sea of theft — Flag of Yore

Target: https://sot-chall.abcjr.dev/ — PIPWORLD2, a Rust/WASM (Trunk) .io-style pirate game. The challenge carries three flags; this is the one solved here.

Q2 — Flag of Yore

An infrastructure flag: an old release was never cleaned out of the public bucket.

1. index.html pins a release and fetches https://sot-chall-test-versions.abcjr.dev/releases/prod/<id>/release.json — a public Cloudflare R2 bucket with directory listing disabled.
2. The prod asset index (assets.idx, magic PIDX) names an asset that the game never uses: dev_tutorial, 720×640, the last sprite in tutorial.pak (raw RGBA frames, 24-byte PPAK header, 720*640*4 bytes per frame).
3. Rendering it yields a screenshot of the game running in dev mode, and the dev HUD in that screenshot leaks an older release id:

release: v0.0.9-d2bad05a4314-20260914T130501Z

4. That id does not exist under prod, but it resolves under a different channel: /releases/dev/v0.0.9-.../release.json → variant: "dev".
5. That release’s assets.idx lists a third pak, dev, containing flag.txt — 24-byte header plus a 52-byte flag.

The chain is: unused asset → screenshot → version string in pixels → sibling channel → extra pak.