How CTF scoring works: static, dynamic and beyond

CTF scoring is the set of rules that turns solved challenges into a ranking. With static scoring each challenge keeps a fixed value. With dynamic scoring its value decays toward a floor as more teams solve it. Hints can cost points, ties go to whoever got there first, and attack-defense, king-of-the-hill and report-based formats score ticks, hold time or severity.

New to CTFs? Start with what a CTF is and how points work. This guide goes deeper and is written for the people who set the rules: club leads, faculty coordinators, conference CTF teams and anyone hosting a CTF.

Static vs dynamic scoring

Static scoring gives every challenge a fixed value. A warm-up might be worth 50 points and a hard heap exploit 500, and those numbers never change. Players know what a solve is worth, but the organizer has to price difficulty in advance. If a "hard" challenge turns out to have an unintended shortcut, 80 teams collect 500 points each and the ranking stops measuring skill.

Dynamic scoring, also called decay scoring, lets the field set the price. Each challenge starts at a high value, and its value falls as solves come in. A challenge only three teams crack stays near its maximum; one half the field solves drops toward a floor. On most platforms that use it, everyone who solved the challenge gets the current value, so early solvers lose points as later teams catch up.

Mixed setups are common. Warm-ups or sanity-check challenges stay static at a token value, and everything else decays. CTF7 supports both static and dynamic scoring, and the real-time scoreboard shows rankings, points, solves and time taken. Terms used here are also in the glossary.

Decay curves explained

Every decay scheme answers one question: how much is this challenge worth after s teams have solved it? Almost all of them use the same three parameters:

• Initial value, the maximum: what the challenge is worth before anyone solves it, often 500 or 1,000.
• Minimum value, the floor: the lowest it can fall, so even a heavily solved challenge still pays something. Floors of 20 to 25 percent of the initial value work well.
• Decay: how many solves it takes to reach (or nearly reach) the floor. A larger decay means slower decay.

What differs is the shape of the curve between the maximum and the floor. Three shapes cover most real implementations:

# s = number of solves, I = initial, M = minimum, D = decay

linear       value = max(M, I - (I - M) × s / D)
parabolic    value = I + (M - I) / D² × s²        (M once s ≥ D)
exponential  value = M + (I - M) × e^(-k × s)      k = ln(50) / D

Parabolic (quadratic) decay

The parabolic (quadratic) curve is a common choice. It falls slowly at first and steeply near the decay point. Early solvers of a hard challenge keep almost full credit, and a challenge that proves easy for this field drops fast. With 500 / 100 / 30, the value is still 456 after 10 solves, 322 after 20, and hits the floor at 30.

Linear decay

Linear decay takes the same number of points off for each solve until the floor. It is the easiest to explain on a rules page ("each solve reduces the value by about 13 points"). The trade-off is that early solves on hard challenges cost as much as late solves on easy ones, which punishes the first teams more than many organizers intend.

Exponential (long-tail) decay

Exponential decay falls fastest at the start and then flattens into a long tail just above the floor. With the same 500 / 100 / 30 settings, a challenge is worth only 308 after 5 solves. It strongly rewards challenges very few teams solve and suits elite events where separating the top ten matters more than ranking the middle of the board. Logarithmic decay, the third option in the separate dynamic scoring calculator, has a similar front-loaded shape but lands exactly on the floor at the decay count. Some platforms also use logistic or other S-shaped variants that sit between these shapes.

Public scoreboards and platforms document their own variations on these three shapes, so always publish your exact formula in your rules rather than pointing players at someone else's.

Interactive decay calculator

Set an initial value, a floor and a decay, pick a curve, then drag the solves slider to see what a challenge is worth at any point in the event. Turn on "compare" to overlay all three shapes with the same parameters. Hover or tap the chart to read every curve's value at a given solve count.

How to choose decay parameters for your event

There is no universal setting, but a few rules of thumb hold across events:

1. Scale decay to your field. Set decay close to the number of teams you expect to solve your easiest non-warm-up challenge. For a college CTF expecting 200 teams, a decay of 30 to 60 keeps mid-level challenges meaningful. For a 30-team class event, 8 to 12 is enough.
2. Keep the floor meaningful. A floor of 0 or 10 means beginners who solve five easy challenges have almost nothing on the board, which hurts motivation. A floor of 20 to 25 percent of the initial value keeps the bottom of the leaderboard alive.
3. Start every decaying challenge at the same value. One initial value, such as 500, lets solve counts do the pricing, and it is the easiest rule to defend when a team disputes a value. Giving "easy" challenges a lower ceiling brings back the guesswork dynamic scoring is meant to remove. The exception is a small field, say a 30-team class, where there are too few solves for decay to separate easy from hard. There, a lower ceiling for warm-up and easy tiers (100 to 200 against 500) is a reasonable compromise, as long as the rules say so. Sanity-check flags can stay static at a token value either way.
4. Decide whether decay is retroactive. Most dynamic scoreboards recompute every solver's points. Some events freeze each team's points at solve time to reward speed. Either can be fair, but the rules must say which.

For deciding which challenges to build in the first place, see how to create CTF challenges. To budget the whole event, try the CTF cost calculator; to compare decay curves in a separate chart-and-table view, use the dynamic scoring calculator.

Hint costs: pricing help fairly

Hints keep stuck players moving, and charging for them keeps the board honest: a team that solved unaided should outrank one that needed help. Common models:

• Flat cost. Each hint costs a fixed number of points, for example 50. It is simple, but under dynamic scoring a 50-point hint on a challenge that has decayed to 120 points is a much bigger penalty than on one still worth 480.
• Percentage of the challenge value. The hint costs, say, 20% of the challenge's current value. This scales naturally with decay and is the fairest fit for dynamic events.
• Escalating tiers. The first hint is a cheap nudge and later hints are more revealing and more expensive.
• Free hints. Common in beginner and classroom events, where the goal is learning rather than ranking.

Decide two edge cases in advance. Does a team pay for a hint even if it never solves the challenge? (Usually yes: the cost is charged on unlock.) And can a hint cost push a team's score below zero? (Usually no.) On CTF7, point-cost hints are built in and are a Standard plan feature (see pricing). Write your hint policy into your CTF rules.

Tie-breaks by time

Ties are common, especially in beginner events where several teams clear the board. The standard rule is simple: among teams with equal points, the team that reached that score first ranks higher. In practice that means comparing the timestamp of each team's last scoring submission.

NullPointers and ByteBandits finish level, but NullPointers got to 4,120 forty-five minutes earlier, so they take first. Rootkit Rangers finished earliest of all, but time only breaks ties. It never outranks points.

Variants you will see in published rules:

• Oldest latest-solve timestamp. The rule above, and the most common default.
• Elapsed time. For events where each player starts their own timed window, ties go to the shorter time from start to final score.
• Secondary criteria. Fewer hints used, fewer wrong submissions, or (for report-based formats) report quality.

One subtlety with dynamic scoring: because values change after a team's last solve, two teams can become tied, or untied, without doing anything. Always break ties on final recomputed points.

First blood: what it is and how events reward it

First blood is the first valid solve of a challenge in an event. How they reward it varies a lot:

• Announcement only. The event posts first, second and third bloods to the scoreboard feed or a Discord channel, with no points attached. Some organizers choose this deliberately on fairness grounds.
• Percentage bonus. The earliest solvers get a small bonus on top of the challenge value.
• Fixed bonus. A flat number of extra points for the first solver. Large flat bonuses can decide an event by themselves.

Bonuses reward speed, and speed depends partly on luck: time zone, network lag or opening the right challenge first. If you do award a bonus, keep it small relative to challenge values, for example under 5%, and make sure everyone gets the same start time. Parabolic decay already rewards early solvers of hard challenges, so many organizers find a public shout-out is enough. See first blood in the glossary.

Attack-defense scoring: ticks, flags and SLA

In an attack-defense CTF, every team runs an identical vulnbox with the same vulnerable services. Teams patch their own services and attack everyone else's. Scoring runs on a fixed clock called a tick, often one to three minutes long. Each tick:

1. A checker plants fresh flags in every team's services and confirms older flags are still retrievable.
2. The checker rates each service UP, MUMBLE (responds incorrectly), CORRUPT (earlier flags missing) or DOWN. Only UP earns SLA points.
3. Teams submit flags stolen from rivals. A flag is valid only for a set number of ticks, its flag lifetime, so old loot can't be banked.
4. The scoreboard adds attack points for captures, subtracts defense points for your own lost flags, and adds SLA points for uptime.

# additive model (per tick, per service)
score += attack + defense + SLA

# SLA-multiplied model
score = (attack + defense) × (ticks UP ÷ total ticks)

The two models handle availability differently. Under the multiplied model, being down for 30% of the game cuts all offense and defense points by 30%. That makes "unplug it to stay safe" a losing strategy. Some game servers also scale attack points by the victim's rank or by how many teams stole the same flag, so the first exploit against a strong team is worth more than the hundredth against a weak one.

How the format itself runs (vulnboxes, network setup, team sizes) is covered in CTF formats. On CTF7, attack-defense is run as a managed event by our team, on request, rather than as a self-serve setting.

King of the Hill: scoring hold time

In King of the Hill, teams compete for control of shared machines ("hills"). A team that gains control writes its identifier to an ownership marker, then defends the machine against rivals while keeping it working. The scorer reads every hill at a fixed interval and credits whichever team holds it:

score = Σ hills (checks held × hill rate) + capture bonuses

The design decisions that matter:

• Check interval. Short intervals (30 to 60 seconds) make control change hands visibly on a projector; longer ones reward stable defense.
• Hill rate. Harder hills pay more per check, so teams don't all crowd the easiest machine.
• Capture bonus. A one-time bonus for taking a hill rewards initiative. Keep it small so an early capture doesn't decide the game.
• Service availability. If a team "defends" by breaking the hill's service, the check should credit no one. That keeps the rules about holding a working machine, not trashing it.

Ties in KotH are usually broken by total time held across all hills. Like attack-defense, King of the Hill runs on CTF7 as a managed event, scoped and operated by our team on request.

Raw Ops: scoring reports with CVSS 4.0

Some competitions have no flags at all. In Raw Ops, CTF7's report-based "anti-CTF" format, participants investigate a realistic target and submit vulnerability reports, as on a VAPT engagement. Triage reviewers reproduce each report, reject invalid or out-of-scope findings, merge duplicates and confirm the severity. Accepted findings are scored using CVSS 4.0, and chaining several weaknesses into a higher-impact path is encouraged.

CVSS 4.0 produces a 0.0 to 10.0 base score with standard severity bands: Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0). Report-scored events typically turn that into points in one of two ways:

The point values above are illustrative, not a fixed CTF7 schedule.

Because points follow triaged severity, not the reporter's own estimate, CVSS literacy becomes a competitive skill. Our CVSS 4.0 guide explains the metrics with web and API examples. The vulnerability report template shows what a report needs to survive triage. For blue-team events, SOC simulations focus on alert triage, log analysis and incident reports, with scoring scoped per managed event.

Scoring and public CTF listings

Fair, transparent scoring, stable infrastructure and well-tested challenges are what teams remember about an event. If you plan to list your CTF on the global CTF calendar, step-by-step advice is in how to list your CTF on CTFtime.

Checklist: publish your scoring rules

Whatever model you pick, write it down before registration opens.

• Scoring type per challenge group: static values, or the decay formula with initial, floor and decay.
• Whether dynamic values are retroactive for earlier solvers.
• Hint costs, when they are charged, and whether scores can go negative.
• Tie-break order, for example earliest final score, then fewer hints.
• First-blood handling: announcement only, a bonus (and how big), or none.
• For A/D: tick length, flag lifetime, checker statuses and the attack/defense/SLA formula.
• For KotH: check interval, hill rates and capture bonuses.
• For report-based events: severity source, duplicate policy and how chains are scored.
• Flag-sharing rules and how they are enforced. Dynamic flags and anti-cheat catch most copied flags. See also what a dynamic flag is.

Our CTF rules template includes a scoring section you can copy. When you are ready to run it, tell us about your event and we'll point you to the right plan for your scoring, hints and scoreboard needs.