Nothing Up My Sleeve (roulette)

cryptohack

Task: a roulette casino whose wheel is driven by a Dual_EC_DRBG-style RNG s=(t*P).x, r=(s*Q).x & (2^240-1) over P-256, where the PLAYER chooses Q. Solution: plant the Dual EC backdoor by setting Q=e*P (e=2) with known d=e^{-1} mod n; then e^{-1}*R lands on s*P recovering the next seed. Brute the 16 truncated top bits via lift_x, reconstruct one full output from observed base-37 spins, forward-predict the wheel through the croupier-change boundaries, bet exact numbers (+35) to reach $1000 and win the flag.