Arena

Core loop

• Join an active arena, choose a faction, and start completing missions.
• Build a network that other players can attack, then deploy it when it is ready.
• Attack deployed player networks, submit flags, and try to finish before the attack timer runs out.
• Watch rankings, chat, and attack logs to understand how the arena is moving.

Factions

Every arena has four factions: Green Lizard, Red Bear, Blue Wolf, and Purple Panda. Your faction choice is locked for that arena, so pick the team you want to represent before you start competing.

• Mission and global rankings both contribute to faction results.
• If the top factions are tied, the arena does not show a single winning faction.
• Faction results are shared, but your personal flags still decide your individual position.

Missions

Starting a mission creates a timed mission instance. If you leave before finishing, the same unfinished instance continues when you return. When you replay a completed mission, the mission state is reset and a new run begins.

• A mission is complete when every required vulnerable service has been hacked.
• Completion time is measured from mission start to completion.
• Being discovered does not block completion, but an undiscovered completion is visible in public logs.

Flags

Flags are both your build currency and your ranking score. Arena ranking uses your current flags plus the flags you have already spent, which means improving your network can still support your long-term score.

• Players start with 5 flags.
• Players can claim 1 free flag per calendar day.
• Players can steal flags from other players by completing attacks against their networks.
• You cannot spend below 0 flags, and refunds reduce spent flags without going below 0.

Network builder

Each player has one network per arena. You choose its country, edit devices and services in a draft, and deploy the draft when you want other players to attack the new version.

• Your public host and IP are generated for the arena network.
• Server and Laptop devices are available by default.
• Denial of Service and Sensitive Data Exposure vulnerabilities are available by default.
• Child devices can only be placed under routers.
• Server validation checks network edits, so invalid draft changes are rejected before deployment.

Deployment

Draft changes are not live until you deploy. Deployment copies the draft network into the live network, and the live network is what other players see as a mission target.

• A deployable network must contain at least one vulnerable service.
• Deploying resets current attack instances for that network so new attackers receive the newest version.
• Your deployed network expires when the arena expires.

Attacks

Player networks appear as attackable missions inside the arena. You cannot steal from your own network, and a successful attack only steals flags when it is completed in time.

• Only the first saved completion of a player-network mission can steal flags.
• The attack must be completed within 30 minutes.
• The maximum stolen amount is limited by the number of vulnerable services in the target network.
• The stolen amount can never be higher than the target player's available flags.
• A successful attack can still steal 0 flags if the target has no available flags.

Logs and stealth

Successful attacks are written into arena logs and merged into chat for the last 24 hours. If the attacker was not discovered, the log hides their name and shows them as an anonymous attacker.

• Chat still carries normal player messages between log entries.
• Discovered attacks can reveal the attacker name.
• Keeping discoverability low helps protect your identity and improves mission ranking order.

Strategy

• Spend flags when the upgrade helps your network or attack options, because spent flags still count toward global ranking.
• Fast completions matter, but stealth matters too.
• Claim the daily free flag and reinvest it before other players pull ahead.

Related docs

• Labs
• Lab Missions