Writeup for Python: Impossible

Problem

This is a challenge called "Daily AlpacaHack 2026/05/21 Python:Impossible".

What I tried

I examined the provided files.

chall.py

#!/usr/bin/env python3
import os
import sys


n = int(sys.argv[1])
# The following asserts are contradictory.
assert n > 0
assert n < 0

print(os.getenv("FLAG", "Alpaca{dummy}"))

n = int(sys.argv[1]) converts the first argument provided during program execution into an integer and assigns it to n.

assert n > 0
assert n < 0

This is the biggest contradiction in the code. The assert statement raises an AssertionError and forces the program to terminate if the condition on the right is not met. The first assert requires n to be greater than 0, while the second requires n to be less than 0. No such number exists. Therefore, running this normally will always result in an error at one of these lines, and the program will stop. If I can somehow bypass this condition, the FLAG will be printed.

server.py

#!/usr/bin/env python3
import os
import subprocess
import sys


name, value = input("env> ").split("=", 1)
arg = input("arg> ")
chall = os.path.join(os.path.dirname(__file__), "chall.py")

subprocess.run(
    [sys.executable, chall, arg],
    env=os.environ | {name: value},
    stdin=subprocess.DEVNULL,
    timeout=3,
)

name, value = input("env> ").split("=", 1) waits for standard input from the user. It splits the input string once by the "=" sign. For example, if the user enters HOGE=fuga, name will be "HOGE" and value will be "fuga".

arg = input("arg> ") takes the input string from the user and assigns it to the arg variable. This will be the argument passed to chall.py.

Regarding chall = os.path.join(os.path.dirname(__file__), "chall.py"), looking from the innermost parentheses outward: __file__ is a special variable provided by Python. It contains the file path of the script currently being executed (server.py). os.path.dirname(...) strips the last filename part from the provided path, extracting only the parent folder path. This is then joined with "chall.py" using os.path.join(..., "chall.py") to store the full path of chall.py in chall.

subprocess.run(
    [sys.executable, chall, arg],
    env=os.environ | {name: value},
    stdin=subprocess.DEVNULL,
    timeout=3,
)

sys.executable points to the Python interpreter (python3) currently running. In other words, it constructs the command python3 chall arg, where chall and arg have already been assigned. Next, it executes the command by adding the user-inputted name=value pair to the server's current environment variables. The pipe symbol (|) is used to merge the current environment dictionary with the new one. If the same key exists in both, the value from the right dictionary overwrites the left. Finally, it blocks keyboard input while chall.py is running and sets a timeout to kill the process if it takes longer than 3 seconds.

Python's assert statement is a feature originally intended for debugging during development. I looked for ways to ignore assert statements and found the -O option. However, while I would like to run python3 -O, the arg is placed after the filename, making python3 chall.py -O impossible. I then learned that there is a dedicated environment variable that, when set, makes the process ignore assert statements exactly as if the -O flag were used on the command line. That environment variable is PYTHONOPTIMIZE. For the env> input, I specify PYTHONOPTIMIZE=1. For arg, any integer will suffice. PYTHONOPTIMIZE=0 is equivalent to level 0 (no optimization). =1 is level 1 (basic optimization), and =2 or higher is level 2 (maximum optimization). Therefore, the number following PYTHONOPTIMIZE= can be anything 1 or greater.

FLAG

Alpaca{python_optimization_skips_asserts}