1 mBTC picture puzzle

December 23, 2013, 05:40 UTC. r/bitcoinpuzzles is seven hours old and givesadvice4bitcoin posts a picture. "It's a very easy puzzle, but it may be a little harder than it first appears." One image, an address with 1 mBTC, marked easy. The funding confirmed 81 seconds after the post.

How the picture puzzle works

Four pictures, three syllables

A phone book, a cat's eye, the letter O with an octopus, a QR code. Read the first three out loud: directory, eye, O. directory.io, a site that listed every Bitcoin private key there is, 128 to a page.

Reading them wrong was easy. herpderp020 admitted afterwards to "yellow pages, cat eye, octopus". At 09:28 tf2manu994 had "Book, Eye, Letter O, 36 Down" and the author answered: "It's not a book though. Think of another word :)"

A QR code used twice

The QR code holds 56 binary digits. Decode them as bytes and you get "36 down". The author's edit says the code "needs to be used two different ways", and the first is "as is": the digits themselves are the page number. directory.io/00110011…01101110. Then the decoded "36 down" says which row.

At 10:15 6loss was "so close but got to go out". The author: "Try throwing the binary in your browser, you'll never know where you end up ;)". At 10:28, from 6loss, "Claimed =)". The claim confirmed at 10:39:50, and the author put the full solution into the post.

What the picture puzzle record carries

export const picturePuzzleRecord = bitcoinPuzzle({
  id: "picture_puzzle",
  address: p2pkh("1MeQumbMGbTDPUNtBbLwzfyZqeeZzpRnex", "e275dd7b…f42692bc"),
  sourceUrl: THREAD,
  startedAt: "2013-12-23 05:40:33",
  status: Status.Solved,
  pubkey: uncompressed("0443363aa63ab32ed94309fbaf2783e6f4dc0878cc04b2f6c954b5345ade0c11…acbadcf"),
  key: hex("00000000000000000000004804804824004000024020024124824824824123a3"),
  prize: 0.001,
  hints: [/* the post, two edits, three comments, Book, Eye, Letter O */],
  solvedAt: "2013-12-23 10:39:50",
  solveTime: 17957,
  transactions: [funding(/* … */), claim(/* … */)],
  solver: party("6loss", { profiles: [/* reddit */] }),
  assets: assets({ puzzle: "puzzle.png", sourceUrl: PICTURE }),
});

Where the key comes from

The solution in the post stops at the page and never prints the key. So the key on the record is the author's recipe run once, and verify checks it against the address.

One catch. Read the page number as decimal and the 36th key down isn't the prize address. Read it as octal and it is. Probably the leading zero, which is how C and PHP mark an octal number. A page starts at key 128 * (page - 1), row 36 adds 35, and the key derives 1MeQumbMGbTDPUNtBbLwzfyZqeeZzpRnex uncompressed. That's also the public key the claim signed with.

Hints with their answers

Six hints are the author's: the post, two edits and three comments. Each edit carries 2013-12-23, because the archived post dates its last edit to 10:39:09 that day. The solution hangs off the first hint as its answer, and the four picture words hang off "It's not a book though". "Book, Eye, Letter O, 36 Down" is tf2manu994's, so it's community.

The picture

assets/picture_puzzle/puzzle.png is what Imgur serves today for the image in the post, 360 by 360. assetUrl() points at it on GitHub.

A singleton id, no name segment

picture_puzzle is the whole identifier, like gsmg, bitaps, mineshop, movie_enigma, satoshi_birthday_quiz and book_quiz. One puzzle, one key, no slash.

The picture puzzle record

bitcoinPuzzle({
  address: p2pkh("1MeQumbMGbTD…eZzpRnex", "e275dd7b615b…f42692bc"),
  status: Status.Solved,
  key: hex("000000000000…824123a3").derived(),
})