Bringin THC to the EVM: Designing Decentralized Treasure Hunt Challenges on Ethereum

Buongiornissimo DEF CON, how are you doing? It's quite bright in here. I got a bit more tan. So, my name is Alberto. You can call me Albi.

And today I'm going to talk about how to bring THC to the EDM, or how you can design decentralized and on-chain treasure hunt challenges on Ethereum. Before we start, a few words about myself. I'm a time traveler at Social Distortion Protocol. I'm also the founder of the Ethereum Foundation with an I. I invite you to join us.

Go to the website and there is a link to our Telegram channel. I'm also a freelance software engineer, because it seems you need money to live in this society. So, I work with artists, and with them I develop on-chain fine arts, and also with lawyers. And with them I develop also legal DAOs, let's say. You can find a list of my works on my website, granzotto.

net. But let's go back to Social Distortion Protocol, or SDP. It's an organization established in the year 2045, that is in the future for you. And our future is broken, like beyond repair, so there is no way for us to fix it. And what we do instead is we time travel.

We time travel back in the past, that is your future, sorry, your present, and we do like this kind of experiences to show you how the future looks like if you don't fight. And some people call this kind of experiences games, some other people call them arts. We like to use the term experience. And the experience I want to talk about today, it's an experience we really, really like, that is called THC, or Treasure Hunt Challenge. A Treasure Hunt Challenge is also called Scavenger Hunt, but it doesn't allow you to make any fun acronym with it, so we went for THC.

And it's a game that you play on a physical space, can be like an event, a conference, a building, a neighborhood, a city. The game is built around a narrative. And it's organized into levels, like many classic games, you go from level one to so on till the end. And your goal as a player is to solve physical puzzles to progress throughout the game and to finish the game. This is a high-level structure of how the Treasure Hunt looks.

You have a master plot that is surrounding the whole game. And the game is divided into chapters. The first chapter is, of course, chapter zero. And we have inside the chapter, you have a quest. That is some text that gives you the context of the story and at one point points you to a puzzle.

A puzzle is a physical, most of the time is a physical thing you need to find and solve it. And once you solve it, the puzzle will release you a solution. That is just a piece of text that would allow you to move to the next chapter, and so on. We have also side quests, so some chapters, they have these other things you can solve to gain more points, but they're not needed to finish the game. While if you want to finish the game, you need to go linearly from chapter zero to chapter N.

One very important thing for us as game masters is the onboarding. The onboarding is the process of taking an attendee at an event and converting them to a player in the game. And instead of, again, attending the event, they will then just spend time with our puzzles. We do this by crafting letters and envelopes that we hand out to people at the conference. And you receive this letter, it looks kind of nice.

Inside there is this letter that is inviting you to play the game, and you will find also a link that will, when you open it, will open our dev where part of the game is developed. And we use this kind of envelopes, also these other ones. I don't know if you, any Germans here, if you have this one in your mailbox, congrats, you're a bad boy. The game works like this. So after you open the letter, I said that there is a URL.

You open the URL, like 99% of the time you open it on your phone. And this is where the game starts. So you have the onboarding phase that I just described. Then you open the website and you start reading the first chapter. Then you locate the puzzle, and ideally you solve the puzzle, you get the solution, and you use the web application that is on the left side here to submit the solution.

And then the game progress to the next chapter, where you will read again a new part. You will read the quest, find the puzzle, solve the puzzle, and so on. There are some nice side effects to this kind of experience. So first of all, you explore the venue. The game, again, develops over the venue.

For example, it can be an event, as I said already. And we make the game so each chapter will touch a different part of the location. You also connect with others. And we have so many examples of people that started the game by themselves, and they ended up finishing the game in a team. And even most important, you learn new things.

We have people doing lockpicking for the first time because they had to solve a puzzle, or also people creating their first smart contract on Solidity because they had to hack, let's say, for a side quest, a puzzle that was on the Ethereum blockchain. And I want to keep talking about the puzzles now. And this is probably the most time-consuming part for us as game masters to create a nice THC because they are, in a way, connected to the location where we deploy the game. This was at ETH Berlin, and it's a ball pit. And we put some balls with a password inside, and you had to basically spend quite some time to find these special balls in the ball pit to find the password.

Or this is actually super fun. It's a chess board, and you had to solve a chess puzzle and move the pieces physically on the board to make the board automatically open because we had some RFIDs under the board. And again, we like also to play with hardware, and this is what this board would do. This one is one of my favorites because it's quite weird. You have a keyboard, MIDI keyboard, connected to a birdhouse, and you had to play the right tune in order to open the door of the birdhouse and get the password.

And everything we do is quite do-it-yourself. Some people mistake what we do for bombs, but this is not a bomb, in case you were wondering. Or this other one is called the Vibrisome. That is, I think, the first sex toy connected to the Optimism network. And you had to interact with a smart contract in order to activate the vibrator, and it would vibrate you and morph the password.

So you had to hold it in your hand or somewhere else to get the password to get to the next level. Thanks. And, of course, this game is played by many people at the same time, and it's also fun to see where you are at compared to the others. So we developed also, of course, a leaderboard where you can see all the addresses at which chapter they are and also how many sidequests they solved. And once you finish the game or you finish all the sidequests, we also release on-chain art, on-chain NFTs, developed by some artists we collaborate with.

And, again, we love on-chain stuff, so also the NFTs are on-chain SVGs with no external dependencies. We run these. As I said already, we love THC, we love this kind of game, and we released the game several times over the years. We started at the Congress, the Curse Communication Congress, and then we also deployed the game at ETH Berlin 3 and 4 and DEF CON 6 and 7. And we did this also, I want to mention Daedalus Industries, that is another organization, and they developed all these crazy hardware puzzles that I also showed you in the section before.

And also, really, they're quite amazing. But today I want to talk a bit more about THC as in Treasure Hunt Creator, that is the open-source framework that we developed to create this THC, these Treasure Hunt challenges on the EDM. It's open-source. You can find it on our GitHub, social-distortion-protocol. The zero is very important, otherwise it goes to our competitors, and slash THC.

The framework is divided into two pieces. There is ADAPT, that is the front-end, and there is also the back-end, that is the smart contract. There is nothing else, so we don't have any other servers spinning around. It's just like these two pieces. We try to keep things as, again, on-chain and decentralized as possible, so we avoid having our own servers, let's say, running the game.

The experience from ADAPT, as I said before, ADAPT is your navigator. It's what you use to explore the game and go from chapter to chapter, and also this is what you use to submit your passwords, so your solutions to the puzzles. When you first open the game with the web app, there is no registration. You start, and you're already, in a way, registered because we create a burner wallet for you on the phone, and given that it's a burner wallet and we don't have the address, there is no balance in this burner wallet, but in order to submit solutions, we just use Gelato-related networks, so we sponsor, basically, your transactions that are sent to our smart contract. So you need nothing.

You don't even need a wallet installed on your phone if you don't have one. And the other thing that is also important is game assets. As I said, we only have two pieces, the dev and the smart contract, so the game assets are built in the front end, in the dev. And I remind you of the structure of the game, so each chapter has a quest, a puzzle, and a solution, and in that case, given that everything is, again, in the front end, in the smart, in the dev, you don't want players to be able to read the chapters that they are going to play later. So what we do is we take each quest and we encrypt it using AES with a solution of the puzzle chapter.

So chapter one, the text, is in your dev, in the dev, but it's encrypted with a solution. So if you don't find the solution, you will never be able to access this kind of text. On the other side, we have the smart contract, and as a reminder, we have, again, multiple solutions, solution zero to solution N-1, because the last chapter doesn't have a solution. And here, we are analyzing how we're putting the solutions in the smart contract. Of course, we cannot put this solution in clear text, because otherwise you would be able to decode it from EtherScan or any other tool you want.

So what we do instead is this. We take a solution, let's say solution X, and this is something we do offline before publishing the game, of course. We take solution X and we hash it using KetKak, and we use the hash to create what we call a solution wallet. So we initialize a wallet using the hash as a state of the solution. And we have two things.

When you have a wallet, you have a public address and a private key. We take the public address and we store it in the smart contract. And after we do this process for all solutions, our contract is ready to be published. So keep this in mind. We have a smart contract with all the addresses of the solutions on chain now.

Then there is this other phase that is the submission phase. You, as a player, represented as a nice pink skeleton, because maybe it took too long to find the solution, and we run on the frontend the same algorithm I showed you before. So we hash the solution using KetKak. We create a hardware wallet, but this time, instead of caring about the solution address or the public address, we care about the private key. Why?

Because we need it to sign the address of the player. So the burner wallet, as I told you before. So we take the wallet of the solution to sign the player address, and what we get is a proof that that player found that solution. So we take this proof, RSV, and then using the wallet of the player, we submit it to the smart contract. At this point, the smart contract starts the verification phase.

And what happens is that by receiving this RSV, this proof, the smart contract is able to run an easy recover, using as data the player address. And at this point, the smart contract is recovering the signer. And if the signer is a solution, it's a valid solution, then the player can progress to the next chapter. Otherwise, it's rejecting the transaction. And this is crucial, again, because we don't want solutions to be public on-chain, and this is some kind of, I guess it actually checks all the checkmarks of a zero-knowledge proof.

It's not letting me know, but for me, this sounds like zero-knowledge proof. It's not super fancy. I mean, it's just public-key cryptography. But still, it works very well, and it's very cheap in terms of gas, also. Also, in order to prepare all the game assets, publish the dApp, and also deploy the smart contract with all the solutions, as I said, encrypted, we need to, there is a lot of tooling.

The process is actually quite complex. There are different steps you need to do in order to deploy your own treasure hunt challenge. And we don't want you to roll your own THC, because it's too complicated. So, we developed another framework called CBD, that is the THC companion. And CBD stands for Continuous Build and Deployment, and this is another part of the framework that you can still find on GitHub, on FTP slash CBD.

And this is taking care of, basically, all these intermediate steps you need to publish the game. There is one thing that is actually quite crucial. When you deploy the game, and all the quests are basically in the front-end already, and maybe you need to change something, because something is not clear. Or, like a quest is not as clear as you think it was. Or, for example, something changed in the venue, and you need to modify a part of a chapter.

All these small edits, they require the pipeline to be run again, the pipeline to build all the assets. And CBD is taking care of this part, basically. We're building all the game, all the game assets, and publish everything on-chain. That's all on my side. I have two minutes left.

I will quickly... Can I go back here? Yes, nice. I want to quickly mention that this kind of game is also a VIP, that is a DevCon Improvement Proposal. I invite you to check the original proposals here.

This is from 2020. This is VIP4. Same year, 2020, there was VIP11 by Daedalus Industries, the industries that I mentioned before. And they submitted also an Improvement Proposal for DevCon to create this kind of escape room, crypto-onboarding escape rooms. And then, in the year 2024, we decided to merge our efforts, so SAP and Daedalus Industries, to make more like a wider, let's say, proposal for the AP36, that is Game of Capture and Escape, that you can also read at that URL.

And now I'm really done, yes. You can find me on Twitter, at vrde. And if you want to follow SAP, go to Distortion Proto, where the first O in distortion is a zero. That is crucial. Don't fuck it up.

Thank you, guys. Take care. Questions, though? Yes, we have time for questions. How did the Zuckerberg hunt go?

Did you find Zuckerberg? Yes, again, we found Zuckerberg. That was the very first game we deployed. It was not exactly this format. It was more like geocaching.

So you had to find QR codes that were hidden in the event, at the Congress, in that case. It was a primitive version of THC. And it was very simple, but people loved geocaching, and that was the original seed idea that also guided us to create these THC games. They just had a geocaching treasure hunt in San Francisco, that they were talking about on the news. Someone won something like $10,000.

People love geocaching. Yes. In our case, you don't win $10,000. People are also happy with, like, I don't know, once we gave a prize, a piece of wood. I mean, it's nothing, but even if it was part of the game, for whatever reason, they liked it.

Stickers. But, I mean, if you play these guys, don't expect to win $10,000. That is not even the money we make. So it's also quite expensive on us to make this kind of game. Yes, of course.

Any questions for Alberto down here? That was a great talk. Thank you, Alberto. Thank you. I remember a year or so ago that there was Crypto the Game or something like that, that became very popular.

It was even acquired by Uniswap or something like this. So it seems that playing these games with on-chain mechanisms is becoming something of a trend. Would you say that? And, like, where do you see the future of social distortion going? Like, what's your idea to maybe scale this?

Or maybe you don't, maybe it's, you know, what's your vision? So, first of all, we have no vision. That's also part of STP. We don't have—yeah, we just live day by day, to be fair. We have another game we deployed a time ago that I want to do again.

We like this idea of, like, on-chain pop-up games. And what you mentioned before, by the way, to try to answer your question about on-chain games, I think it's a super cool trend. There are people doing a lot of really cool games, on-chain games. What we like is this kind of on-chain games that you play in a real physical space to connect with other people. So we want to focus more on these kind of experiences.

And if we have, let's say, a plan for the future, we try to develop more these kind of ideas of in-person on-chain games because I think they're quite fun.