Ledger Donjon

Who this is

The Donjon is the team inside Ledger that attacks Ledger's own products, and other people's. Charles Guillemet introduced it in December 2018 as eight experts in software attacks, side channels and fault injection, with a stated habit of open sourcing the tools. In October 2020 it ran a public CTF, Capture the Fortress: three weeks, more than fifteen challenges, first prize 400 dollars and a Backup Pack. Scissors Secret Sharing was the 100 point warm up, twelve BIP39 words with ten out of order and a real address at the end. That's why it's in a dataset of funded puzzles and the other challenges aren't.

What the record says

Two Ledger blog posts. The introduction, for what the team is and what it says about itself, cited twice because two different facts come from it. The CTF announcement, for the dates and the prizes. The profiles are the Donjon's own site and that announcement. No individual is on the record beyond the CSO who signed the founding post, because the challenges were published as the team's.

The record

static readonly author = party("Ledger Donjon", {
  key: "ledger-donjon",
  kind: PartyKind.Organization,
  about: "Ledger's security research team, which ran the Capture the Fortress CTF in 2020.",
  profiles: [
    profile("website", "https://donjon.ledger.com/"),
    profile("website", "https://www.ledger.com/blog/Capture-the-Fortress"),
  ],
  facts: [
    fact("Introduced on 2018-12-11 by Ledger's CSO Charles Guillemet as an internal security evaluation lab of eight experts …", "https://www.ledger.com/blog/introducing-ledger-donjon", { date: "2018-12-11" }),
    fact("Says it open sources its attack tools and methodology and drives Ledger's bug bounty program.", "https://www.ledger.com/blog/introducing-ledger-donjon", { date: "2018-12-11" }),
    fact("Capture the Fortress ran from 2020-10-28 to 2020-11-18 as a jeopardy CTF with more than 15 challenges. …", "https://www.ledger.com/blog/Capture-the-Fortress", { date: "2020-10-21" }),
  ],
});