FINDX
Everyone keeps predicting PQ Day.
Better. Let’s put the biggest crypto bounty ever on it.
There is a number hidden behind this point.
xG = C
Find it. Find x. Everything behind C is yours. Good Luck.
The movement started on Solana. Spreading across chains worldwide.
An unsolved discrete logarithm became the creator and bounty owner
001 / START HERE
The Elliptic Curve Discrete Logarithm Problem, or ECDLP, is the problem of recovering a private scalar from its public point. If somebody learns how to solve it, announcing that ability may be worth less than stealing quietly. FIND X tries to reverse that incentive by making public proof more valuable than silence.
Make x the most expensive unknown number on Earth.
FINDX starts the pile. People, projects, foundations, protocols and other chains can add to it. The goal is for FINDX to become the least interesting asset behind the key.
burn nobody can take it FIND X nobody can take it until somebody breaks crypto
If a project is already going to throw tokens away, it can make a cryptographer work for them instead.
002 / THE CHALLENGE
G the standard Edwards25519 base point C the public canary point x an unknown nonzero scalar find x xG = C
Multiplying G by a known x is easy. Recovering x from G and C is the Elliptic Curve Discrete Logarithm Problem.
FIND X turns that equation into a growing public bounty.
I used the exact 32 bytes of C as the Solana creator address of FINDX. Every trade accrues creator fees for C. Pump lets anyone sweep those fees into C, and anyone can add more assets directly.
Assets at C have no developer key, custodian or claim form. Whoever finds x can sign as C and take them.
The token starts it. The world fills it.
[ inspect C on Solana ] [ FINDX on Pumpfun ] [ creator specification ] [ fee collection ]
003 / VERIFY THE ORIGIN
C from public inputs.A deterministic, reproducible procedure takes public text and a public counter, hashes them directly into a candidate Edwards25519 point, clears the cofactor, and accepts the first valid result. It has no private input.
public domain QDAY/Edwards25519/NUMS/canary/v1/ for counter = 0, 1, 2, ... input = domain || LE64(counter) h = BLAKE2b-256(input) P = canonical Edwards25519 decode of h C = 8P accept the first valid, non-identity C
The complete transcript contains two attempts.
counter 0 BLAKE2b-256 f4b17b5acddbac3db93e510d203c82ea9d6e869070a40f275581d950723dc174 canonical Edwards25519 point no counter 1 BLAKE2b-256 29e995bdd3f9d8cdc0e6c85d7222f9d5e627010f1ae6a7b0a77eafb0c06aa123 canonical Edwards25519 point yes after cofactor clearing 7343aaaab7bb999347740b9e1932f5487046f56b1566ab23cac0b129adefb771
The selection rule is fixed: accept the first valid non-identity point. Here that is counter 1.
Forcing this construction to produce a chosen xG would require an infeasible BLAKE2b preimage search or the discrete logarithm itself.
The procedure and its output were publicly committed before FINDX existed. The source, original manifest and commit remain public.
private scalar input none
public input domain text + counter
accepted counter 1
committed C 7343aaaab7bb999347740b9e1932f548
7046f56b1566ab23cac0b129adefb771
manifest SHA-256 14d4a47a850f5ba9d81129142d8718c3
23d826b5f9459516374c4f0f92eaa65b
launch commit 8023354ad0c1a54e2f1e1d8f9f67dabd84f06b69
This proves that the published construction reproduces C without using or revealing a private scalar. It cannot prove that nobody has independently solved the discrete logarithm since then.
If somebody already knows x, good. That is who the bounty is for.
$ git clone https://github.com/petoshi/qday.git $ cd qday $ git checkout 9c55db704e2ab9c3e95ef1b8b203176a2027b030 $ go run ./core/cmd/qday-canary -manifest ./qday-mainnet.json derived challenge: 7343aaaab7bb999347740b9e1932f5487046f56b1566ab23cac0b129adefb771 manifest challenge: 7343aaaab7bb999347740b9e1932f5487046f56b1566ab23cac0b129adefb771 Solana address: 8kwjLg5bY5i3XMAab6oUgnX82nPCedE3EgDSFkHWcCkY match: true
[ reproduction instructions ] [ Go verifier ] [ original manifest ]
004 / THE SAME POINT ON SOLANA
The committed point is printed as hexadecimal. A Solana public key is printed as Base58. I decoded the hex and encoded the same bytes as Base58.
hex 7343aaaab7bb999347740b9e1932f5487046f56b1566ab23cac0b129adefb771 same 32 bytes Base58 8kwjLg5bY5i3XMAab6oUgnX82nPCedE3EgDSFkHWcCkY
new derivation none
hash none
bridge none
wrapper none
second key none
custodian none
same bytes verified
C is a canonical prime-order Edwards25519 point. The same scalar x satisfying xG = C can sign for this Solana address.
A wallet seed is not the same thing as a signing scalar. The linked test constructs a standard Ed25519 signature directly from a scalar and verifies it against xG.
[ reproduce the address ] [ scalar signing test ] [ Solana account model ]
005 / CLAIM
x. Sign as C. Take everything.find x | v construct an Ed25519 signer for C | v sign as C | v take every asset controlled by C
No committee approves the answer. No administrator releases the reward. A valid signature from C is enough.
A signature proves control of C, but it does not reveal x. Publishing x lets everyone verify xG = C themselves.
The bounty does not care how the answer is found. Quantum computer, classical algorithm, new mathematics. Bring x.
Take the money. Publish the proof.