CAIN-42 CAIN StudioAttack lab
Take a real receipt notarized by the 4-region PBFT cluster and try to forge it.
7 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Published receipt verifies | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | Signed by a quorum of the pinned cluster. |
| attack | Digest changed | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | The quorum signed this digest, not yours. |
| attack | Request id swapped | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | The commit certificate names exactly one request. |
| attack | Sequence moved | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | The certificate is for one slot in the log. |
| attack | Operation digest differs from the receipt digest | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | The operation must notarize exactly the receipt's digest. |
| attack | Commit signatures dropped to one | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | One replica is not a quorum (needs 3 of 4). |
| attack | Wrong pin (another cluster's configuration) | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | Pinned to a configuration this receipt was not signed by. |
| attack | Commit certificate removed | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | No commit quorum, no notarization. |
Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.