fun problem

I don't think there does - from E[(X_1 + X_2)^n] = E[U^n] = 1/(n+1) we can compute the moments of X, and it turns out the 9th moment isn't big enough

Here's my attempt

9/ 128 bits seems just out of reach, maybe with some careful parameter tuning and enough time or with a more advanced factoooring method it can be done. I'd love to hear if anyone was able to make this work! cc @samczsun @paradigm_ctf

6/ How can we find such a c? Remember from Fermat's Little Theorem that 2^{p-1} ≡ 1 (mod p), and so 2^k ≡ 1 (mod p) whenever p-1 divides k. So, if we multiply a bunch of small prime powers together, we might get lucky and have p-1 divide their product.

2/ First, the unintended backdooor solution - python's subprocess run leaks the FLAG environment variable, so we can read it with forge cheatcodes and base 256 encode it into the two uints that the runner helpfully prints for us:

1/ Trapdooors, Backdooors, and Maybe Actually Factoooring some paradigm CTF notes (pic related)

2/ The Babylonian method, AKA Newton's method, approximates sqrt(S) by starting with an initial estimate x_0, and updates by averaging x_n and S/x_n. Then x_n will converge to sqrt(S), and for integers, will eventually equal floor(sqrt(S)).

(2) The full calculations are here overleaf.com/read/cdqwywvtvg…. It's maybe not too surprising that hyperbolic functions fall out, given that the AMM curve is a hyperbola. The formula is particularly simple if we maintain the scaled units/tanh parametrization:

(1) Some thoughts on Paradigm's TWAMM (paradigm.xyz/2021/07/twamm/) The formula seems mysterious, but after some scaling, it turns out that two-sided constant product AMM trades are just hyperbolic tangent additions! This gives an alternate equivalent formula, without any calculus: