# Splatoon 3 Anticheat Seed Randomization Weakness

Splatoon 3 anticheat's secondary seed collapsed from 4B to 1,024 possibilities, letting attackers precompute valid ch1 hashes and run cheats undetected.

- Payout: hidden
- Severity: medium
- Program: Nintendo
- Found by: liz403
- Disclosed: 2026-02-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3042475
- Library page: https://bugbountylibrary.com/r/h1%3A3042475
- Tags: area:os domain:desktop impact:integrity kind:bounty platform:hackerone sev:medium technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:crypto

**Target:** Nintendo Switch game anticheat integrity check (ch1)
**Root cause:** The shuffling logic deriving the secondary seed from a strong primary seed collapses the effective entropy to only 1,024 possible values, making the anticheat hash space trivially enumerable.
**Steps:**
1. Identify the anticheat module `ch` and its secondary seed derivation for the `ch1` game-code integrity check.
2. Observe the shuffling logic reduces the >4 billion primary seed space to 1,024 secondary seeds.
3. Precompute all valid `ch1` hashes for the unmodified game (few minutes).
4. Intercept the anticheat function and feed pre-approved answers from a saved file on the SD card.
5. Modify live game code (e.g. infinite ink, invincibility) without detection.
**How found:** Researcher analyzed the anticheat seed derivation and noticed the shuffling logic collapsed the primary seed's entropy to 1,024 values, making the hash space enumerable.
**Exploitation:** Attacker intercepts the anticheat check and supplies precomputed valid ch1 hashes stored on the SD card, satisfying integrity verification while running modified game code for cheats.
**Insight:** When a strong seed feeds a derivation/shuffle step, count the actual output entropy rather than trusting the input space; a lossy transform can reduce billions of seeds to a precomputable set.