[contest]

Break the limits.

We hand you a trading bot’s key and a set of limits on Hyperliquid or Binance testnet. Get a trade past them anyway, and we pay.

$1,000 in prizes 24 seats 16 Nov to 13 Dec 2026

Testnet only, no real money. Seats are confirmed by email.

your agent · four rules, nobody approves

# inside the limits, orders go throughorder BTC buy $300 alloworder BTC buy $700 require_approvalorder BTC buy $1,500 block order size > $1,000order ETH buy $900 block gross exposure > $5,000# every decision is signed and chained# your move

[ Your setup ]

Mishmar sits between a trading bot and the exchange. Every order the bot proposes is checked against the owner’s limits before it is signed. Inside the limits it goes through; past them it is blocked, or parked for a person to approve. The exchange key is split between the bot and Mishmar, so neither can trade alone.

In the contest you are the bot. You get one agent on a Mishmar account, on Hyperliquid testnet or Binance demo trading (your pick), with the agent’s own key, and one portfolio with $2,500 of allocated capital. Four rules apply to it:

Order size over $1,000: blocked
Order size over $500: waits for approval, and nobody ever approves
Gross exposure over $5,000: blocked
Daily loss over $250: blocked

Inside those you can trade as much as you like. You see the account in the console as a viewer: every decision, every rule evaluation, every fill. Your job is to get a trade past the limits anyway.

[ What wins ]

$500

Ghost order

A fill on the venue with no allowed decision behind it in the ledger.

$250

Past a limit

An allowed order whose fill lands 2% or more past a blocking limit, valued at the fill price.

$250

Skipped approval

A fill of $510 or more that nobody approved.

Proof is the signed ledger plus the venue’s fills. The first report of each distinct root cause wins. The pool is $1,000, paid in USDC on Arbitrum in report order; every valid finding also gets a year of Pro and a credit in the write-up. A limit counts as crossed only when the fill is 2% or more past it: market orders can slip by up to 1%, and that is the venue, not a bypass.

What doesn’t count

A position that drifts past a cap because the market moved.
A fill less than 2% past a line.
Denial of service, on Mishmar or on a venue.
Attacks on the console, sign-in, other people’s accounts, the cloud it runs on or the venues themselves.
Social engineering.

[ How it runs ]

Keys go out from 16 November 2026, as seats are confirmed. The contest ends on 13 December 2026, 23:59 UTC. 24 seats; a seat filled late still gets its run.

Sign up below. We confirm your seat by email, with the full rules.
Install the mishmar CLI where you will run from (how) and run the pairing command from the email. That makes your half of the key; we approve it at the venue.
Trade, attack, and report what you find.

Reports go to security@mishmar.io first, with the decision id and the venue’s fill. We acknowledge within a day, reproduce it, fix it, and then publish a write-up with your name on it. Nothing is public until it is fixed, and the same root cause cannot win twice. A daily scoreboard (attempts, blocked, parked, fills, breaches) is posted in the Discord.

The small print

Testnet only. No real money is traded, held or at risk.
One entry per person, 18 or over, not open where sanctions forbid it.
Mishmar decides whether a report is a valid finding and which class it is in. Prizes are paid within 14 days of the close to the address you give.
You can leave at any time; we can revoke a key that is used against the rules above.