Rubber Duck Stamp — investigation crystallization

DEF CON 34 Gold Bug, puzzle 12 (IRL). Everything established, everything falsified, the live theories, and the shortest paths to the answer. Compiled 2026-08-08 from problem-12/investigation/.

Artwork panels
7
6 letter tiles settled
Birds painted
15
ducks + 2 geese + 3 swans
Tract rows
10
fabricated stock listing
Falsified strings
5
never retry
Where it stands

No confirmed answer yet. The extraction machinery is nearly fully mapped — display order, six of seven letter tiles, the tract's chained digit rule with its painted worked examples — but the final reading of the chain output (the teammate's "missing logical step") is still open. The strongest levers are listed under Direction.

What is established

  • Display order is photographed (reference drop ref-05): Baudot → blue collage → Hill → LFSR → angular semaphore → cream trio → red linocut.
  • One output tile per panel, in order: A · W · ALLA · I · L · L · N. Every tile has an independent reconstruction.
  • Hill's row 2 is palindromic under all three pipelines — raw Polybius AYYA, decrypt K⁻¹ ALLA, encrypt K ANNA. Deliberate direction-invariant design; an erased pencil "mod 5" caption sits under the ink MOD5.
  • The collage's Ogham instruction reads: IGNORE THE SQUARES AND FIND THE ANSWER. READ THE TRACT. The tract is the final assembly medium, not just the source of "W".
  • Answer format calibration (solved puzzles): concatenated uppercase English phrases, 9–16 letters, descriptive — ORANGESCARF, THREEMINUTESLATE, STRANGEBUZZING.

The seven panels

Panel mechanisms in display order
#PanelMechanismOutputTile
1B&W engravingBaudot / ITA2 punch tape (24 frames)"THE LETTER NEEDED IS A"A
2Blue collageOgham strip + newsprint tractinstruction + ten W companiesW (tract holds more — see below)
3Hill watercolorHill cipher, K=[[1,2],[2,0]] mod 5plaintext grid row 2ALLA / A
4Salmon pintails8-bit LFSR, "CLOCK 9 / READ REGISTER"01001001 = 0x49I
5Wood ducksFlag semaphore, D as delimiter"USE THE LETTER L"L
6Cream trioSix segment-display cells, CRUN_Cright-side bits 001100 = 12L (M if A=0)
7Red linocutManchester + RDS differential decode1101110N

The ordered string AWAILLN (all per-slot variants included) spells nothing, survives no classical transform (atbash, caesar, vigenère with panel keys), and is not a subsequence of any known duck idiom. The letters must be consumed by a mechanism, not read.

The birds: duck, duck, goose (and swans)

Pixel-level species audit of all fifteen birds: panel 2's white birds are snow geese (grin-patch bills), panel 6's cream trio are tundra swans (black bills, yellow lores). Family string across the display: D G D D D S D — and the first three birds of the row, left to right, literally read duck, duck, goose.

  • Species in order: rubber ducks, snow geese, long-tailed duck pair, northern pintails, wood ducks, tundra swans, mandarin drakes (the only same-sex pair).
  • Facing pattern RRRLLRL verified bird-by-bird; duck counts 2222232.
  • Species initials spell nothing in order under any naming scheme; the rival "WOMBAT" bird-channel claim does not survive the pixels.
  • The odd birds sit at positions 2 (goose = the collage, i.e. the tract panel) and 6 (swans). Best structural reading: the goose panel is where the answer lives — which is exactly where the authored tract rule was found.

The tract and the chain rule

The tract is a fabricated WSJ-style listing — ten consecutive W companies with three numeric columns (%chg, 52-wk hi, lo) — glued into the collage, with an authored annotation layer: three teal paint marks, one navy blot turning WebsterFinl into WebsterFind, and one bold row.

Exact transcription (every digit cross-read in 2+ photos)
Row%chgHiLoNameAnnotation
0…tsco B (Watsco B)torn — numbers unreadable
125.28394.54251.17WattsWater
2−15.45119.9855.60Wayfairbold row; teal on f–a (pos 4–5)
322.6977.6952.69WebsterFinlteal on i (pos 9); blot → "WebsterFind"
4−7.2497.7672.78WellsFargocapital F (pos 6) repainted teal
526.31255.20161.26Welltower
640.41377.90197.96WescoIntl
723.92386223.83WestPharmSvchi printed with no cents
8216.27799.8773.14WesternDigitalimpossible values
917.9048.6336.90WesternMidstrm
10−4.65124.2356.33Westlake

The chain rule (best-supported mechanism in the whole puzzle)

position(row n) = first cents digit of row n−1's Hi. Letter n = namen[position].

  • Fits all three teal marks exactly: 394.54 → Wayfair[5] = a; 119.98 → WebsterFinl[9] = i; 77.69 → WellsFargo[6] = F. The straddled row-2 mark covers both digits of 54 (f at 4, a at 5).
  • Explains the fabrications: the .69/.69/.69 row makes row 4 = F under every column choice, and 386's missing cents deliberately skips row 8.
  • The paradox: full output rows 2–10 is a i F w e m [skip] M a — not English — and row 1 is hostage to the torn row 0. The reading of this output is the open "logical step".

Ruled out for the output: all classical transforms, panel-mechanism re-encodings tried so far (fragments like ROBIN/RADAR only, noise-grade), one-letter-per-row dictionary fits (WATERCRESS et al. — spellable but mechanically unsupported), and variable-substring segmentation (under-constrained; nothing survives strict teal compliance). If the answer is spelled from tract names it cannot contain U — which rules out every *DUCK* string as a tract product.

Falsified candidates and method learnings

Live-tested or upstream-rejected — never retry
StringOriginLesson
ALLINAWALLtile multiset anagram (Hill=ALLA)exact-multiset anagrams are not the assembly rule
INAWALLtile multiset anagram (Hill=A)
FALSEIMPRESSIONearlier team lanetheme-first guessing fails; the rival "ASIILEK / WOMBAT" letter set contradicts verified extractions
ILIKEASILKIEearlier team lane
THEGAMEISAFOOTearlier team lane
  • No free re-ordering. The answer assembles in a source-forced order (teammate constraint, consistent with all failures).
  • Mechanism beats theme. Every solid advance came from pixels + arithmetic (teal marks, fabricated digits, palindromes), not vibes.
  • The author telegraphs conventions: palindromic rows, reversal-invariant bit codes, delimiter semaphore — extraction is designed to be orientation-proof. Ambiguity we still feel usually means a cue is still unread.

Live theories, ranked

  1. Chain-output reading twist (primary). The chain rule is authored; its output needs one more step. Open sub-ideas: the torn row 0 seeds the chain (its absence may be the designed entry point — e.g., start at the bold Wayfair row instead); capitals F/M in the output may mark word boundaries; the output may key one of the six duck panels' mechanisms.
  2. Panel letters as tract keys (secondary). Panel A1Z26 values (1,23,1,9,12,12,14) mod 10 select rows {1,3,1,9,2,2,4}; the teal-marked rows {2,3,4} are exactly those selected by the W, L, L, N panels, and the row-2 mark straddles two letters where two panels select row 2. Under this model the answer is 7 letters in panel order with rows 1 and 9 still rule-less: _ i _ _ f/a f/a F. No completion found yet.
  3. Duck-duck-goose gating (structural). The goose panel (2) hosts the answer; the swan panel (6) may flag which letters/rows are "not ducks" and get excluded. Untested combinatorially against the chain.
  4. Parked curiosities (unpromoted, kept honest): the rows' own hi-cents digits read 5967-29·862 (phone-number shape; fits the Cap'n Crunch phreaking wink in CRUN_C); teal letters {f,a,i,F,d} are one letter off DAFFY; "WebsterFind" may simply re-anchor FIND THE ANSWER.

Direction — shortest paths to the answer

  1. Photograph the torn row 0. If any fragment of Watsco B's Hi cents survives under the collage's torn edge (raking light, oblique angle), the chain gains its seed and row 1's letter. This is the single highest-value physical action.
  2. Re-shoot the tract edges — anything left of the %chg column (a fourth number would change the chain), and below row 10 (partial digit tops are visible).
  3. Finish the chain-twist sweep (in progress): output fed through the six duck panels' mechanisms, restart-at-bold-row, bottom-up print order, digits-as-message.
  4. Then live-test at the BBS only with a full derivation, one polite attempt per exact string, and log every result. Anagram-grade guesses have now cost five strings — the never-retry list is getting expensive.

Candidate board

Current candidate standing
CandidateSupportStatus
ALLINAWALL / INAWALLexact tile anagramfalsified
ISLIKEAWOMBATrival lane; contradicts verified extractionsrejected, do not test
chain-rule output (reading TBD)authored mechanism, worked examples, fabrication designprimary — needs final step
DUCKDUCKGOOSEreal odd-one-out structure; no letter derivation; unspellable from tract (U)thematic only — hold
UGLYDUCKLINGswans painted as cream ducklings; no derivationthematic only — hold
WATERCRESS-class row spellingsspellable one-letter-per-row; no digit rule produces themshelf

Full evidence chain lives in the repo: problem-12/investigation/reference-drop-order.md, hill-ghost-text*.md, bird-audit.md, tract-deep-dive.md, cream-crunc-and-grid-probes.md, structure-synthesis-2.md, candidates.md.