diff --git a/challenge/js-pow-sha256/runtime/runtime.go b/challenge/js-pow-sha256/runtime/runtime.go
index 94541a9..63e0412 100644
--- a/challenge/js-pow-sha256/runtime/runtime.go
+++ b/challenge/js-pow-sha256/runtime/runtime.go
@@ -70,10 +70,14 @@ func VerifyChallenge(in challenge.Allocation) (out challenge.VerifyChallengeOutp
 		result := make([]byte, inline.DecodedLen(len(in.Result)))
 		n, err := inline.Decode(result, in.Result)
 		if err != nil {
-			panic(err)
+			return challenge.VerifyChallengeOutputError
 		}
 		result = result[:n]
 
+		if len(result) < 8 {
+			return challenge.VerifyChallengeOutputError
+		}
+
 		// verify we used same challenge
 		if subtle.ConstantTimeCompare(result[:len(result)-8], c) != 1 {
 			return challenge.VerifyChallengeOutputFailed
diff --git a/challenge/js-pow-sha256/runtime/runtime.wasm b/challenge/js-pow-sha256/runtime/runtime.wasm
index d68cbd7..a627793 100644
Binary files a/challenge/js-pow-sha256/runtime/runtime.wasm and b/challenge/js-pow-sha256/runtime/runtime.wasm differ