Terms of
engagement
This guide gives the rules and conditions that apply to the Fluid Attacks CTF.
The CTF starts at 8:00 a.m. (UTC-5) and ends at 8:00 p.m. (UTC-5) on Saturday, September 26, 2026.
Requirements
General requirements
In the Fluid Attacks CTF, each participant competes alone. Teams and help between participants are not permitted. See the FAQ question "Can I participate as part of a team?".
Only citizens and permanent residents of a country in Latin America or the Caribbean can participate. See the FAQ question "Who is eligible to participate in the CTF?" for the proof required when your LinkedIn profile does not show your country.
Account policy
You can have only one (1) account.
Alternate accounts, test accounts, and shared accounts are not permitted. Fluid Attacks will reject accounts that do not obey this rule.
Registration
You must register with the official form. All your data must be complete and true. Fluid Attacks compares your registration data with your public LinkedIn data. Before you apply, make sure that your LinkedIn profile is correct and complete, and shows your current employment or academic status.
If the form does not accept your LinkedIn profile because a different person used it, send an email to [email protected].
If you win a prize, Fluid Attacks will ask you for bank data and a payment document. Section 7.8 gives the complete list.
Review and approval
The Fluid Attacks organizers examine all the applications. Approval depends on the requirements and on the available capacity. Fluid Attacks will send you an email when it approves or rejects it.
See the FAQ question "Can I cancel or transfer my registration spot?" if you cannot participate after approval.
Automatic rejection
Fluid Attacks will automatically reject your registration for the reasons that the FAQ question "Why was my registration rejected?" gives.
Rules of the competition
Obey these rules during the CTF:
Do not solve challenges with other participants, give or get help, or ask for hints on external forums or Discord. See the FAQ question "Can I participate as part of a team?".
Do not share solutions, write-ups, flags, or techniques before 72 hours after the end of the CTF. See the FAQ question "What happens if I publish solutions or write-ups during or after the competition?".
Do not use more than one account or the identity of a different person.
Do not use brute force to send flags. Send only the flag from solving the challenge.
Do not attack the CTF platform or cause a DoS or a DDoS against it. You can attack a challenge instance. This is part of the challenge.
Do not harm the performance of other participants.
Scoring
Every challenge starts with a value of 500 points. As more participants solve a challenge, the platform decreases its point value for all participants. See the FAQ question "How does the dynamic scoring system work?" for the tiebreaker rule.
Fluid Attacks has a zero-tolerance policy for fraud. See the FAQ question "What are the consequences of cheating or fraud?" for the penalties.
If you suspect that another participant breaks these rules, see the FAQ question "What happens if I suspect another participant is cheating?"
See the FAQ question "How does the live interview process work?" for the decision.
Be polite and professional at all times. Harassment, discrimination, and other unethical behavior are not permitted.
Obey this rule in all the communication channels of the competition: Discord, email, and the CTF platform.
If you do not obey this rule, Fluid Attacks can disqualify you and ban you permanently from future editions.
AI tools
The two scoreboards
The CTF has two separate scoreboards: AI-Prohibited and AI-Permitted. You must select your scoreboard during registration and cannot change it. See the FAQ question "Can I switch scoreboards after registering?"
The AI-Prohibited scoreboard
On this scoreboard, you must not use any AI tool. You must complete every challenge by yourself. If Fluid Attacks finds that you used an AI tool, Fluid Attacks bans you. See the FAQ question "What are the prizes and how are they awarded?" for the details.
This scoreboard gets the largest part of the prize pool and ranks separately from the AI-Permitted scoreboard.
The AI-Permitted scoreboard
On this scoreboard, you can use AI tools if you obey the conditions in the FAQ question "Are AI tools allowed during the competition?" This scoreboard ranks separately from the AI-Prohibited scoreboard.
During the validation interview, do not use AI tools to reproduce your solution.
Rankings and prizes
Rankings of companies and institutions
Fluid Attacks calculates rankings for countries, companies, and universities from each group's top three scores. Fluid Attacks adjusts this score with a statistical model.
See these FAQ questions for the complete rules:
How are country, corporate, and university rankings determined?
Will my score count towards a company if I am a freelancer or contractor?
Will I be counted as an active student if my university dates are missing?
Prizes
Fluid Attacks gives prizes to the top three participants of each scoreboard, as this table shows.
AI-Prohibited
$1,800
1st place
$900
2nd place
$500
3rd place
AI-Permitted
$400
1st place
$300
2nd place
$100
3rd place
The total prize pool is $4,000 USD.
See the FAQ question "How does the dynamic scoring system work?" for the tiebreaker rule. See the FAQ question "What are the prizes and how are they awarded?" for the validation requirements.
The validation interview
To validate the scores of the possible winners, the organizers do a live interview. Your camera and your full screen must stay on during the session, without a second screen. Fluid Attacks records the session, and you consent to this when you accept these rules.
If you are a prize candidate and you do not attend, you lose the prize. If you are not a prize candidate and you do not attend, Fluid Attacks can ban you.
See the FAQ question "How does the live interview process work?" for the complete rules.
Validation of solutions
The top three participants of the AI-Prohibited scoreboard must go to a mandatory live interview before they get their prizes.
Fluid Attacks can also ask any participant, from either scoreboard, for a live interview or a video write-up, as additional support. This does not replace the mandatory interview for the top three AI-Prohibited participants. Fluid Attacks does not publish the exact method that it uses to find AI use.
See the FAQ question "Are AI tools allowed during the competition?" for the consequences if you do not attend.
Schedule of the interviews
Fluid Attacks tells the top three participants of the AI-Prohibited scoreboard, and gives each one an exact interview time, on Sunday, September 27, 2026. This time is between 7:00 a.m. and 11:00 a.m. (UTC-5) on Monday, September 28, 2026. These participants must be available at this time. If you do not reply, Fluid Attacks will expect you at the interview.
The participants in positions 4 to 6 are the alternates. Fluid Attacks tells the alternates to come to an interview on Tuesday, September 29, 2026, only if it bans one of the top three participants.
See the FAQ question "How does the live interview process work?" for the complete schedule.
Results of the validation
CTF.ae and Fluid Attacks give you their decision when the evaluation is complete. This decision is one of these:
You win the prize.
You do not win the prize.
Fluid Attacks bans you.
See the FAQ question "How does the live interview process work?" for the scoring rule.
While the validation process is open, do not tell other persons the content of your interview. All the validation happens within 72 hours after the end of the CTF.
The validation decisions are final. Fluid Attacks can start an investigation after this period (section 10). Even during an investigation, you can publish your solutions from 72 hours after the end of the CTF. Fluid Attacks pays the prizes after it approves the interview results.
Special conditions
If you are a Fluid Attacks employee with earlier access to the CTF challenges, you cannot compete or win a prize. See the FAQ question "Why was my registration rejected?" for this rule.
If a winner is an employee of Fluid Attacks, Fluid Attacks gives the value of the prize as funds for cybersecurity certifications.
Each active participant gets a verifiable badge for the CTF. See the FAQ question "What is a badge, and who receives one?" for the badge rule.
Prize claim
After the validation, Fluid Attacks sends a message to the winners and asks for this data:
Name.
Bank.
ID document.
Account number.
Full address.
An invoice or equivalent payment document for the prize amount.
Your bank account must accept international transfers.
There is no minimum age to win a prize. If the winner is a minor, the legal representative of the minor completes the prize claim process.
Data privacy
When you register, you give Fluid Attacks your permission to examine your public LinkedIn profile. Fluid Attacks does this to make sure that it shows your residence in Latin America, your employment, or your student status. Fluid Attacks and CTF.ae also use your data for competition statistics and rankings.
The recruitment partner of Fluid Attacks can also access your data. The recruitment partner uses your data only for recruitment and hiring. Fluid Attacks does not sell your data to other companies.
If you are a prize candidate, Fluid Attacks also accesses the recording of your validation interview and the data in section 7.8. Fluid Attacks uses this data only to validate and pay your prize.
If you have technical problems with the CTF challenges or with the platform, use CTF.ae's Discord server.
For all the other questions or requests, send an email to [email protected].
When you register and participate, you agree to obey all these rules. You also accept the consequences if you do not obey them.
The FAQ section is part of these terms. When you accept these rules, you also accept the FAQ.
Fluid Attacks can do investigations after the competition. If an investigation shows a violation of the rules, Fluid Attacks can disqualify the participant. The rankings can change because of these investigations.
