This is a nice straightforward challenge. I probably made around 1.5 million queries before I stopped and verified my code and found a silly mistake ( I base64 decoded an initial hex encoded data ¯_(ツ)_/¯ ) After fixing the mistake it took about 19000 queries to find the flag.
I am curious how the challenge was constructed. The paper suggests that it should take around 1 million queries, but this challenge requires 19000 only. It is highly unlikely to be a random occurence. Is there a way to construct this kind of challenge with any given complexity, or was it a trial and error approach?