SE050 Secure Element
NXP EdgeLock SE050C2 at 0x48, enabled from GPIO8. Keys are generated and used inside the chip — the ESP32 asks it to sign and never sees the private half.
DEF CON 34 // LAS VEGAS
Solana Badge
DEF CON 34
Six buttons, stereo ears
and a secure element.
An ESP32-S3 handheld built for the one conference where the badge itself is the challenge. A 2.8" LCD, a D-pad you can actually play with, two microphones for direction, two addressable LEDs for signalling — and hardware key storage that does not trust the processor next to it.
DEF CON 34 · Las Vegas
Built for the Solana community
Hardware by SkyRizz
2.8"
ILI9341 SPI LCD
ESP32-S3
N16R8 Module
6
Buttons via I²C
Stereo
PDM Microphones
SE050
Secure Element
585
Vias · 2 Layers
THE CORE
ESP32-S3.
Sixteen megabytes.
An ESP32-S3-WROOM-1-N16R8 anchors the back of the board — dual-core LX7, Wi-Fi and Bluetooth LE 5, 16 MB of flash and 8 MB of octal PSRAM. Enough headroom to hold a framebuffer, a stereo audio buffer and a real application at the same time.
The octal PSRAM consumes GPIO35 through GPIO37 internally, so those never leave the module. Everything else is either committed to a peripheral or broken out to the ten-pin header along the top edge.
MCU MODULE
ESP32-S3
DISPLAY
J5 · 18-WAY FPC
SCK
GPIO11
SPI clock
MOSI
GPIO15
Data to panel
CS / DC
GPIO12 / 13
Select · command
RST
GPIO14
Panel reset
BL
GPIO7
Backlight · PWM
DISPLAY
A 2.8" panel
on the front face.
An ILI9341 running 320 × 240 in landscape, bonded to the front and driven over SPI. Its ribbon passes through a slot in the middle of the board to reach the FPC connector on the reverse, so nothing crosses the face you actually look at.
The backlight is transistor-driven from GPIO7 — put it on an LEDC channel and you get smooth dimming and fade-in, which the factory test firmware already exercises on boot.
CONTROLS
Six buttons.
Two wires.
A four-way D-pad on the left, SELECT and CANCEL on the right — six 6 × 6 mm tactiles, none of them wired to the processor. They all report through a TCA9534 expander at address 0x20, each with a 10 kΩ pull-up so a press reads as zero.
One open-drain interrupt on GPIO4 fires whenever anything changes, so the firmware never polls. Six inputs collapse into a single register read, and six GPIOs stay free for whatever you bolt onto the header.
TCA9534 · 0x20 · PRESSED = 0
UPP0
LEFTP1
RIGHTP2
DOWNP3
CANCELP5
SELECTP4
Change interrupt on GPIO4 — open-drain, no external pull-up, so enable the internal one.
IN STEREO
Two microphones.
Two RGB LEDs.
Most badges get one of each. This one gets a pair — which is the difference between hearing a sound and knowing where it came from, and between blinking and actually signalling.
PDM MICROPHONES · SHARED I²S
MK1
LEFT
SPH0641LM4H
CLK 47DATA 48
MK2
RIGHT
SPH0641LM4H
Both mics share one clock and one data line — each is assigned an edge of the PDM clock, so a single I²S peripheral captures the pair.
ADDRESSABLE RGB · SINGLE WIRE
D3
RGB 1
WS2812B-compatible
DOUT →DIN
D4
RGB 2
WS2812B-compatible
Chained from GPIO2 — the first LED's output feeds the second, so both are addressed independently over one data line.
ONBOARD
What else
is on the board.
A hundred and twenty placements across two layers — power, identity, I/O and the bits that make a badge survive a weekend off a single cell.
Li-Po Power Path
MCP73831 charger, DW03D cell protection and a pair of AO3401A MOSFETs that hand over between USB and battery automatically. Red and blue LEDs report charge state.
Battery Gauge
A 2.2 kΩ divider puts half of VSYS on GPIO1 (ADC1_CH0). Read it, double it — and remember it tracks the system rail, so the number jumps when USB is plugged in.
Expansion Header
A 1×10 2.54 mm header along the top edge — the only through-hole part. Eight free GPIOs plus VSYS and GND, every pin labelled on the silkscreen.
Reset & Boot
RST1 and BOOT1 on the back, plus the classic two-transistor auto-program circuit off the CH340C — so esptool can drop the board into download mode on its own.
Touch Option
A six-pin FPC footprint sits on the bus for a capacitive panel, and the test firmware already speaks GT911. Unpopulated on this revision — GPIO5 and GPIO6 stay free.
I²C BUS
SCL GPIO9 · SDA GPIO10
0x20
TCA9534
Six-button expander
0x48
SE050C2
Secure element
INT
GPIO4
Button change · open-drain
SPARE
J6 header
Capacitive touch option
ONE BUS
A healthy board
answers twice.
Scan the bus on a working badge and exactly two devices reply: the button expander at 0x20 and the secure element at 0x48. That is the fastest bring-up check there is — if both answer, the I²C side of the board is good.
The same two wires reach the spare FPC header, so a capacitive touch panel or any other I²C peripheral drops straight onto the existing bus without touching the layout.
UART / HID
Pick your USB
with a slider.
The USB-C data pair lands on a DPDT switch on the back. One position routes it to a CH340C bridge — a plain serial port, with the auto-reset circuit intact so esptool behaves. The other sends it straight to the ESP32-S3's native USB.
That second position is where a badge gets interesting: USB-Serial/JTAG for debugging, or TinyUSB to enumerate as a HID device. The test firmware ships with a mouse self-test to prove the path works.
S1 · DPDT DATA MUX
USB-C · D+ / D−
UART
CH340C
Serial port
auto-reset works
auto-reset works
HID
Native USB
JTAG · TinyUSB
GPIO19 / 20
GPIO19 / 20
TEST KIT
SERIAL · 115200
s
I²C scan
Expect 0x20 + 0x48
m
Microphones
Live stereo level bars
e
SE050 re-test
Soft reset + ATR read
g
RGB self-test
Both LEDs in the chain
b
Battery
Divider reading
r
Status report
Everything at once
BRING-UP
It arrives already
able to test itself.
Every badge ships flashed with a factory test image — a single Arduino sketch that drives the panel, walks the button expander, captures both microphones with live level meters, talks to the secure element and reports the battery, all mirrored to the LCD and the serial console.
Logging goes to both UART0 and the USB CDC port at once, so a board can be diagnosed over whichever cable happens to be plugged in. Single keystrokes re-run any individual test.
WHAT IT BECOMES
A badge is just
a handheld with a lanyard.
Screen, buttons, radio, stereo audio, addressable light and a secure element — handed to a few thousand people who take hardware apart for fun.
01
Hardware Signer
Keep a Solana keypair inside the SE050 and approve transactions on-screen with SELECT. The key is generated in the element and never crosses to the processor.
02
Badge Games
A D-pad, two action buttons, a 320 × 240 panel and 8 MB of PSRAM. Everything a jam entry needs, and nothing to solder before you start.
03
Direction Finding
Two microphones a known distance apart give you phase difference — which gives you bearing. Point the badge at a sound and have it tell you where the sound is.
04
Badge-to-Badge
Wi-Fi and BLE are already on the module. Trade signed handshakes over ESP-NOW, build a proof-of-meeting graph, or run a room-wide scoreboard.
05
HID Injection
Flip S1 to the native USB side and the badge enumerates as a keyboard or mouse. The stock firmware already includes a HID self-test to build from.
06
Your Own Add-on
Eight free GPIOs and VSYS on the top header, plus a spare I²C FPC seat. Solder on a radio, a sensor, a shitty add-on — the badge becomes whatever the weekend needs.
BADGES FOR YOUR EVENT
Need a badge
that does something?
SkyRizz takes event badges from schematic to assembled hardware — layout, fabrication, factory test firmware and all.