Terms of
engagement
This guide outlines the eligibility criteria, rules, and general conditions for participating in the Fluid Attacks CTF.
Participation requirements
Eligibility
The Fluid Attacks CTF is strictly an individual competition. Fluid Attacks does not allow team formation or collaboration among participants.
This competition is restricted to citizens or permanent residents of Latin American and Caribbean countries.
Account policy
Participants may have only one (1) account.
The creation of alternate accounts (sockpuppets), test accounts, or the sharing of account access is forbidden and will result in an immediate rejection of all associated accounts.
Registration
Each applicant must register for the CTF via the official form. All information provided must be complete and truthful.
Each applicant's registration data will be cross-checked against their public LinkedIn information. They must ensure that their profile is accurate and up to date with their current employment or academic status before submitting the application.
If the CTF form prohibits an applicant from entering their LinkedIn profile because it is already in use by someone else, the applicant should notify Fluid Attacks of this issue at [email protected].
If the applicant is a permanent resident of a country in Latin America or the Caribbean but their LinkedIn profile does not reflect this, they must send proof of residency to the Fluid Attacks email address provided above.
Review and approval
Fluid Attacks' organizing team reviews applications. The approval is not automatic and depends on eligibility requirements and available capacity.
Once an application has been approved or rejected, Fluid Attacks will email the applicant.
Rejection criteria
A registration will be automatically rejected if:
The provided LinkedIn profile is nonexistent, has no connections, or has no verifiable history.
The applicant is not a citizen or legal resident of a Latin American or Caribbean country.
The information is false, incomplete, or does not match the professional or academic identity on LinkedIn.
The applicant has been banned from any previous edition of the Fluid Attacks CTF.
Participation rules
During the CTF, participants must not:
Share solutions, write-ups, flags, or techniques with other participants (they may do so only after at least 72 hours have passed since the end of the CTF; doing so earlier would result in disqualification from the competition).
Solve challenges together with other participants or engage in any other form of collaboration.
Use multiple accounts or impersonate others.
Submit flags via brute force or automate mass submissions.
Attack the CTF infrastructure or attempt to cause a DoS/DDoS.
Sabotage or interfere with the performance of other participants.
Fair play and penalties
Participants who commit any form of fraud in the CTF will be:
Immediately disqualified from the competition.
Permanently banned from future editions.
Removed from all cumulative rankings: Their past and current scores will no longer count toward any individual, company, university, or country cumulative rankings.
Community standards
All participants are required to behave respectfully and professionally at all times; therefore, harassment, discrimination, and any unethical behavior are not permitted. This applies to all communication channels used in the competition (Discord, email, the CTF platform, etc.). Any violation may result in immediate disqualification from the current CTF and permanent exclusion from future editions.
Use of AI tools
The CTF will have two separate scoreboards: AI-Permitted (before 'Unrestricted') and AI-Prohibited (before 'AI-Free').
Each participant must choose their scoreboard during registration. Switching scoreboards is not allowed; only the scoreboard selected at registration will be considered.
The two game modes are defined as follows:
AI-Prohibited
Participants agree not to use AI tools in any form during the competition. This scoreboard is ranked independently from AI-Permitted, and its participants are equally eligible for prizes. This scoreboard is intended for people who wish to compete to demonstrate their skills and go head-to-head against other competitors.
AI-Permitted
Participants may use AI tools as they wish, provided they understand and can reproduce their submitted solutions on their own, do not use AI agents to solve challenges autonomously (without human interaction), and continue to comply with all other rules set forth in this document. This scoreboard is ranked independently from AI-Prohibited. Participants in this scoreboard are eligible for prizes, although a larger share of the prize pool is allocated to the AI-Prohibited scoreboard.
Fluid Attacks requires a live interview from the top-ranked participants in the AI-Prohibited scoreboard to validate their understanding of the submitted solutions, in order to claim the prizes. Fluid Attacks also reserves the right to request a live interview from any other participant in either scoreboard. Alternatively, Fluid Attacks reserves the right to request a video write-up showing the solution and the dynamic exploitation of the challenge in a live environment. Failure to demonstrate such understanding may result in disqualification from the CTF.
Ranking and prizes
For corporate and institutional rankings, subsidiary companies, branches, or brands belonging to the same parent holding group will be grouped under the main parent company's name.
Fluid Attacks awards prizes to the top three participants in each scoreboard (AI-Permitted, AI-Prohibited). In the event of a tie, Fluid Attacks will use the time it took participants to complete the challenges as the tiebreaker.
To validate the provisional winners' scores, organizers run a live interview process:
45-minute live session via Google Meet, covering three challenges selected in advance by CTFAE from among those the participant has already solved, and not revealed to the participant before the session.
The interview is conducted in English by CTFAE; members of the Fluid Attacks team will join to translate into Spanish or Portuguese if needed.
Camera on and full screen sharing are mandatory throughout the interview.
The session is recorded. By accepting these rules, participants consent to being recorded.
Participants must not receive external help during the interview.
AI-Prohibited prize candidates (top 3) are notified on Sunday and must be available on Monday, from 7:00 a.m. to 11:00 a.m. (UTC-5).
Alternates (4th–6th place) are notified to be interviewed on Tuesday only if needed.
If a participant does not attend for the interview or the interview is inconclusive, that prize will not be awarded.
If Fluid Attacks determines that a participant solved the challenges autonomously, or did not actually complete or understand them, the participant may be banned, and the prize passes to the next qualifying participant, the ranking will be updated accordingly.
CTFAE, together with Fluid Attacks evaluates each challenge during the interview and determines whether the participant's understanding and solution are demonstrated, partially demonstrated or inconclusive, or not demonstrated. Based on this assessment, the interview challenges are scored to determine whether the participant deserves the prize, does not deserve the prize, or cheated and must be disqualified.
Interview results are communicated afterward, once both parties (CTFAE and Fluid Attacks) have completed their evaluation.
Session confidentiality: participants must not disclose which challenges were assigned or the interview content while the validation process remains open.
All validation is completed within 72 hours of the CTF's conclusion, in line with the policy against publishing solutions during this period. Decisions issued at the end of the validation process are final.
Fluid Attacks disburses the prizes after reviewing and approving the results of the interviews for these final challenges. If the participant does not attend the interview, the prize is declared unawarded.
If the winner of any of the prizes is an employee of Fluid Attacks, they will receive only the monetary equivalent of the prize in the form of funding for cybersecurity certifications.
Every active player, regardless of their result, receives a verifiable badge for having participated in the CTF. Top-ranked participants may receive distinctive badges.
Data privacy
By registering, the applicant authorizes Fluid Attacks to review their public LinkedIn profile for profiling purposes (e.g., to verify their residence in Latin America, current employment, or student status). This data will be used exclusively for eligibility verification, competition statistics, and rankings, and will not be sold to third parties. Only Fluid Attacks and CTF.ae will have access to it.
Technical issues related to the CTF challenges or platform should be reported via the CTF's official Discord server.
All other questions, concerns, or requests should be sent to [email protected].
By registering and participating, the participant agrees to comply with all rules set forth herein and to accept the consequences of noncompliance.
Fluid Attacks may conduct investigations after the competition and retroactively disqualify participants who violated any of the rules mentioned above. Therefore, the rankings may be affected by these investigations.
