Rubber Duck Stamp — investigation crystallization

DEF CON 34 Gold Bug, puzzle 12 (IRL). Everything established, everything falsified, the live theories, and the shortest paths to the answer. Compiled 2026-08-08 from problem-12/investigation/.

Artwork panels
7
6 letter tiles settled
Birds painted
15
ducks + 2 geese + 3 swans
Tract rows
10
fabricated stock listing
Falsified strings
5
never retry
Where it stands

No confirmed answer yet. The extraction machinery is nearly fully mapped — display order, six of seven letter tiles, the tract's chained digit rule with its painted worked examples — but the final reading of the chain output (the teammate's "missing logical step") is still open. The strongest levers are listed under Direction.

What is established

  • Display order is photographed (reference drop ref-05): Baudot → blue collage → Hill → LFSR → angular semaphore → cream trio → red linocut.
  • One output tile per panel, in order: A · W · ALLA · I · L · L · N. Every tile has an independent reconstruction.
  • Hill's row 2 is palindromic under all three pipelines — raw Polybius AYYA, decrypt K⁻¹ ALLA, encrypt K ANNA. Deliberate direction-invariant design; an erased pencil "mod 5" caption sits under the ink MOD5.
  • The collage's Ogham instruction reads: IGNORE THE SQUARES AND FIND THE ANSWER. READ THE TRACT. The tract is the final assembly medium, not just the source of "W".
  • Answer format calibration (solved puzzles): concatenated uppercase English phrases, 9–16 letters, descriptive — ORANGESCARF, THREEMINUTESLATE, STRANGEBUZZING.

The seven panels

Panel mechanisms in display order
#PanelMechanismOutputTile
1B&W engravingBaudot / ITA2 punch tape (24 frames)"THE LETTER NEEDED IS A"A
2Blue collageOgham strip + newsprint tractinstruction + ten W companiesW (tract holds more — see below)
3Hill watercolorHill cipher, K=[[1,2],[2,0]] mod 5plaintext grid row 2ALLA / A
4Salmon pintails8-bit LFSR, "CLOCK 9 / READ REGISTER"01001001 = 0x49I
5Wood ducksFlag semaphore, D as delimiter"USE THE LETTER L"L
6Cream trioSix segment-display cells, CRUN_Cright-side bits 001100 = 12L (M if A=0)
7Red linocutManchester + RDS differential decode1101110N

The ordered string AWAILLN (all per-slot variants included) spells nothing, survives no classical transform (atbash, caesar, vigenère with panel keys), and is not a subsequence of any known duck idiom. The letters must be consumed by a mechanism, not read.

The birds: duck, duck, goose (and swans)

Pixel-level species audit of all fifteen birds: panel 2's white birds are snow geese (grin-patch bills), panel 6's cream trio are tundra swans (black bills, yellow lores). Family string across the display: D G D D D S D — and the first three birds of the row, left to right, literally read duck, duck, goose.

  • Species in order: rubber ducks, snow geese, long-tailed duck pair, northern pintails, wood ducks, tundra swans, mandarin drakes (the only same-sex pair).
  • Facing pattern RRRLLRL verified bird-by-bird; duck counts 2222232.
  • Species initials spell nothing in order under any naming scheme; the rival "WOMBAT" bird-channel claim does not survive the pixels.
  • The odd birds sit at positions 2 (goose = the collage, i.e. the tract panel) and 6 (swans). Best structural reading: the goose panel is where the answer lives — which is exactly where the authored tract rule was found.

The tract and the chain rule

The tract is a fabricated WSJ-style listing — ten consecutive W companies with three numeric columns (%chg, 52-wk hi, lo) — glued into the collage, with an authored annotation layer: three teal paint marks, one navy blot turning WebsterFinl into WebsterFind, and one bold row.

Exact transcription (every digit cross-read in 2+ photos)
Row%chgHiLoNameAnnotation
0…tsco B (Watsco B)torn — numbers unreadable
125.28394.54251.17WattsWater
2−15.45119.9855.60Wayfairbold row; teal on f–a (pos 4–5)
322.6977.6952.69WebsterFinlteal on i (pos 9); blot → "WebsterFind"
4−7.2497.7672.78WellsFargocapital F (pos 6) repainted teal
526.31255.20161.26Welltower
640.41377.90197.96WescoIntl
723.92386223.83WestPharmSvchi printed with no cents
8216.27799.8773.14WesternDigitalimpossible values
917.9048.6336.90WesternMidstrm
10−4.65124.2356.33Westlake

The chain rule (best-supported mechanism in the whole puzzle)

position(row n) = first cents digit of row n−1's Hi. Letter n = namen[position].

  • Fits all three teal marks exactly: 394.54 → Wayfair[5] = a; 119.98 → WebsterFinl[9] = i; 77.69 → WellsFargo[6] = F. The straddled row-2 mark covers both digits of 54 (f at 4, a at 5).
  • Explains the fabrications: the .69/.69/.69 row makes row 4 = F under every column choice, and 386's missing cents deliberately skips row 8.
  • The paradox: full output rows 2–10 is a i F w e m [skip] M a — not English — and row 1 is hostage to the torn row 0. The reading of this output is the open "logical step".

Ruled out for the output — exhaustively (several hundred base strings × ~120 transforms): ITA2/Baudot re-encodings, Hill K/K⁻¹, LFSR clocking, every Caesar/Atbash/Vigenère/Beaufort/autokey with panel-derived keys, bifid/Playfair, digit-streams as A1Z26/T9/ASCII, alternate chains (lo/chg primary, from-end, bottom-up, bold-start, cyclic), partial-emission subsets, and constrained either-digit choice. Best near-misses (all judged coincidence): ROBIN(S) via a SWAN-keyed Vigenère, "WEE CATS", a WFIFW/EMMA palindrome echo. One-letter-per-row dictionary fits (WATERCRESS et al.) and variable-substring segmentation stay unsupported. If the answer is spelled from tract names it cannot contain U — which rules out every *DUCK* string as a tract product.

Three newer structural facts (from the numbers themselves)

  • Hi/Lo redundancy: for rows 3–6 the first cents digits agree across the Hi and Lo columns (6,7,2,9 in both; p≈10⁻³) — the chain letters for rows 4–7 (F,w,e,m) are double-confirmed as authored.
  • The row-8 gap fills with D: row 7's Hi has no cents, but its Lo (223.83) gives WesternDigital[8] = capital D. Fallback message rows 2–10: f/a, i, F, w, e, m, D, M, a — capitals land on F, D, M.
  • Teal multiplicity = panel multiplicity: row 2 carries two marked letters and is selected by two panels (the two L's); rows 3 and 4 carry one mark each and are selected by one panel each (W, N). Row 1 is selected twice (the two A panels) and its chain source — row 0 — is torn: the Baudot panel literally states "THE LETTER NEEDED IS A", supplying the letter the torn row can't. This yields one letter per panel in display order: A i A M f a F — mechanism compelling, reading still unresolved.

Falsified candidates and method learnings

Live-tested or upstream-rejected — never retry
StringOriginLesson
ALLINAWALLtile multiset anagram (Hill=ALLA)exact-multiset anagrams are not the assembly rule
INAWALLtile multiset anagram (Hill=A)
FALSEIMPRESSIONearlier team lanetheme-first guessing fails; the rival "ASIILEK / WOMBAT" letter set contradicts verified extractions
ILIKEASILKIEearlier team lane
THEGAMEISAFOOTearlier team lane
  • No free re-ordering. The answer assembles in a source-forced order (teammate constraint, consistent with all failures).
  • Mechanism beats theme. Every solid advance came from pixels + arithmetic (teal marks, fabricated digits, palindromes), not vibes.
  • The author telegraphs conventions: palindromic rows, reversal-invariant bit codes, delimiter semaphore — extraction is designed to be orientation-proof. Ambiguity we still feel usually means a cue is still unread.

Live theories, ranked

  1. Assembly layer over the chain (primary, updated). Transform-space over the chain output is exhausted — the missing step is how the seven panels consume the chain letters. The multiplicity correspondence (two-letter straddle ↔ two selecting panels; Baudot's stated A covering the torn row 0) is too aligned to be chance. Open: which of f/a goes to the angular vs cream panel, whether row 8's D is a letter or a word break, and what ordering the consumption imposes (current best strings AiAMfaF / AAfaiFM are not yet English).
  2. Panel letters as tract keys (secondary). Panel A1Z26 values (1,23,1,9,12,12,14) mod 10 select rows {1,3,1,9,2,2,4}; the teal-marked rows {2,3,4} are exactly those selected by the W, L, L, N panels, and the row-2 mark straddles two letters where two panels select row 2. Under this model the answer is 7 letters in panel order with rows 1 and 9 still rule-less: _ i _ _ f/a f/a F. No completion found yet.
  3. Duck-duck-goose gating (structural). The goose panel (2) hosts the answer; the swan panel (6) may flag which letters/rows are "not ducks" and get excluded. Untested combinatorially against the chain.
  4. Parked curiosities (unpromoted, kept honest): the rows' own hi-cents digits read 5967-29·862 (phone-number shape; fits the Cap'n Crunch phreaking wink in CRUN_C); teal letters {f,a,i,F,d} are one letter off DAFFY; "WebsterFind" may simply re-anchor FIND THE ANSWER.

Direction — shortest paths to the answer

  1. Photograph the torn row 0. If any fragment of Watsco B's Hi cents survives under the collage's torn edge (raking light, oblique angle), the chain gains its seed and row 1's letter. This is the single highest-value physical action.
  2. Re-shoot the tract edges — anything left of the %chg column (a fourth number would change the chain), and below row 10 (partial digit tops are visible).
  3. Work the assembly layer, not more transforms — the chain-twist sweep is complete and decisively negative on transform-space. Concretely: settle row 8 (letter D vs word break), resolve the f/a straddle assignment against the angular-vs-cream panels' own semantics, and re-examine what ordering the seven consuming panels impose on A i A M f a F.
  4. Then live-test at the BBS only with a full derivation, one polite attempt per exact string, and log every result. Anagram-grade guesses have now cost five strings — the never-retry list is getting expensive.

Candidate board

Current candidate standing
CandidateSupportStatus
ALLINAWALL / INAWALLexact tile anagramfalsified
ISLIKEAWOMBATrival lane; contradicts verified extractionsrejected, do not test
chain-rule output (reading TBD)authored mechanism, worked examples, fabrication designprimary — needs final step
DUCKDUCKGOOSEreal odd-one-out structure; no letter derivation; unspellable from tract (U)thematic only — hold
UGLYDUCKLINGswans painted as cream ducklings; no derivationthematic only — hold
WATERCRESS-class row spellingsspellable one-letter-per-row; no digit rule produces themshelf

Full evidence chain lives in the repo: problem-12/investigation/reference-drop-order.md, hill-ghost-text*.md, bird-audit.md, tract-deep-dive.md, cream-crunc-and-grid-probes.md, structure-synthesis-2.md, candidates.md.