Bring Your Own Program (BYOP)

uoftctf2026

Task: Custom JavaScript VM/emulator with an inline cache optimization, an object shape system, and a security allowlist blocking access to key 0 (file read function). Solution: Exploited an inline cache poisoning bug where dictionary mode transition reorders slots without bumping the cache version (due to missing hit flag on parent objects), causing a cached lookup to return the restricted F0 function instead of F1.