CAIN-42 CAIN StudioAttack lab
Each run opens a real 2-of-3 approval for a destructive action and hands you every ballot.
5 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Two different approvers say yes | POST /approval-keystone/request → POST /approval-keystone/vote → POST /approval-keystone/vote | Quorum reached: the request becomes one single-use credential. |
| attack | One approver votes twice | POST /approval-keystone/request → POST /approval-keystone/vote → POST /approval-keystone/vote | A ballot counts once. |
| attack | One yes is not enough | POST /approval-keystone/request → POST /approval-keystone/vote | 2 of 3 means 2. |
| attack | A no from anyone after one yes | POST /approval-keystone/request → POST /approval-keystone/vote → POST /approval-keystone/vote | A denial is recorded and never counts toward approval. |
| attack | Forged ballot | POST /approval-keystone/vote | Ballots are signed; a made-up one is refused. |
| attack | Vote 'maybe' | POST /approval-keystone/request → POST /approval-keystone/vote | Only APPROVE or DENY. |
Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.