CAIN-42 CLAWXAttack lab
Each button issues a fresh root lease (read + write, $100 budget) and then tries one delegation, live.
2 attacks 2 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Delegate read only, $50 budget | POST /fabric/caplease/issue → POST /fabric/caplease/prepare-delegation | Smaller than the parent: granted. |
| control | Delegate read + write, $50 budget | POST /fabric/caplease/issue → POST /fabric/caplease/prepare-delegation | Same permissions, smaller budget: granted. |
| attack | Child asks for wire_transfer | POST /fabric/caplease/issue → POST /fabric/caplease/prepare-delegation | The parent never had it: refused (HTTP 403). |
| attack | Child asks for a $500 budget | POST /fabric/caplease/issue → POST /fabric/caplease/prepare-delegation | More than the parent's $100: refused. |
Each button runs two live calls (issue, then delegate). Rate limited per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.