Live vault · real USDC

I was drained twice.Now try to drain me.

Public scoped key. Real policy. Every failed attempt publishes a receipt that explains why it was blocked.

Bypass policy and move the USDC — you keep the prize pool.

Prize pool

0 USDC

REST API docsMCP docs
Live · decision receipts
updated 4:26:34 PM

75

Blocked

0

Drained

1 country hitting the vault

FR×75
  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    1.00 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    1.00 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.159.122.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR162.158.23.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.68.234.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· Transfer proposal
    FR172.70.108.•••1654h ago

    500 USDC

    Recipient is not on the account allowlist — transfer blocked.

    policy-333920420b8f

  • BLOCKED· add recipient
    FR172.70.108.•••1654h ago

    add recipient — This credential is not permitted to perform that operation.

    policy-333920420b8f

  • BLOCKED· List recipients
    FR172.70.108.•••1654h ago

    List recipients — This credential is not permitted to perform that operation.

    policy-333920420b8f

75 receipts · newest first · scroll for history

Attack surface

One tool: propose_transfer

Set recipientId to your payout wallet — where you want the USDC if you bypass policy.

Challenge API key

frtfi_hu_501661e5d5befb6aa9ce7a26af2c14465d38c78c

Vault id (fromWalletId)

f5dcd5d0-1c0d-4940-90a7-8ca14bf18836
# Set your attack key
export FORTFI_KEY='frtfi_hu_501661e5d5befb6aa9ce7a26af2c14465d38c78c'

# Optional — balance on the challenge vault only
curl -s -X POST 'https://fortfiapp.com/api/mcp' \
  -H "Authorization: Bearer $FORTFI_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_account_holdings","arguments":{"walletId":"f5dcd5d0-1c0d-4940-90a7-8ca14bf18836"}}}' | jq .

# THE ATTACK — propose_transfer (MCP tool: propose_transfer)
# recipientId = FortFi allowlist id for YOUR wallet (where you want the prize sent)
curl -s -X POST 'https://fortfiapp.com/api/mcp' \
  -H "Authorization: Bearer $FORTFI_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "propose_transfer",
      "arguments": {
        "fromWalletId": "f5dcd5d0-1c0d-4940-90a7-8ca14bf18836",
        "recipientId": "<your-wallet-recipient-id>",
        "amountUsdc": "0"
      }
    }
  }' | jq .

# If the proposal needs confirmation:
# tools/call → confirm_proposal → { "proposalId": "<id-from-above>" }
Public revocable vault key — not a seed phrase. list_wallets and list_recipients are blocked for this credential.

Build on the same controls

Spin up your own governed vault and scoped agent keys.

Open an accountAPI docs