Cycle refund exploit demo

8

ryzzut 2026-06-03 20:01

Probably something for the connoisseurs…

Maybe this is known behavior? I stumbled across it when asking an LLM about the source code (so I don’t claim this is a genius discovery).

COPY accepts negative length parameters, ignores them and then deducts negative cycles, which allows refilling the cycle count.

This essentially allows you to create impossible raster effects.

If it is known, just ignore it. Sorry.

I love the platform and have been playing with it for years and my kids, too.


Timo 2026-06-03 20:11

That’s new to me :O
And so it will stay… Don’t want to fix things anymore. It’s just like old hardware or system ROMs, they had bugs and they never got fixed ;)


wryhode 2026-06-04 10:12

this is huge! thank you, i never thought of that


qwaffe 2026-06-04 13:04

it's not only useful for raster, it can speed up any slow program !


Sylveon 2026-06-05 18:30

Man this is crazy! And if I copy a -25 byte chunk of data from $A000 to $E000, will it copy 25 bytes from $A000 to $E000 but I deducts cycles? :3


ryzzut 2026-06-05 21:26

You can build a real DOT(X, Y) graphics primitive with this. This implementation is probably really suboptimal. Just as an example.

Bouncing Lines.nx | Open in app
2026-06-05 21:26

ryzzut 2026-06-05 21:30

This is smooth on my phone (vibe coded based on the DOT primitive).

Cubes Of Horror.nx | Open in app
2026-06-05 21:30

moechofe 2026-06-08 12:55

Oh, I'm just late to this news and discover it the hard way.
I debug the code, and it actually copy nothing.


moechofe 2026-06-08 13:00

@Sylveon For this to work, you just need to specify a destination address bigger than the source address, that's all.


Sylveon 2026-06-09 04:04

@moechofe oh right now I found out you can copy an address to the same address with the negative byte length and be still able to write to it without it being copyed somewhere else and still have the Cycle Refund :3


nathanielbabiak 2026-06-12 00:19 (Edited)

This is great! This is enough for another display system...


nathanielbabiak 2026-06-13 05:50 (Edited)

I want to put this in rilden's cycle counter to map the exact nature of the exploit...


Log in to reply.