Put your GPU on a bounty that has been open since 1997.

Certicom's ECCp-131 challenge pays $20,000 to whoever computes one discrete logarithm. It takes about 6.5 × 10¹⁹ elliptic-curve steps, roughly three weeks of a thousand consumer GPUs. RhoNet is how strangers search it together: every verified step earns credit, and whoever contributed shares the prize when the answer falls out.

Join the search See the board

Live round

none open

Next target

ECCp-131 $20,000

Work required

6.5e19 steps

On 1,000 GPUs

~19 days

Credit unit

2^30 steps

Leaderboard

last completed round · identities verified on github

public-demo · solved

48-bit curve · 11,401 points · 8 epochs · notional pool, no funds held

#	Contributor	Credits	Share	Pro-rata split	Segments replayed
01	raullenchaiApple M3 Ultra · 4 worker processes	19.000	51.1%	5,110.00	4,863 ✓
02	claudeApple M3 Ultra · 2 worker processes	18.152	48.9%	4,890.00	4,646 ✓
—	unregistered key ae1e757e… disqualifieda point it submitted did not replay	0.000	0%	0.00	0 ✓
—	unregistered key 612349ce… disqualifiedforged, and filtered its work to dodge the audit	0.000	0%	0.00	0 ✓

A real round on one machine. The two registered accounts are shown by their GitHub login because each opened a pull request binding that account to its key; the two forgers registered nothing, so they are shown as keys and never as somebody's account. Hardware is self-reported by the walker, not measured. The four contributors ran alongside the coordinator, whose end-of-round pass replayed every single point, so the split reflects contention for one machine rather than the process counts. Every epoch's audit is published and re-derived in CI: public/epochs. The pool is notional; no contract has been deployed and nobody has been paid.

Join

three commands

Your machine admits itself, then starts walking.

Admission is real curve work, so a rented botnet gets no advantage over an honest GPU. Credit accrues to the address you name and survives you switching the machine off.

# clone, install, point a walker at an open search
git clone https://github.com/iotexproject/rhonet && cd rhonet
python3 -m venv .venv && .venv/bin/pip install fastapi 'uvicorn[standard]' cryptography httpx
.venv/bin/python -m rhonet.walker --coordinator https://<round host> --payout 0x<your address>

# or run the whole system yourself: a fresh curve, a coordinator, three
# honest contributors and two forgers, solved and settled in about two minutes
./demo.sh

Accounting

designed and tested, never yet run with money

This is how a round is meant to pay out. Every step below runs today against a local vault in tests, and none of it has ever moved real money.

You walk the curve.
Your GPU follows a pseudo-random path from a start point derived from your own public key. Occasionally it lands on a distinguished point, one whose x-coordinate ends in enough zero bits. That is the only thing you ever send.
Each point is worth its expected work.
A point with w trailing zero bits stands for 2^w steps, and one credit is 2^30 verified steps. No block reward, no halving, no treasury, no vote.
A sample of your work is replayed.
After each epoch closes, some of your segments are walked again from scratch. Which ones is decided by entropy that does not exist while you are submitting, so there is nothing to aim at. One failure forfeits everything.
Your balance is committed on chain.
Every epoch the coordinator posts one Merkle root of every address and its credited steps to a vault on an Ethereum L2, built from balances that already survived that epoch's audit.
The collision ends the round and pays everyone.
When two walks meet, the discrete logarithm falls out. The vault verifies it on chain itself, then each contributor sends one transaction and pulls their share. A prize that arrives weeks later is still claimable under the same root.

What is not settled

Which rollup the vault lives on, who funds the pool before a round opens, and how a prize that is awarded to a named entity, as Certicom's is, reaches a contract that pays strangers. The operator also still chooses the settlement denominator: it can no longer overdraw the pool or lock it, but an understated total under-pays everyone and sends the difference to the operator when the claim window closes. Binding the denominator to the published leaves is the next thing we build.

Verification

why a stranger should believe any of this

The prize is locked before the first step

Funds sit in a contract, not an organizer's account. Abort is a condition, not a decision: a deadline, coordinator silence, or somebody else solving it first, each provable on chain, each callable by anyone, and each sponsor recovers their own deposit.

The coordinator issues no work

Start points come from the round and your public key, so anyone can recompute anyone's walk from public data. There is no secret assignment to trust and no seed server to fail.

The audit is published, not just performed

Each epoch commits to a random beacon before it opens and reveals it after auditing, together with exactly which segments were replayed. A third party can re-derive the audit and check it was not steered.

The chain checks the answer

Settlement is gated on an on-chain reveal that verifies the discrete logarithm against the round's curve. The vault does not take the operator's word that the round was won.

Sampling beats proving

Proving every elliptic-curve step in zero knowledge costs orders of magnitude more than the work it proves. Replaying an unpredictable sample, and forfeiting on failure, is the honest verifier for this problem.

The failures are public too

An external review found four critical and six high-severity defects. A second, adversarial review of the repair found more. Every one, with its reproduction and its fix, is in the repository.

Targets

the same walk, the same credit, the same vault

Target	Expected steps	Prize	1,000 GPUs	Status
Certicom ECCp-109	3.2e16	solved 2002 by 10,308 volunteers	~13 min	calibration rerun
Certicom ECCp-131	6.5e19	$20,000, open since 1997	~19 days	first public round
Bitcoin puzzle #140	1.7e21	14 BTC, bearer	~480 days	needs a kangaroo walk
Certicom ECCp-163	4.3e24	$30,000	~3,400 years	out of reach

Expected steps are 1.25·√n for the rho rows and 2·√(interval) for the kangaroo row. Rates assume 4×10¹⁰ steps per second per card, extrapolated from published 256-bit kangaroo throughput and not yet measured on a 131-bit field. Solving 131 bits says nothing about the 256-bit curves securing your wallet; the gap is a factor of 2⁶².

Calibration

1,200 solves, not one anecdote

A single solve proves almost nothing: rho's completion count has a standard deviation near half its mean, so a round ending at 40% or at 200% of expectation is unremarkable. So we solved 300 independent instances at each of four sizes and checked every answer against the generator's secret.

Bits	Solves	Mean, in units of √n	3σ interval	10th–90th percentile
28	300	1.186	1.084 – 1.287	0.50 – 2.00
32	300	1.227	1.114 – 1.339	0.50 – 2.09
36	300	1.241	1.122 – 1.360	0.51 – 2.10
40	300	1.182	1.077 – 1.287	0.49 – 2.02

Theory puts the constant at 1.25 for this walk. The fitted scaling exponent is 0.5000 with R² = 0.9998: cost is square-root in the group size, with the constant where it belongs. Before the walk's branch function was decorrelated from the distinguished-point test, every distinguished point took the same branch out of 128 — a defect that would have surfaced only as a slightly wrong exponent.

Status

read this before sending anyone money

Demonstrator. Nothing here should hold funds yet.

The protocol runs end to end on toy curves and the settlement contract has been rewritten twice under review, but no public round has been opened and no prize has ever been settled on chain. Before ECCp-131 can start we need a GPU kernel for the 131-bit field and a measurement of its real throughput, which is the number the entire schedule above depends on. Findings, reproductions and fixes are tracked in the open at review/2026-09-08-external-review.md.