Reverse Engineering an ASIC with a Laptop and z3: How One Engineer Cracked Jane Street's Chip Puzzle
Forget the usual imagery of chip reverse engineering—acid decapping, electron microscopes, cleanrooms. In August, quantitative trading firm Jane Street showed that you can "tear down" a chip using nothing but files and a laptop.
On August 5, Jane Street published a puzzle: *Can you reverse engineer an ASIC?* They designed their own chip and released only the GDS layout—the final mask data containing all metal, routing, and transistor layers—plus a few input/output samples. The challenge author put it this way: "The GDS is, in a very real sense, the chip. Everything the circuit does is in there. The tricky part: nothing is labeled!"
The prize? Merchandise and an official blog feature. No cash.
A Month-Long Rabbit Hole
On September 4, an engineer using the handle Jestoph published a full solution, scoring 427 points on Hacker News. His self-description was brutally honest: "Why do I always do things the hard way?" He holds an EE degree but has never worked as an engineer.
His pipeline involved zero acid:
1. Parse the GDS with gdstk—the warm-up puzzle alone contained 27 components.
2. Identify the sky130 standard cell library, matching pins by geometric overlap.
3. Run a polygon-overlap graph algorithm (~1k paths, 17k polygons) to extract a netlist and generate Verilog.
4. Simulate with iverilog, inspecting waveforms in surfer.
5. Solve with z3 to recover the 120-bit input, yielding the answer string (* TWO STARS *).
Along the way he built a sqlite3-driven circuit simulator, a homemade hardware description language, and a raylib-based GDS viewer—then threw them all away, adding "Aren't you glad you skipped it?" HN commenter swiftcoder quipped that he'd never seen such a severe case of not-invented-here syndrome.
His verdict on z3 was the happiest line of the writeup: "It's kind of magical?"
He also found a genuine bug—an undriven wire—reported it nervously, and received an email from Jane Street the next day confirming he was right.
The Reveal: Sudoku's Cousin
Multiple independent solvers reconstructed the circuit's true identity: an 11×11 Star Battle checker. Star Battle is a logic puzzle in the Sudoku family—place two stars in every row, column, and region, with no two stars adjacent. The chip validates a puzzle solution in hardware: a 120-bit input encodes the board, and it takes 121 clock cycles to produce a verdict.
Correct answers output (* TWO STARS *); failures output TRY AGAIN; an empty board yields EMPTY SKY; some overflow condition produces BIG BANG. Someone taped out a logic puzzle with four easter-egg strings.
One easily missed detail: he wasn't first. A solution appeared on sunaabh.com on August 18 (using the KLayout API for netlist extraction), and KarelPeeters posted a gist on August 22 (Yosys + SAT solving). What Jestoph uniquely had: an officially email-confirmed submission, the bug discovery, and the best storytelling—the last one worth 427 points, over three times the original puzzle post's 119.
The AI Ban Lasted Weeks
The rules included a bolded request: "Please don't feed the puzzle files directly into an AI tool, nor use it to generate your writeups." In the solution thread, some reported ChatGPT reaching the answer within an hour, and one person reproduced it with Codex (transcript: "Worked for 12m 36s")—though it leveraged the already-public circuit reconstruction. The ban survived from August 5 until the September 4 deadline, roughly the contest's lifetime.
The Ladder
Jane Street's puzzles build on each other:
- Monthly puzzles: paper-and-pencil, roughly bi-monthly
- 2017–2022: ETC (Electronic Trading Challenge), simulated markets, cash prizes
- Feb 2025: neural network reverse-engineering puzzle (mechanistic interpretability)
- Aug 2025: ASIC layout reverse engineering via GDS masks
- Future: winners may get their own chip designs taped out
A free security lesson: the layout *is* the function. Leak the GDS and you leak everything the chip does—a laptop, some open-source libraries, and a month are enough.
As for whether the physical chip exists? Unknown. The layout in the puzzle was real, and the answer strings were real. The rest, the emails didn't say.