sourced).
We removed dead MPS links from hackme.tech. Use the official stats API above — not third-party aggregators.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 MINER QUICK START
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Download only from https://hackme.tech/downloads.html — verify SHA256 on the same page.
2. Windows: HackMe-Setup.exe → start_hackme_public_pool.bat (pool token preconfigured).
3. Linux / HackMe OS ISO: workerpoh + minersign; set HACKME_PUBLIC_AUTHORITY_BASE=https://hackme.tech
4. Map worker-id → your HMC-... payout address (WORKER_PAYOUT_MAP).
5. Track accrual on local dashboard (127.0.0.1:8080) and explorer after settlement.

Economics reminder (read before scaling rigs):
https://hackme.tech/economics-model.html
Coordinator accrual ≠ wallet balance until settlement runs.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 RESEARCH (short — not a mining post)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

OSS CVE Watch — 14-day public ledger on nghttp2 (one repo, honest CLEAN days).

Day 2/14 published:
  • libFuzzer + ASAN · ~8h · 1,013,382,502 executions
  • Corpus: 2,905 inputs · 467 coverage edges
  • Verdict: CLEAN · 0 ASAN heap crashes

Report: https://hackme.tech/reports/oss-cve-watch/day02.html
Hub:    https://hackme.tech/reports/oss-cve-watch/

We publish clean days too. CVE number only after ASAN repro + maintainer triage.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 LINKS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Site:       https://hackme.tech
Downloads:  https://hackme.tech/downloads.html
Research:   https://hackme.tech/research.html
Source:     https://github.com/jokeez/hackme (AGPL-3.0)
Telegram:   https://t.me/hackme_tech

Questions welcome in-thread. We answer setup questions; no exploit PoCs in public.

— HackMe operators

Disclaimer: HackMe is experimental RC mining software. Mining carries risk. Not investment advice. Not an ICO. Pool parameters may change with notice on the official site. English authoritative.

[kapa77]

HackMe Network — pool bump · July 2026 · rc11s production baseline

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 POOL LIVE (snapshot · July 13, 2026)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Official coordinator:  https://hackme.tech/pool/coordinator
Pool stats API:        https://hackme.tech/pool/coordinator/api/pool/stats
Work stats (detail):   https://hackme.tech/pool/coordinator/api/work/stats
Explorer:              https://hackme.tech/pool/explorer

  • Pool hashrate:     ~88 GH/s (live coordinator aggregate)
  • Workers online:    6 registered · 2 active GPU rigs (~61 + ~27 GH/s)
  • Block height:      170,961+
  • Total accrual:     ~3,249 HMC paid out via coordinator ledger
  • Fair pool:         90s lease · max 12 active leases/worker · hybrid signer strict
  • Pool fee:          0% operator skim on coordinator accrual
  • Settlement:        off-chain accrual → on-chain HMC (timer + health gates)

Not Stratum. HTTP coordinator + workerpoh (CUDA on Linux/NVIDIA · OpenCL on AMD/Manjaro).
MiningPoolStats hosted dashboard shut down Jul 2026 — use official API above, not dead third-party links.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 WHY MINE HERE (honest pitch)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✓ Useful PoW — WASM-gated nonce work, not blind SHA loops
  ✓ Open client — AGPL-3.0 · verify SHA256 on hackme.tech/downloads.html
  ✓ Fair economics — payout for accepted work, not lottery-only “found” mode
  ✓ Two earn paths — PoH mining + optional pool fuzz work (same coordinator)
  ✓ 0% pool fee today — home GPU friendly while network grows
  ✓ Public research arm — OSS CVE Watch proves the stack does real security work

We are early. ~2 serious GPU miners today. That is risk and opportunity:
low competition on accrual, real GH/s visible on stats API, operator answers setup in-thread.

No CEX listing yet. No ROI promises. Mine if you want open infrastructure + useful compute — not if you need instant fiat exit.

Economics (read once): https://hackme.tech/economics-model.html
Coordinator accrual ≠ wallet balance until settlement runs.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 MINER QUICK START (5 steps)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Download ONLY from https://hackme.tech/downloads.html — verify SHA256 on same page.
   Release channel: 0.1.0-rc11s (production baseline · stable rc)

2. Windows: HackMe-Setup.exe → start_hackme_public_pool.bat (pool token preconfigured).
   Linux: tarball with workerpoh-cuda + workerpoh-opencl + minersign.
   Dedicated rig: HackMe OS ISO — Zero-Knowledge Start (boot → HMC address on screen → mine).

3. Set authority:
   HACKME_PUBLIC_AUTHORITY_BASE=https://hackme.tech

4. Map worker-id → your HMC-… payout address (WORKER_PAYOUT_MAP / hybrid signer).
   Must match operator settlement map or on-chain credit stalls.

5. Track:
   • Local dashboard  http://127.0.0.1:8080  → Mining → Start pool worker
   • Coordinator GH/s on /api/work/stats
   • Explorer after settlement batch

GPU notes (from real fleet):
  • NVIDIA Linux: workerpoh-cuda — 50–70 GH/s class (4090-tier home rig)
  • Manjaro/OpenCL: HACKME_GPU_BACKEND=opencl if CUDA NVRTC missing
  • AMD Windows: workerpoh-opencl in installer

Questions in-thread — we answer setup. No weaponized PoC in public.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 OSS CVE WATCH · nghttp2 · public ledger (Days 1–6 live)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

14-day honest hunt on nghttp2 (HTTP/2) — libFuzzer + ASAN, corpus persists.

Published on-site:
  Day 5: 2.04B exec · 15h · CLEAN · 0 ASAN heap crashes
  Day 6: resume slice post-reboot · CLEAN · 0 ASAN
  Days 2–6 cumulative: billions of exec · coverage plateau 467 edges · no heap bugs

We publish CLEAN days. CVE number only after ASAN repro + maintainer triage.

Day 5 report: https://hackme.tech/reports/oss-cve-watch/day05.html
Day 6 report: https://hackme.tech/reports/oss-cve-watch/day06.html
Series hub:  https://hackme.tech/reports/oss-cve-watch/

This is what “useful PoW network” means here — mining infra + open security research on the same stack.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 B2B / INTEGRATORS (optional — not required to mine)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  • hackme-fuzzing CLI — WASM guard audits · escrow 20/80
  • Pool-distributed fuzz workers (workerfuzz) — same coordinator
  • Developers: https://hackme.tech/developers.html
  • Console (read-only): https://hackme.tech/fuzzing-console.html

Miners: you can ignore this block entirely and just run workerpoh.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 LINKS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Site:        https://hackme.tech
Downloads:   https://hackme.tech/downloads.html
Research:    https://hackme.tech/research.html
Economics:   https://hackme.tech/economics-model.html
Source:      https://github.com/jokeez/hackme (AGPL-3.0)
Telegram:    https://t.me/hackme_tech
Contact:     support@hackme.tech · https://hackme.tech/contacts.html

Also listing notes (optional): hashrate.no pool submit — HTTP coordinator, not TCP :3333.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Call to miners: if you have a spare NVIDIA/AMD box and want to be early on a useful-PoW pool with open reports and 0% fee — reply here with your OS + GPU. We help with first boot (Windows / Linux / ISO).

— HackMe operators

Disclaimer: HackMe is experimental RC mining software (0.1.0-rc11s). Mining carries risk. Not investment advice. Not an ICO. No token sale. Pool parameters and settlement timing may change with notice on hackme.tech. English authoritative.